ISO 27001 checklist (2022): requirements and Annex A controls
A free, interactive self-assessment for ISO/IEC 27001:2022. Work through the mandatory ISMS requirements (clauses 4–10) and the Annex A control themes, mark your status, and track your progress. It saves in your browser and you can download a summary.
This is a self-assessment to help you prepare, not a certification and not legal advice. Under ISO 27001 you apply Annex A controls based on your own risk assessment — not every control applies to every organization. Certification is done by an accredited body.
Official source, checked on 28 Sep 2026:
ISMS requirements (clauses 4–10, mandatory)
- Context and scopeDetermine internal and external issues and interested parties, and define the documented scope of your ISMS.
- Leadership and policyTop management commitment and an approved information security policy.
- Roles and responsibilitiesAssign information security roles, responsibilities and authorities.
- Risk assessmentA defined, repeatable process to identify and assess information security risks.
- Risk treatment and Statement of ApplicabilitySelect controls, justify inclusions/exclusions in a Statement of Applicability, and maintain a risk treatment plan.
- ObjectivesSet measurable information security objectives and plans to achieve them.
- Resources, competence and awarenessProvide resources; ensure staff are competent and aware of their security responsibilities.
- Documented informationCreate and control the documents and records the ISMS needs.
- OperationPlan and control the processes and carry out the risk treatment plan.
- Monitoring and internal auditMonitor and measure the ISMS and run internal audits at planned intervals.
- Management reviewTop management reviews the ISMS at planned intervals.
- Nonconformity and improvementHandle nonconformities and drive continual improvement.
Annex A — Organizational controls (A.5, 37 controls)
- Security policiesInformation security policy and topic-specific policies, reviewed regularly.
- Roles and segregation of dutiesDefined responsibilities and separation of conflicting duties.
- Supplier and cloud securitySecurity requirements in supplier and cloud-service agreements, and monitoring.
- Access control policy and identityAccess control policy, identity and access management across the lifecycle.
- Threat intelligence and incident managementA process to receive threat information and to manage security incidents.
- Classification and handlingClassify information and handle it according to its sensitivity.
- Continuity and ICT readinessPlan for business continuity and ICT readiness for disruptions.
Annex A — People controls (A.6, 8 controls)
- Screening and termsBackground screening, terms of employment and confidentiality/NDA agreements.
- Awareness and trainingSecurity awareness, education and training for staff.
- Responsibilities and disciplineDisciplinary process and responsibilities on change or termination of employment.
- Remote working and reportingSecure remote working and a way to report security events.
Annex A — Physical controls (A.7, 14 controls)
- Perimeters and entryPhysical security perimeters and entry controls for secure areas.
- Equipment and cablingProtect equipment, cabling and supporting utilities.
- Clear desk and disposalClear desk / clear screen and secure disposal or reuse of equipment.
Annex A — Technological controls (A.8, 34 controls)
- Endpoint, malware and vulnerabilitiesEndpoint protection, protection against malware, and vulnerability management.
- Authentication and privileged accessSecure authentication, management of access rights and privileged access.
- CryptographyUse of cryptography and key management.
- Backup, logging and monitoringBackups, logging, and monitoring of activities.
- Network securityNetwork security and segregation of networks.
- Secure development and changeSecure development lifecycle and change management.
Ready to build the documents? The ISO 27001:2022 Toolkit gives you 40 editable Word/Excel documents — policies, procedures, the risk register and a Statement of Applicability with all 93 Annex A controls (€299 one-time).
Frequently asked questions
How many controls does ISO 27001:2022 have?
Annex A of ISO/IEC 27001:2022 has 93 controls in four themes: Organizational (37), People (8), Physical (14) and Technological (34). Clauses 4–10 set the mandatory management-system requirements.
Do I have to implement all 93 controls?
No. You select Annex A controls based on your risk assessment and record your choices in a Statement of Applicability. The clause 4–10 requirements, however, are mandatory.
Is this checklist a certification?
No. It is a preparation self-assessment. Certification is carried out by an accredited certification body against the standard.
Is my progress stored anywhere?
Only in your own browser (local storage). Nothing is uploaded, and you can reset it at any time.
Can I download the ISO 27001 checklist as Excel?
Yes. Click “Download for Excel (CSV)” to get all clauses and Annex A themes with your status in a file that opens in Excel, Google Sheets or LibreOffice. You can also download a short text summary.
Can I use this as an ISO 27001 audit checklist or gap analysis?
Yes, as preparation for an internal audit or a gap analysis: mark your status for each requirement and export the result. It does not replace the audit by an accredited certification body.
Is there an ISO 27001 checklist in PDF or XLS?
The checklist downloads as CSV, which opens directly in Excel (where you can save it as XLSX) or Google Sheets. Need a PDF? Open the file in Excel and print or save it as PDF.