# ISO 27001 checklist (2022): requirements and Annex A controls > Free ISO 27001:2022 requirements checklist and audit template. Track clauses 4–10 and Annex A control themes, then download for Excel (CSV). URL: https://gofirmhub.com/en/compliance/iso-27001/checklist/ Last updated: 2026-10-30 A free, interactive self-assessment for ISO/IEC 27001:2022. Work through the mandatory ISMS requirements (clauses 4–10) and the Annex A control themes, mark your status, and track your progress. It saves in your browser and you can download a summary. This is a self-assessment to help you prepare, not a certification and not legal advice. Under ISO 27001 you apply Annex A controls based on your own risk assessment — not every control applies to every organization. Certification is done by an accredited body. Official source, checked on 28 Sep 2026: - [ISO/IEC 27001:2022 — Information security management systems](https://www.iso.org/standard/27001) Progress0% ### ISMS requirements (clauses 4–10, mandatory) - Context and scopeDetermine internal and external issues and interested parties, and define the documented scope of your ISMS. - Leadership and policyTop management commitment and an approved information security policy. - Roles and responsibilitiesAssign information security roles, responsibilities and authorities. - Risk assessmentA defined, repeatable process to identify and assess information security risks. - Risk treatment and Statement of ApplicabilitySelect controls, justify inclusions/exclusions in a Statement of Applicability, and maintain a risk treatment plan. - ObjectivesSet measurable information security objectives and plans to achieve them. - Resources, competence and awarenessProvide resources; ensure staff are competent and aware of their security responsibilities. - Documented informationCreate and control the documents and records the ISMS needs. - OperationPlan and control the processes and carry out the risk treatment plan. - Monitoring and internal auditMonitor and measure the ISMS and run internal audits at planned intervals. - Management reviewTop management reviews the ISMS at planned intervals. - Nonconformity and improvementHandle nonconformities and drive continual improvement. ### Annex A — Organizational controls (A.5, 37 controls) - Security policiesInformation security policy and topic-specific policies, reviewed regularly. - Roles and segregation of dutiesDefined responsibilities and separation of conflicting duties. - Supplier and cloud securitySecurity requirements in supplier and cloud-service agreements, and monitoring. - Access control policy and identityAccess control policy, identity and access management across the lifecycle. - Threat intelligence and incident managementA process to receive threat information and to manage security incidents. - Classification and handlingClassify information and handle it according to its sensitivity. - Continuity and ICT readinessPlan for business continuity and ICT readiness for disruptions. ### Annex A — People controls (A.6, 8 controls) - Screening and termsBackground screening, terms of employment and confidentiality/NDA agreements. - Awareness and trainingSecurity awareness, education and training for staff. - Responsibilities and disciplineDisciplinary process and responsibilities on change or termination of employment. - Remote working and reportingSecure remote working and a way to report security events. ### Annex A — Physical controls (A.7, 14 controls) - Perimeters and entryPhysical security perimeters and entry controls for secure areas. - Equipment and cablingProtect equipment, cabling and supporting utilities. - Clear desk and disposalClear desk / clear screen and secure disposal or reuse of equipment. ### Annex A — Technological controls (A.8, 34 controls) - Endpoint, malware and vulnerabilitiesEndpoint protection, protection against malware, and vulnerability management. - Authentication and privileged accessSecure authentication, management of access rights and privileged access. - CryptographyUse of cryptography and key management. - Backup, logging and monitoringBackups, logging, and monitoring of activities. - Network securityNetwork security and segregation of networks. - Secure development and changeSecure development lifecycle and change management. Ready to build the documents? The [ISO 27001:2022 Toolkit](https://gofirmhub.com/en/compliance/iso-27001-toolkit/) gives you 40 editable Word/Excel documents — policies, procedures, the risk register and a Statement of Applicability with all 93 Annex A controls (€299 one-time). ## Frequently asked questions ### How many controls does ISO 27001:2022 have? Annex A of ISO/IEC 27001:2022 has 93 controls in four themes: Organizational (37), People (8), Physical (14) and Technological (34). Clauses 4–10 set the mandatory management-system requirements. ### Do I have to implement all 93 controls? No. You select Annex A controls based on your risk assessment and record your choices in a Statement of Applicability. The clause 4–10 requirements, however, are mandatory. ### Is this checklist a certification? No. It is a preparation self-assessment. Certification is carried out by an accredited certification body against the standard. ### Is my progress stored anywhere? Only in your own browser (local storage). Nothing is uploaded, and you can reset it at any time. ### Can I download the ISO 27001 checklist as Excel? Yes. Click “Download for Excel (CSV)” to get all clauses and Annex A themes with your status in a file that opens in Excel, Google Sheets or LibreOffice. You can also download a short text summary. ### Can I use this as an ISO 27001 audit checklist or gap analysis? Yes, as preparation for an internal audit or a gap analysis: mark your status for each requirement and export the result. It does not replace the audit by an accredited certification body. ### Is there an ISO 27001 checklist in PDF or XLS? The checklist downloads as CSV, which opens directly in Excel (where you can save it as XLSX) or Google Sheets. Need a PDF? Open the file in Excel and print or save it as PDF. ## Related free tools - [Vendor Risk Register & Assessment Tool (NIS2)](https://gofirmhub.com/en/compliance/vendor-risk-register/): A vendor risk register in your browser: supplier list, security questionnaire, risk score, review dates and… - [NIS2 Compliance Checklist — Free Self-Assessment](https://gofirmhub.com/en/compliance/nis2/checklist/): Free NIS2 self-assessment tool: check how NIS2 compliant you are against the Article 21 measures and Article… - [ISO 27001:2022 Toolkit — 40 editable documents](https://gofirmhub.com/en/compliance/iso-27001-toolkit/): Editable ISO 27001:2022 starter pack: 40 Word/Excel documents, incl. 5 forms and a risk register. The SoA… - [NIS2 Toolkit — 12 editable compliance documents](https://gofirmhub.com/en/compliance/nis2-toolkit/): Editable NIS2 starter pack: 12 Word/Excel docs for governance, measures & incident reporting. Includes… - [Free Cookie & Tracker Scanner](https://gofirmhub.com/en/compliance/cookie-scanner/): Scan any website for cookies and third-party trackers. Free cookie scanner showing first- vs third-party… - [Free Privacy Policy Generator](https://gofirmhub.com/en/legal/privacy-policy-generator/): Generate a free privacy policy for your website in minutes. GDPR-aware template you fill in yourself, in your… - [Free Terms and Conditions Generator](https://gofirmhub.com/en/legal/terms-and-conditions-generator/): Generate free terms and conditions for your website in minutes. A template you fill in yourself, in your…