CISOs and Security Leaders
Organize control ownership, risk treatment priorities, security evidence, and readiness conversations with executives and department leaders.
ISO 27001 Readiness • Annex A Controls
ISO 27001 Readiness Checklist for Annex A Control Review and Audit Preparation
Use this professional ISO 27001 readiness checklist to organize ISMS preparation, Annex A control areas, business risks, evidence, owners, and remediation priorities before the formal audit process.
93Annex A control areas organized for readiness planning
4Organizational, people, physical, and technological themes
9Columns for risk, impact, evidence, owner, and priority
LocalOrange County, Irvine, Los Angeles, and Southern California focus
Checklist overview
A practical ISO 27001 preparation tool for ISMS readiness.
ISO 27001 readiness is not only a documentation exercise. It requires leadership accountability, business risk management, defined scope, operational procedures, access control, incident response, vendor oversight, technical safeguards, evidence collection, and continual improvement.
This checklist gives your team a structured way to review the main Annex A control areas and understand where evidence, ownership, or remediation may be needed before a formal audit conversation.
Who can use this
Built for security, compliance, IT, and business leadership teams.
Compliance and Audit Teams
Prepare documentation, map evidence, identify missing approvals, and build a remediation roadmap before the formal audit process.
IT Managers and Network Engineers
Review identity, endpoints, firewalls, Microsoft 365, Azure, logging, backups, vulnerability management, and network segmentation.
Cloud and Microsoft 365 Administrators
Review MFA, Conditional Access, cloud governance, admin roles, logging, DLP, encryption, backup, and secure configuration practices.
Business Owners and Executives
Use the risk and impact columns to understand why ISO 27001 readiness requires management support, budget, ownership, and business-aligned decisions.
SaaS and Professional Services Firms
Prepare for customer security reviews, vendor questionnaires, contractual expectations, and future ISO 27001 audit planning.
How to use the checklist
Review, assign, prioritize, and prepare evidence.
1
Confirm Scope
Define the ISMS boundary: business units, locations, systems, cloud services, data types, suppliers, and processes included in readiness planning.
2
Assign Owners
Some control areas belong to IT, while others require HR, legal, compliance, facilities, executives, system owners, or vendors.
3
Collect Evidence
Gather policies, tickets, screenshots, exports, logs, risk registers, approvals, diagrams, training records, contracts, and test results.
4
Identify Gaps
Mark missing documentation, weak implementation, unclear ownership, outdated records, and untested procedures.
5
Prioritize Remediation
Focus first on high-risk areas such as identity, access rights, vulnerabilities, backups, incident response, cloud security, and data protection.
6
Prepare for Audit
Use the checklist to guide leadership discussions, internal audit preparation, management review, and evidence package planning.
Excel-style control checklist
ISO 27001 Annex A Readiness Checklist
The checklist below organizes the 93 Annex A control areas into a practical preparation table. The first column and header stay visible while reviewing the sheet during management, IT, security, or compliance meetings.
| Control ID | Theme | Control Area | Readiness Objective | Key Risk if Weak | Business Impact | Evidence to Prepare | Typical Owner | Priority |
|---|---|---|---|---|---|---|---|---|
| A.5.1 | Organizational | Policies for information security | Confirm policies are approved, published, reviewed, and aligned to business risk. | Inconsistent security expectations and weak governance. | Audit delays, customer concern, unclear accountability. | Approved policy set, review dates, owner list, policy acknowledgement records. | Executive / CISO | High |
| A.5.2 | Organizational | Information security roles and responsibilities | Verify security duties are assigned, understood, and documented. | No clear ownership for controls, remediation, and incident response. | Missed tasks, slow response, weak management oversight. | RACI matrix, job roles, governance charter, responsibility assignments. | Executive / CISO | High |
| A.5.3 | Organizational | Segregation of duties | Review whether conflicting duties are separated or compensated with monitoring. | Fraud, unauthorized changes, and privilege abuse. | Financial loss, data exposure, control failure. | Role matrix, access review results, exception approvals, monitoring records. | IT Manager / HR | High |
| A.5.4 | Organizational | Management responsibilities | Check that managers require security practices within teams and operations. | Security expectations are not enforced consistently. | Policy failure, weak culture, avoidable incidents. | Manager responsibilities, performance expectations, onboarding records. | Executive / Department Leaders | Medium |
| A.5.5 | Organizational | Contact with authorities | Identify who contacts law enforcement, regulators, or authorities when needed. | Delayed reporting or mishandled incidents. | Regulatory exposure, reputational damage, incident escalation delays. | Contact list, incident escalation procedure, communication plan. | CISO / Legal | Medium |
| A.5.6 | Organizational | Contact with special interest groups | Review participation in trusted security communities and industry information sources. | Limited awareness of emerging threats and sector-specific risks. | Late response to vulnerabilities, weaker threat awareness. | Memberships, subscriptions, threat advisory sources, security forums. | CISO / Security Lead | Low |
| A.5.7 | Organizational | Threat intelligence | Assess whether threat information is collected, evaluated, and used for defense. | Controls do not adapt to current threats. | Higher chance of compromise from known attack patterns. | Threat feeds, advisories, risk updates, vulnerability alerts, meeting notes. | Security Lead | High |
| A.5.8 | Organizational | Information security in project management | Confirm projects consider security requirements from planning through delivery. | New systems launch with avoidable security gaps. | Rework, data exposure, compliance issues. | Project templates, security sign-offs, risk reviews, architecture reviews. | Project Manager / IT | High |
| A.5.9 | Organizational | Inventory of information and associated assets | Verify key assets, data, owners, and locations are documented. | Unknown systems and data cannot be protected properly. | Security blind spots, poor response, audit weakness. | Asset inventory, CMDB, data inventory, system ownership records. | IT Manager | High |
| A.5.10 | Organizational | Acceptable use of information and associated assets | Review acceptable use rules for systems, data, devices, and services. | Employees misuse systems or handle data improperly. | Data leakage, malware exposure, HR disputes. | Acceptable use policy, employee acknowledgement, training records. | HR / IT | Medium |
| A.5.11 | Organizational | Return of assets | Check that assets are returned during offboarding or role changes. | Devices, credentials, or data remain with former users. | Data loss, unauthorized access, inventory errors. | Offboarding checklist, asset return records, access removal tickets. | HR / IT | High |
| A.5.12 | Organizational | Classification of information | Determine whether information is classified by sensitivity and handling needs. | Sensitive data is treated like ordinary information. | Data exposure, contractual issues, privacy risk. | Classification policy, data categories, handling procedures, examples. | Data Owner / CISO | High |
| A.5.13 | Organizational | Labelling of information | Review labels or markings used to communicate information sensitivity. | Users do not recognize sensitive content or required handling. | Accidental disclosure, improper sharing, audit gaps. | Labeling standard, examples, M365 labels, DLP labels, user guidance. | Data Owner / IT | Medium |
| A.5.14 | Organizational | Information transfer | Assess rules and safeguards for sending, receiving, and sharing information. | Data is transferred insecurely or to the wrong party. | Data leakage, contractual violations, privacy exposure. | Transfer policy, secure sharing tools, encryption settings, approvals. | IT / Data Owner | High |
| A.5.15 | Organizational | Access control | Review access control policy and enforcement across systems and data. | Unauthorized users access sensitive systems or information. | Breach risk, audit findings, customer trust loss. | Access control policy, access matrix, review records, approval workflow. | IT Manager / CISO | High |
| A.5.16 | Organizational | Identity management | Evaluate identity lifecycle from creation to changes and termination. | Accounts are unmanaged, duplicated, or orphaned. | Unauthorized access, privilege creep, poor traceability. | Identity procedure, account request tickets, HR integration, directory exports. | IT Manager | High |
| A.5.17 | Organizational | Authentication information | Review how passwords, secrets, keys, and authentication factors are protected. | Compromised credentials lead to unauthorized access. | Account takeover, data breach, ransomware exposure. | Password policy, MFA settings, secret storage process, user guidance. | IT / Security Lead | High |
| A.5.18 | Organizational | Access rights | Check access approval, periodic review, modification, and removal processes. | Excessive or outdated access remains active. | Privilege abuse, audit exceptions, data exposure. | Access review reports, approval records, termination tickets, role definitions. | IT Manager / System Owners | High |
| A.5.19 | Organizational | Information security in supplier relationships | Review supplier security expectations and due diligence. | Vendors introduce unmanaged security risk. | Third-party breach, service disruption, contractual issues. | Vendor risk questionnaire, supplier list, security review records. | Procurement / CISO | High |
| A.5.20 | Organizational | Information security within supplier agreements | Check security requirements included in supplier contracts and agreements. | Contracts lack security obligations or evidence expectations. | Limited recourse after incidents, compliance gaps. | Contract clauses, DPAs, SLAs, security addenda, review checklist. | Legal / Procurement | High |
| A.5.21 | Organizational | Managing information security in the ICT supply chain | Assess controls over technology suppliers, cloud providers, and managed services. | Supply-chain weaknesses affect business systems. | Compromise through vendors, outage, data loss. | ICT supplier inventory, dependency map, provider assurance reports. | IT Manager / Procurement | High |
| A.5.22 | Organizational | Monitoring, review, and change management of supplier services | Review ongoing supplier performance, changes, and security monitoring. | Supplier changes weaken security without approval or visibility. | Operational disruption, contractual failure, new vulnerabilities. | Supplier reviews, change notices, service reports, meeting minutes. | Vendor Owner / IT | Medium |
| A.5.23 | Organizational | Information security for use of cloud services | Evaluate cloud governance, configuration, access, logging, and provider risk. | Cloud services are misconfigured or poorly governed. | Data exposure, account compromise, compliance gaps. | Cloud policy, Azure/M365 settings, CSP reports, cloud risk assessment. | Cloud Admin / CISO | High |
| A.5.24 | Organizational | Information security incident management planning and preparation | Confirm incident roles, procedures, escalation, and tools are ready. | Teams are unprepared when incidents occur. | Longer downtime, larger breach impact, poor communication. | Incident response plan, contact tree, tabletop records, playbooks. | CISO / IT Manager | High |
| A.5.25 | Organizational | Assessment and decision on information security events | Review how events are triaged and classified as incidents or false positives. | Important alerts are ignored or mishandled. | Delayed containment, larger compromise, evidence loss. | Event triage process, SIEM alerts, ticket examples, severity matrix. | Security Lead | High |
| A.5.26 | Organizational | Response to information security incidents | Assess containment, eradication, recovery, and communication practices. | Incidents are handled inconsistently or too slowly. | Operational disruption, data loss, reputational impact. | Incident records, response playbooks, communication logs, post-incident reports. | CISO / IT Manager | High |
| A.5.27 | Organizational | Learning from information security incidents | Verify post-incident reviews lead to improvements. | Same weaknesses repeat after incidents. | Recurring incidents, control stagnation, missed lessons. | Lessons learned reports, action items, remediation tracking. | CISO / Security Lead | Medium |
| A.5.28 | Organizational | Collection of evidence | Review evidence handling for investigations and audit support. | Evidence is incomplete, altered, or not defensible. | Weak investigations, legal exposure, audit problems. | Evidence procedure, chain-of-custody records, log retention settings. | Security / Legal | Medium |
| A.5.29 | Organizational | Information security during disruption | Assess protection of information during crisis, outage, or disruption. | Security controls fail during emergency operations. | Data exposure, uncontrolled workarounds, recovery risk. | BCP procedures, emergency access rules, continuity plans. | BCDR Owner / IT | High |
| A.5.30 | Organizational | ICT readiness for business continuity | Review technology resilience, recovery, and continuity readiness. | Critical systems cannot recover within business needs. | Downtime, revenue loss, customer service failure. | DR plan, backup tests, RTO/RPO targets, recovery exercise records. | IT Manager / BCDR Owner | High |
| A.5.31 | Organizational | Legal, statutory, regulatory, and contractual requirements | Identify applicable legal, regulatory, and contractual security requirements. | Obligations are missed or misunderstood. | Regulatory exposure, contract risk, audit findings. | Requirements register, contract review, compliance mapping. | Legal / Compliance | High |
| A.5.32 | Organizational | Intellectual property rights | Review controls protecting software, licensing, and intellectual property. | IP is misused, stolen, or improperly licensed. | Legal disputes, financial exposure, loss of competitive value. | License inventory, IP policy, software register, vendor agreements. | Legal / IT | Medium |
| A.5.33 | Organizational | Protection of records | Assess retention, integrity, access, and disposal of business records. | Records are lost, altered, or unavailable. | Legal exposure, audit failure, operational disruption. | Retention schedule, records inventory, access controls, backup evidence. | Records Owner / Compliance | Medium |
| A.5.34 | Organizational | Privacy and protection of personally identifiable information | Review safeguards for personal data collection, use, storage, and sharing. | PII is exposed, misused, or retained improperly. | Privacy complaints, regulatory risk, reputational harm. | PII inventory, privacy policy, consent records, access controls. | Privacy / Compliance | High |
| A.5.35 | Organizational | Independent review of information security | Check whether security is reviewed independently at planned intervals. | Management lacks objective visibility into security maturity. | Hidden weaknesses, poor governance, customer concern. | Audit reports, assessment results, remediation plans, review schedule. | Executive / CISO | Medium |
| A.5.36 | Organizational | Compliance with policies, rules, and standards for information security | Evaluate whether policies and standards are followed in practice. | Documented rules are not implemented consistently. | Audit exceptions, operational inconsistency, control failure. | Compliance checks, exception logs, control testing results. | Compliance / IT | High |
| A.5.37 | Organizational | Documented operating procedures | Review documented operational procedures for critical security activities. | Operations depend on tribal knowledge. | Inconsistent execution, errors, weak continuity. | Runbooks, SOPs, administrative procedures, change records. | IT Manager | Medium |
| A.6.1 | People | Screening | Assess screening practices for roles with access to sensitive systems or data. | Unsuitable personnel gain trusted access. | Insider risk, fraud, data exposure. | Screening policy, role criteria, HR records, approval evidence. | HR / Management | Medium |
| A.6.2 | People | Terms and conditions of employment | Review employment terms covering security responsibilities and confidentiality. | Security expectations are not contractually communicated. | Policy disputes, weak accountability, data misuse. | Employment agreements, onboarding documents, confidentiality terms. | HR / Legal | Medium |
| A.6.3 | People | Information security awareness, education, and training | Verify training is relevant, recurring, and tracked. | Employees are vulnerable to phishing and unsafe behavior. | Credential theft, data leakage, malware incidents. | Training records, phishing results, awareness materials, completion reports. | HR / CISO | High |
| A.6.4 | People | Disciplinary process | Check that security violations can be handled consistently. | Policy violations are not addressed fairly or effectively. | Culture weakness, repeated misuse, HR disputes. | Disciplinary policy, HR procedure, incident escalation process. | HR / Legal | Medium |
| A.6.5 | People | Responsibilities after termination or change of employment | Review post-employment duties and access removal expectations. | Former personnel retain information or access. | Unauthorized access, IP loss, confidentiality breach. | Termination checklist, NDA terms, access removal evidence. | HR / IT | High |
| A.6.6 | People | Confidentiality or non-disclosure agreements | Confirm confidentiality agreements match business and data sensitivity. | Confidential information is shared without clear obligation. | Data exposure, legal disputes, customer trust issues. | NDA templates, signed agreements, review schedule. | Legal / HR | Medium |
| A.6.7 | People | Remote working | Assess security requirements for remote work and offsite access. | Remote access increases compromise and data leakage risk. | Account takeover, insecure networks, device loss. | Remote work policy, VPN/MFA settings, device controls, user guidance. | IT / HR | High |
| A.6.8 | People | Information security event reporting | Verify employees know how to report suspicious events quickly. | Events are not reported or escalated in time. | Delayed response, larger compromise, evidence loss. | Reporting channels, training, helpdesk tickets, awareness reminders. | Security Lead / HR | High |
| A.7.1 | Physical | Physical security perimeters | Review physical boundaries protecting facilities and sensitive areas. | Unauthorized people access restricted areas. | Theft, tampering, data center exposure. | Site diagrams, access controls, visitor logs, perimeter reviews. | Facilities / IT | Medium |
| A.7.2 | Physical | Physical entry | Check entry controls for offices, server rooms, and restricted areas. | Unauthorized physical entry is not prevented or tracked. | Asset theft, data exposure, safety risk. | Badge logs, visitor records, access approvals, escort procedure. | Facilities / Security | Medium |
| A.7.3 | Physical | Securing offices, rooms, and facilities | Assess protection of rooms and facilities containing information assets. | Sensitive areas are exposed or poorly secured. | Equipment theft, unauthorized viewing, service disruption. | Facility review, lock records, secure room controls, photos. | Facilities / IT | Medium |
| A.7.4 | Physical | Physical security monitoring | Review monitoring for sensitive areas and access points. | Physical incidents go undetected. | Theft, tampering, delayed investigation. | Camera coverage, monitoring logs, alarm reports, retention settings. | Facilities / Security | Medium |
| A.7.5 | Physical | Protecting against physical and environmental threats | Assess controls for fire, flood, power, temperature, and environmental risks. | Environmental events damage critical systems. | Downtime, data loss, equipment replacement cost. | Environmental controls, UPS records, fire suppression checks, sensor logs. | Facilities / IT | Medium |
| A.7.6 | Physical | Working in secure areas | Review rules for work performed in sensitive or restricted areas. | Sensitive work areas are misused or exposed. | Data leakage, visitor exposure, tampering. | Secure area rules, visitor procedure, signage, monitoring records. | Facilities / IT | Low |
| A.7.7 | Physical | Clear desk and clear screen | Assess practices that reduce visible or unattended sensitive information. | Paper records or screens expose sensitive data. | Privacy breach, customer data exposure, insider risk. | Clear desk policy, screen lock settings, training, inspection records. | HR / IT | Medium |
| A.7.8 | Physical | Equipment siting and protection | Review placement and protection of equipment from damage or unauthorized access. | Equipment is exposed to theft, damage, or interference. | Downtime, asset loss, unauthorized access. | Equipment locations, rack locks, environmental controls, inventory. | IT / Facilities | Medium |
| A.7.9 | Physical | Security of assets off-premises | Assess protection of laptops, mobile devices, and media outside facilities. | Offsite assets are lost, stolen, or compromised. | Data breach, device replacement cost, business disruption. | Device policy, encryption status, MDM reports, asset checkout records. | IT Manager | High |
| A.7.10 | Physical | Storage media | Review handling, storage, transfer, and disposal of removable or backup media. | Media containing sensitive data is lost or misused. | Data exposure, regulatory issues, recovery failures. | Media inventory, encryption records, disposal certificates, storage logs. | IT / Records Owner | Medium |
| A.7.11 | Physical | Supporting utilities | Check resilience of utilities supporting information systems. | Power, cooling, or connectivity failure disrupts operations. | Downtime, equipment damage, service interruption. | UPS tests, generator records, utility contracts, maintenance logs. | Facilities / IT | Medium |
| A.7.12 | Physical | Cabling security | Review protection of power and network cabling from damage or interception. | Cables are tampered with, damaged, or exposed. | Network outage, interception risk, service disruption. | Cabling diagrams, inspection records, locked closets, photos. | Network Engineer / Facilities | Low |
| A.7.13 | Physical | Equipment maintenance | Verify equipment is maintained securely and records are kept. | Systems fail or maintenance exposes sensitive data. | Downtime, data exposure, warranty issues. | Maintenance logs, vendor access records, service tickets, asset records. | IT / Facilities | Medium |
| A.7.14 | Physical | Secure disposal or re-use of equipment | Review sanitization before disposal, reuse, or transfer of equipment. | Residual data remains on devices. | Data breach, privacy exposure, customer trust loss. | Wipe certificates, disposal logs, chain-of-custody, asset retirement records. | IT Manager | High |
| A.8.1 | Technological | User endpoint devices | Assess protection of laptops, desktops, tablets, and mobile devices. | Compromised endpoints become entry points for attackers. | Malware, ransomware, data loss, downtime. | Endpoint inventory, EDR status, encryption reports, patch status. | IT / Security Lead | High |
| A.8.2 | Technological | Privileged access rights | Review assignment, approval, monitoring, and removal of admin privileges. | Admin rights are abused or compromised. | Major breach, ransomware spread, system manipulation. | Admin list, approval records, PAM logs, access review reports. | IT Manager / CISO | High |
| A.8.3 | Technological | Information access restriction | Verify access to data and applications is restricted by business need. | Users access information beyond their role. | Data leakage, privacy issues, audit findings. | RBAC matrix, application permissions, data access reviews. | System Owners / IT | High |
| A.8.4 | Technological | Access to source code | Review protection of source code, repositories, and development secrets. | Code or secrets are stolen or altered. | IP loss, software compromise, credential exposure. | Repository permissions, branch protection, secret scanning, access logs. | Development Lead | High |
| A.8.5 | Technological | Secure authentication | Assess MFA, password controls, session security, and authentication methods. | Weak authentication enables account compromise. | Data breach, business email compromise, unauthorized access. | MFA reports, password policy, SSO settings, conditional access rules. | IT / Identity Admin | High |
| A.8.6 | Technological | Capacity management | Review monitoring and planning for system capacity and performance. | Systems fail under load or resource exhaustion. | Service outage, poor customer experience, emergency spend. | Capacity reports, performance metrics, scaling plans, monitoring alerts. | IT Operations | Medium |
| A.8.7 | Technological | Protection against malware | Assess anti-malware, EDR, email protection, and user safeguards. | Malware infects endpoints or servers. | Ransomware, data loss, downtime, recovery cost. | EDR console, malware alerts, email security settings, response records. | Security Lead / IT | High |
| A.8.8 | Technological | Management of technical vulnerabilities | Review vulnerability identification, prioritization, remediation, and tracking. | Known vulnerabilities remain exploitable. | System compromise, ransomware, audit findings. | Vulnerability scans, patch tickets, remediation SLA, exception records. | Security Lead / IT | High |
| A.8.9 | Technological | Configuration management | Assess secure configuration baselines and change control for systems. | Misconfigurations create security gaps. | Cloud exposure, privilege issues, system instability. | Baseline standards, configuration exports, hardening checklist, change records. | IT / Cloud Admin | High |
| A.8.10 | Technological | Information deletion | Review secure deletion of data when no longer required. | Data persists longer than needed or after disposal. | Privacy exposure, discovery risk, storage cost. | Retention rules, deletion logs, storage lifecycle policies, tickets. | Data Owner / IT | Medium |
| A.8.11 | Technological | Data masking | Assess masking for sensitive data in non-production or limited-use contexts. | Sensitive data is exposed where full data is not required. | Privacy risk, insider exposure, development environment leakage. | Masking rules, test data procedure, screenshots, validation results. | Data Owner / Development | Medium |
| A.8.12 | Technological | Data leakage prevention | Review DLP strategy for email, endpoints, cloud, and sensitive data movement. | Sensitive data leaves approved locations or channels. | Data breach, contract violation, privacy exposure. | DLP policies, alerts, M365 labels, incident records, tuning notes. | Security Lead / Data Owner | High |
| A.8.13 | Technological | Information backup | Verify backup scope, frequency, protection, restoration, and testing. | Data cannot be restored after deletion, outage, or ransomware. | Extended downtime, data loss, business disruption. | Backup reports, restore tests, backup policy, immutable backup settings. | IT Manager | High |
| A.8.14 | Technological | Redundancy of information processing facilities | Assess redundancy for critical systems and supporting infrastructure. | Single points of failure disrupt essential services. | Outage, revenue loss, customer impact. | Architecture diagrams, failover tests, redundancy design, monitoring records. | IT Operations | Medium |
| A.8.15 | Technological | Logging | Review log collection, retention, protection, and access. | Important activity is not recorded or logs are altered. | Weak investigations, delayed detection, audit gaps. | SIEM settings, log sources, retention policy, access controls. | Security Lead | High |
| A.8.16 | Technological | Monitoring activities | Assess monitoring for suspicious events, anomalies, and security alerts. | Attacks remain undetected until damage is done. | Breach impact, downtime, data exfiltration. | Monitoring rules, alert tickets, SOC reports, escalation records. | Security Lead | High |
| A.8.17 | Technological | Clock synchronization | Verify systems use accurate and synchronized time sources. | Logs cannot be correlated reliably. | Investigation delays, evidence issues, troubleshooting difficulty. | NTP settings, system configuration, log samples, time source records. | Network Engineer / IT | Low |
| A.8.18 | Technological | Use of privileged utility programs | Review controls over tools that bypass normal security controls. | Powerful tools are misused or abused by attackers. | System compromise, data exposure, audit failure. | Approved tool list, admin logs, access restrictions, monitoring alerts. | IT Manager / Security | High |
| A.8.19 | Technological | Installation of software on operational systems | Assess software installation approval and control on production systems. | Unauthorized or risky software is installed. | Malware, instability, licensing issues, vulnerability exposure. | Software policy, allowlist, installation tickets, endpoint reports. | IT Operations | Medium |
| A.8.20 | Technological | Network security | Review network architecture, firewall rules, secure access, and protections. | Network weaknesses allow unauthorized access or lateral movement. | Breach spread, outage, data interception. | Network diagrams, firewall rules, VPN settings, IDS/IPS logs. | Network Engineer | High |
| A.8.21 | Technological | Security of network services | Assess security requirements for internal and external network services. | Network services are deployed without adequate protection. | Service compromise, unauthorized access, downtime. | Provider SLAs, service configs, network service inventory, reviews. | Network Engineer / Vendor Owner | Medium |
| A.8.22 | Technological | Segregation of networks | Review segmentation between user, server, guest, production, and sensitive networks. | Attackers move freely after initial compromise. | Ransomware spread, data exposure, system compromise. | VLAN design, firewall ACLs, segmentation tests, network diagrams. | Network Engineer | High |
| A.8.23 | Technological | Web filtering | Assess controls restricting access to malicious or inappropriate web destinations. | Users access phishing, malware, or risky web content. | Credential theft, malware infection, productivity loss. | Web filter policy, DNS security settings, blocked events, reports. | IT / Security Lead | Medium |
| A.8.24 | Technological | Use of cryptography | Review encryption strategy for data at rest, in transit, and key management. | Sensitive data is readable if intercepted or stolen. | Data breach, privacy exposure, contract failure. | Encryption policy, TLS settings, disk encryption reports, key procedures. | Security Lead / IT | High |
| A.8.25 | Technological | Secure development life cycle | Assess security integration into software planning, design, build, and release. | Applications are built without security controls. | Application compromise, data exposure, remediation cost. | SDLC policy, security gates, design reviews, release checklist. | Development Lead | High |
| A.8.26 | Technological | Application security requirements | Review security requirements for applications and services before development or purchase. | Apps lack required security features or protections. | Vulnerabilities, data exposure, customer concern. | Requirements documents, vendor reviews, security acceptance criteria. | Product / Development | High |
| A.8.27 | Technological | Secure system architecture and engineering principles | Evaluate secure design standards for systems and architecture. | Systems are designed with avoidable security weaknesses. | Technical debt, breach risk, expensive redesign. | Architecture standards, design review records, threat models, diagrams. | Architecture / IT | High |
| A.8.28 | Technological | Secure coding | Review developer secure coding practices and code review expectations. | Code contains preventable vulnerabilities. | Application breach, data leakage, patch burden. | Secure coding standard, code review records, SAST results, training. | Development Lead | High |
| A.8.29 | Technological | Security testing in development and acceptance | Assess security testing before deployment or major release. | Vulnerabilities reach production environments. | Exploitation, emergency fixes, customer risk. | DAST/SAST reports, pen test summaries, acceptance criteria, remediation tickets. | QA / Development | High |
| A.8.30 | Technological | Outsourced development | Review security expectations and oversight for outsourced development providers. | External developers introduce insecure code or data exposure. | IP risk, application vulnerabilities, supplier dependency. | Vendor agreements, code review process, access controls, deliverable checks. | Vendor Owner / Development | Medium |
| A.8.31 | Technological | Separation of development, test, and production environments | Verify environments are separated and access is controlled. | Testing activity affects production or exposes real data. | Outage, data leakage, unauthorized changes. | Environment diagrams, access lists, deployment process, test data rules. | IT / Development | High |
| A.8.32 | Technological | Change management | Review approval, testing, rollback, and documentation for changes. | Uncontrolled changes introduce outages or security weaknesses. | Downtime, misconfiguration, audit findings. | Change tickets, approvals, test evidence, rollback plans, CAB notes. | IT Operations | High |
| A.8.33 | Technological | Test information | Assess protection and suitability of test data used in non-production systems. | Sensitive production data is exposed in test environments. | Privacy breach, data leakage, compliance issues. | Test data policy, masking evidence, non-production access review. | Data Owner / Development | Medium |
| A.8.34 | Technological | Protection of information systems during audit testing | Review safeguards during vulnerability scans, audits, and testing activities. | Testing disrupts systems or exposes sensitive information. | Outage, data exposure, operational disruption. | Audit test plan, approvals, scope, change window, test results handling. | IT / Security Lead | Medium |
Related OC Security Audit services
Strengthen the security areas behind the checklist.
ISO 27001 readiness often depends on the maturity of identity, endpoint, cloud, network, access control, incident response, risk management, and governance practices.
Compliance ConsultingReview compliance gaps, controls, documentation, and remediation priorities.
Cybersecurity Risk AssessmentIdentify risks that affect ISO 27001 preparation and risk treatment.
Internal Security AuditReview internal controls, procedures, system configuration, and evidence readiness.
Microsoft Office 365 AuditEvaluate MFA, Conditional Access, admin roles, email protection, and logging.
Azure Cloud Security AuditReview Azure identity, governance, access control, logs, and posture.
Network Firewall Security AssessmentAssess firewall rules, segmentation, remote access, and perimeter protection.
From findings to implementation
Operational support after ISO 27001 readiness findings.
OC Security Audit helps identify gaps, validate evidence, and prioritize remediation. When ISO 27001 findings require implementation, managed IT, Microsoft 365 support, Azure operations, backup, endpoint management, or help desk support, IT Perfection can support the operational follow-through.
Experienced compliance and security guidance
ISO 27001 readiness led with practical cybersecurity and infrastructure experience.
Ali Hassani is a CISO and cybersecurity consultant with 25+ years of experience across IT operations, cybersecurity, compliance auditing, Microsoft infrastructure, network security, cloud security, and infrastructure leadership. That experience helps organizations connect Annex A controls, technical evidence, executive risk, and practical remediation.
CISSPCCISOCCNPCCNAMCSEMCSA SecurityMCITP
FAQ
ISO 27001 readiness checklist questions.
Does every control apply to every business?
Not always. Applicability depends on scope, risk, systems, data, operations, suppliers, and the organization's Statement of Applicability decisions. The checklist helps teams review each area and decide what needs deeper evaluation.
Who should own the checklist?
A CISO, vCISO, compliance lead, IT manager, or executive sponsor should coordinate the checklist, but many rows require input from HR, legal, facilities, system owners, cloud administrators, vendors, and business leaders.
How should a company start?
Start with ISMS scope, asset inventory, risk assessment, access control, vulnerability management, backups, incident response, and evidence collection. Those areas often reveal the most important readiness gaps early.
Can OC Security Audit help complete the readiness review?
Yes. OC Security Audit can help review gaps, collect evidence, validate technical controls, prioritize remediation, and prepare leadership and IT teams for the next stage of ISO 27001 audit preparation.
Prepare with structure
Need help reviewing your ISO 27001 readiness checklist?
OC Security Audit helps businesses in Orange County, Irvine, Los Angeles, and Southern California review ISO 27001 readiness, identify gaps, validate evidence, strengthen technical controls, and build a practical remediation roadmap before the formal audit process.