Compliance · ISO/IEC 27001:2022 Annex A

ISO 27001 Readiness Self-Assessment

Track your readiness against the ISO 27001:2022 Annex A controls. Progress saved in your browser. Export when you are ready to engage a certification body.

Overall readiness

A.5 — Organizational controls

A.5 — Policy & governance 0%

Information security policies + roles + responsibilities

Information security policy approved by leadership Signed + reviewed annually

Roles + responsibilities for InfoSec defined Org chart shows who owns what

Segregation of duties enforced Same person cannot code + deploy + approve

Management commitment + InfoSec resources allocated Documented annually

Contact with authorities (regulators) documented In incident response plan

Contact with special interest groups (CERT, ISACs) Membership or subscription

Threat intelligence program in place Monthly threat scan

InfoSec in project management Security review on every new project

A.6 — People controls

A.6 — Personnel security 0%

Background screening for new hires with privileged access

Confidentiality / NDA agreements on file Signed by every employee + contractor

InfoSec awareness training annually Documented attendance

Disciplinary process for InfoSec violations defined

Information security responsibilities on offboarding Onboarding/offboarding checklist

A.7 — Physical controls

A.7 — Physical & environmental security 0%

Physical security perimeter for offices + server rooms

Physical entry controls (badges, locks, CCTV)

Clean desk + clean screen policy Enforced + documented

Equipment + cabling protected

Secure disposal of assets Certified disposal, not landfill

A.8 — Technological controls

A.8 — Access + identity 0%

User access provisioning + deprovisioning documented

Privileged access management (PAM) Just-in-time access where possible

MFA enforced on admin accounts

Information access restriction (least privilege)

Access rights reviewed quarterly

A.8 — Cryptography + secure development 0%

Encryption at rest + in transit TLS 1.2+ everywhere

Key management documented

Secure development lifecycle Code review + dependency scanning

Application security testing (SAST + DAST)

Vulnerability disclosure program /security/disclosure already live

A.8 — Logging + monitoring 0%

Centralized logging in place

Clock synchronization across systems

Privileged operations monitored + alerted

Anti-malware controls deployed

Backup + recovery tested annually

A.8 — Incident + continuity 0%

Incident response plan documented

Business continuity + DR plan tested annually

Supplier security reviewed before contract

Cloud services security assessment For each major SaaS used

SOC 2 Readiness Vulnerability Disclosure