Compliance · ISO/IEC 27001:2022 Annex A

ISO 27001 Readiness Self-Assessment

Track your readiness against the ISO 27001:2022 Annex A controls. Progress saved in your browser. Export when you are ready to engage a certification body.

Not a compliance opinion. This self-assessment is a general readiness indicator — not legal advice, not a certification, and not an audit against the standard. Standards and interpretations change and this content may be out of date, so do your own due diligence and confirm with a qualified auditor or counsel. Use at your own risk. Questions? Call (647) 581-3182. Full disclaimer.

Overall readiness

A.5 — Organizational controls

A.5 — Policy & governance 0%

Information security policies + roles + responsibilities

Information security policy approved by leadership Signed + reviewed annually

Roles + responsibilities for InfoSec defined Org chart shows who owns what

Segregation of duties enforced Same person cannot code + deploy + approve

Management commitment + InfoSec resources allocated Documented annually

Contact with authorities (regulators) documented In incident response plan

Contact with special interest groups (CERT, ISACs) Membership or subscription

Threat intelligence program in place Monthly threat scan

InfoSec in project management Security review on every new project

A.6 — People controls

A.6 — Personnel security 0%

Background screening for new hires with privileged access

Confidentiality / NDA agreements on file Signed by every employee + contractor

InfoSec awareness training annually Documented attendance

Disciplinary process for InfoSec violations defined

Information security responsibilities on offboarding Onboarding/offboarding checklist

A.7 — Physical controls

A.7 — Physical & environmental security 0%

Physical security perimeter for offices + server rooms

Physical entry controls (badges, locks, CCTV)

Clean desk + clean screen policy Enforced + documented

Equipment + cabling protected

Secure disposal of assets Certified disposal, not landfill

A.8 — Technological controls

A.8 — Access + identity 0%

User access provisioning + deprovisioning documented

Privileged access management (PAM) Just-in-time access where possible

MFA enforced on admin accounts

Information access restriction (least privilege)

Access rights reviewed quarterly

A.8 — Cryptography + secure development 0%

Encryption at rest + in transit TLS 1.2+ everywhere

Key management documented

Secure development lifecycle Code review + dependency scanning

Application security testing (SAST + DAST)

Vulnerability disclosure program /security/disclosure already live

A.8 — Logging + monitoring 0%

Centralized logging in place

Clock synchronization across systems

Privileged operations monitored + alerted

Anti-malware controls deployed

Backup + recovery tested annually

A.8 — Incident + continuity 0%

Incident response plan documented

Business continuity + DR plan tested annually

Supplier security reviewed before contract

Cloud services security assessment For each major SaaS used

SOC 2 Readiness Vulnerability Disclosure

Disclaimer

Content on iisupp.net and its sub-sites is general information only. Any troubleshooting step, instruction, tool, estimate or data taken from this site is used at your own risk, and information may be out of date — please do your own due diligence before acting on it.

No published guide can account for every factor in a live environment. If the system matters, don’t guess — call (647) 581-3182 and have it done safely. Full disclaimer · terms · privacy.