Guide
ISO 27001 compliance checklist
ISO/IEC 27001 is the international standard for information security management systems (ISMS). This checklist maps the 2022 Annex A controls into four domains and adds the certificate checks that matter most when you are evaluating a vendor.
The four control domains
ISO 27001:2022 organizes controls into Organizational, People, Physical, and Technological domains. Use these questions to probe a vendor's ISMS rather than relying on the certificate alone.
Organizational controls
Governance, risk management, and supplier oversight — the foundation of ISO 27001.
- Information security policy exists, is approved, and is communicated to relevant personnel
- Roles and responsibilities for information security are assigned and documented
- Risk assessment and risk treatment process is in place with acceptable risk criteria
- Information security is integrated into project and change management
- Documented supplier agreements include security requirements and monitoring rights
- Business continuity plans address information security and are exercised
- Legal, statutory, regulatory, and contractual requirements are identified and tracked
- Independent review of information security is performed at planned intervals
People controls
Controls for screening, awareness, and acceptable use of personnel.
- Background checks are performed in line with legal and role requirements
- Employment agreements include information security responsibilities and confidentiality
- Security awareness training is delivered at onboarding and repeated periodically
- Disciplinary process addresses breaches of information security policy
- Termination or role change process revokes access and returns assets promptly
- Remote working policy covers device use, physical security, and communication
Physical controls
Protection of facilities, equipment, and media that host sensitive information.
- Physical security perimeters protect areas that contain critical information
- Access to secure areas is authorized, logged, and regularly reviewed
- Equipment is located and protected to reduce environmental and physical risks
- Clear desk and clear screen policy is implemented and enforced
- Media handling covers storage, transport, disposal, and destruction
- Cabling and utility supplies are protected from interception and disruption
Technological controls
Technical safeguards for access, cryptography, operations, and communications.
- User access is provisioned, reviewed, and revoked based on least privilege
- Multi-factor authentication protects privileged and remote access
- Password policies are enforced and aligned with current guidance
- Cryptographic controls protect confidentiality and integrity in transit and at rest
- Event logs capture access, changes, and exceptions; logs are protected and reviewed
- Vulnerabilities are identified, prioritized, and remediated within defined timeframes
- Systems are hardened, patched, and protected against malware
- Networks are segmented and traffic is monitored for anomalies
- Development, test, and production environments are separated
- Secure development practices cover input validation, dependency management, and testing
- Backup data is encrypted, tested, and stored with defined retention
- Redundancy and failover are in place for critical services
How to verify an ISO 27001 certificate
Is the certificate still valid?
Check the issue and expiry dates. ISO 27001 certificates are valid for three years, with annual surveillance audits and a recertification audit in the third year.
Who issued it?
The certificate should come from an accredited certification body. Look for accreditation marks such as UKAS, ANAB, or the equivalent national body.
What is in scope?
The scope statement names the locations, systems, products, and functions covered. Confirm the service you are buying is inside that scope, not a neighboring product.
Are exclusions justified?
Annex A controls can be excluded if irrelevant, but the Statement of Applicability must justify each exclusion. Ask for it if the vendor claims a control does not apply.
Is the 2022 version referenced?
ISO/IEC 27001:2022 replaced the 2013 version. A current certificate should cite ISO/IEC 27001:2022 and the 2022 Annex A control set.
What do surveillance reports say?
Major nonconformities raised during surveillance audits can invalidate the certificate if not closed. Ask for the latest surveillance report summary.
Automate the ISO 27001 evidence review
Upload a vendor's ISO 27001 certificate, Statement of Applicability, or security overview and ComplianceCheckr grades it against these controls — quoting the source text as evidence, marking anything unsupported as unknown rather than guessing, and saving the result as a dated record you can approve, deny, or revisit.