Clause 4
Context of the organisation
Define the internal and external issues, interested parties, and the ISMS scope. The most common Stage 1 finding is a vague or aspirational scope.
ISO/IEC 27001:2022
ISO 27001
Readiness Assessment
The global benchmark for ISMS certification. Assesses your organisation's maturity against Annex A controls and clause requirements — whether you are preparing for Stage 1, Stage 2, or continuous improvement.
- 20 QuestionsAssessment
- ~12 minDuration
- All OrganisationsScope
Who it applies to
- Organisations seeking ISO/IEC 27001:2022 certification — Stage 1 readiness, Stage 2 audit preparation, or surveillance maintenance
- Suppliers required by enterprise customers to evidence an Information Security Management System (ISMS)
- Public sector and regulated entities using ISO 27001 as the backbone of their NIS2, DORA, or sector-specific control framework
Key articles & clauses, in plain English
The five points auditors and supervisors actually verify first.
Clause 5
Leadership
Top management must demonstrate visible commitment, approve the Information Security Policy, and assign roles, responsibilities, and authorities.
Clause 6.1
Risk assessment & treatment
A documented, repeatable risk methodology with defined acceptance criteria; a Statement of Applicability covering all 93 Annex A controls with justified inclusions and exclusions.
Clauses 9 & 10
Performance evaluation & improvement
Mandatory internal audits, management reviews with documented outputs, and a corrective action process with root-cause analysis and effectiveness verification.
Annex A 8.8
Management of technical vulnerabilities
New explicit control in the 2022 revision. Auditors look for a defined SLA for patching, a documented exception process, and evidence of patch records.
What this assessment covers
5 topics · 20 self-assessment questions.
- Domain 01
Context & Leadership
ISO 27001:2022 Clauses 4 and 5 require organisations to define the ISMS scope, identify interested parties, and demonstrate visible leadership commitment to information security.
- Domain 02
Risk Assessment
Clause 6.1 requires a defined, repeatable risk assessment process covering identification, analysis, and evaluation — with documented criteria for risk acceptance.
- Domain 03
Asset & Access Control
Annex A controls 5.9–5.15 cover asset management and access control — two of the most frequently audited control families in ISO 27001:2022.
- Domain 04
Operations & Incident Management
Clauses 8 and Annex A controls 5.24–5.28 require documented operational security procedures and a tested incident management capability.
- Domain 05
Performance & Improvement
Clauses 9 and 10 require measurable performance evaluation — including internal audits, management reviews, and a documented process for handling nonconformities.
Top audit pitfalls
- An ISMS scope written to look impressive on a certificate but not matching operational reality.
- A Statement of Applicability that simply marks every Annex A control as applicable without justification.
- Internal audits that exist on paper but lack independence from the audited function (a Clause 9.2 non-conformity).
Frequently asked questions
Annex A was restructured from 14 control families and 114 controls into 4 themes and 93 controls, with 11 new controls (e.g. threat intelligence, secure coding, data masking, web filtering). The clauses (4–10) are largely unchanged.
Yes. The transition deadline for accredited certifications was 31 October 2025. Any organisation still on the 2013 version after that date is non-certified.
Three to nine months from kickoff to Stage 2 audit for an organisation with reasonable IT hygiene. Six months is a realistic median for an SMB without an existing ISMS.
Yes. ISO 27001 is scaleable — the standard demands proportionate measures, not a large team. Single-CISO organisations with 10–30 staff certify regularly.
It covers the security pillar of GDPR (Art. 32 — security of processing) very well, but does not cover lawful basis, data subject rights, or DPIAs. Pair it with ISO 27701 or a dedicated GDPR programme.
20 evidence-based questions across the five clause/Annex A families auditors actually verify in Stage 1 and Stage 2 — context, risk, asset and access control, operations and incident management, performance and improvement.
Start your ISO 27001 assessment
20 questions · ~~12 min · Scorecard based on your answers. No sign-up to begin.