ISO 27001 checklist: every step to certification for a small business

To get ISO 27001 certified, you need two things in place: the requirements in clauses 4 to 10 of ISO/IEC 27001:2022 (the management system), and a reasoned decision on each of the 93 controls in Annex A (the security measures). Then you run the system long enough to produce real records, and a certification body audits it in two stages.

This checklist puts that in the order a small business would actually do it. Work down it, and you'll know where you stand. Each item names the clause or control it comes from, so you can check it against your copy of the standard.

Before you start

• Know why you're doing it. A customer contract, a tender, a board decision? Write it down. It sets your scope and your deadline.
• Get a copy of the standard. ISO/IEC 27001:2022 is the standard you're audited against, and it's shorter than most people expect. ISO/IEC 27002:2022 is the companion guidance on the Annex A controls; it's optional but helpful.
• Check you're using the 2022 version. Older templates written for 2013 list 114 controls in 14 sections. The 2022 Annex A has 93 controls in 4 themes.
• Name an owner. One person who keeps it moving, with time set aside to do it.
• Get top management's backing. Clause 5 needs them to lead, not just sign.

Clause 4: context and scope

• External and internal issues (4.1). What affects your ability to keep information secure: your market, your systems, your size, your suppliers. Since the 2024 amendment, this includes deciding whether climate change is a relevant issue.
• Interested parties and their requirements (4.2). Customers, staff, regulators, suppliers, insurers, and what each expects of you (contracts, UK GDPR and so on).
• Scope (4.3). Which parts of the business, locations, services and systems the ISMS covers, and how it connects to anything outside it. The scope must be documented.
• The ISMS itself (4.4). You establish, run, maintain and improve the processes that make up your ISMS. The rest of this checklist is how.

Tip: start with the services your customers are asking about. A tight scope you can run well beats a wide one you can't.

Clause 5: leadership

• Leadership and commitment (5.1). Top management makes sure the ISMS has resources, fits the business and gets attention.
• Information security policy (5.2). A short, top-level policy, established by top management, that includes or points to your objectives and commits to meeting requirements and continual improvement. It must be documented and communicated.
• Roles, responsibilities and authorities (5.3). Who is responsible for the ISMS and who reports on how it's performing.

Clause 6: planning

• Risk assessment method (6.1.2). How you identify risks, who owns them, how you rate likelihood and impact, and what level of risk you'll accept. Keep it documented, and make sure repeat assessments give consistent results.
• Risk assessment results (6.1.2, 8.2). A risk register: what could go wrong with your information, how likely, how bad, and who owns each risk.
• Risk treatment (6.1.3). For each risk, decide: reduce it with controls, avoid it, share it (for example, insurance or a supplier), or accept it.
• Compare against Annex A (6.1.3 c). Check your chosen controls against all 93 so nothing necessary has been missed.
• Statement of Applicability (6.1.3 d). Every Annex A control, whether it's included, why, and whether it's implemented. Auditors read this closely.
• Risk treatment plan (6.1.3 e). What you'll do, who does it and by when, approved by the risk owners along with the remaining (residual) risk.
• Information security objectives (6.2). A few measurable goals, with owners, deadlines and how you'll judge them. Documented.
• Planning of changes (6.3). When you change the ISMS, do it in a planned way.

Clause 7: support

• Resources (7.1). Time, budget and tools to run the ISMS.
• Competence (7.2). The people with security roles have the skills for them, and you keep evidence (training records, qualifications, experience).
• Awareness (7.3). Everyone in scope knows the policy, how they contribute, and what happens if they don't follow it. Usually: induction plus regular short training.
• Communication (7.4). What you communicate about security, to whom, when and how.
• Documented information (7.5). Your documents have an owner, a version, a review date and an approval, and people can find the current one.

Clause 8: operation

• Run the processes you planned (8.1). Keep enough records to show they happened as planned, and control anything outsourced.
• Reassess risks (8.2) at planned intervals and when something significant changes. Keep the results.
• Carry out the treatment plan (8.3) and keep the results.

Annex A: work through the 93 controls

Annex A is grouped into four themes. You don't have to implement every control, but you must consider every one and justify each decision in your Statement of Applicability.

For a small business, the controls that usually generate most of the evidence are:

• Asset inventory (5.9): your laptops, phones, SaaS tools, data stores and owners.
• Access control (5.15 to 5.18, 8.2, 8.5): joiners, movers and leavers, MFA, admin accounts, regular access reviews.
• Suppliers (5.19 to 5.23): a list of the suppliers who touch your data, what you checked, and what the contract says. Cloud services sit here too.
• Incident management (5.24 to 5.28, 6.8): how people report something, who decides, and a log of what happened.
• Continuity (5.29, 5.30): keeping information secure and your ICT working through a disruption, with a test you can show.
• Legal and contractual requirements (5.31, 5.34): UK GDPR, contracts and other obligations, identified and kept up to date.
• People (6.1 to 6.6): screening, terms of employment, training, and what happens when someone leaves.
• Endpoints, vulnerabilities and malware (8.1, 8.7, 8.8): device management, patching and protection.
• Backup (8.13): backups taken, and restores tested and recorded.
• Logging and monitoring (8.15, 8.16): what you log, and who looks at it.

If a control doesn't apply (for example, secure development when you don't build software), mark it excluded in the SoA and say why.

Clause 9: performance evaluation

• Monitoring and measurement (9.1). Decide what you measure (for example, training completion, patching times, access review completion), who looks at it and when. Keep the results.
• Internal audit (9.2). Plan an audit programme that covers the whole ISMS, and carry out at least one full internal audit before stage 2. The auditor must be objective and impartial, so they shouldn't audit their own work. Keep the programme and the results.
• Management review (9.3). Top management reviews the ISMS at planned intervals, covering the inputs the standard lists (audit results, risks, objectives, feedback, changes). Keep the minutes and the decisions.

Clause 10: improvement

• Nonconformity and corrective action (10.2). When something isn't done as required, fix it, find the cause, stop it recurring, and record what you did.
• Continual improvement (10.1). Show the ISMS gets better over time, not just that it exists.

The certification audit

• Run the ISMS for a while. Many certification bodies want to see a few months of operation with real records (training, access reviews, supplier checks, restore tests, an internal audit and a management review) before stage 2.
• Choose a certification body. In the UK, check it's accredited by UKAS for ISO/IEC 27001 using the UKAS directory, and get a few quotes.
• Stage 1. The auditor reviews your documentation and readiness. Expect a list of things to fix before stage 2.
• Stage 2. The auditor tests whether the ISMS works in practice: they sample records, talk to people and look at systems. Any nonconformities need corrective action before the certificate is issued.
• After certification. Surveillance audits follow each year, with recertification every three years. The records have to keep building.

Common reasons a checklist isn't enough

A checklist tells you what to produce. It doesn't tell you what to write for your business, and it doesn't remind anyone in month seven that the access review is overdue. The two places small businesses most often come unstuck are the blank page (risk register and SoA) and keeping the system running after the first audit. Plan for both. For the documents you'll need, see our ISO 27001 policies list, and for a do-it-yourself route, getting ISO 27001 without a consultant.

How ClearIMS helps

ClearIMS is designed for small and mid-sized UK businesses that want ISO 27001 discipline without a big-consultancy engagement. You describe your business in plain English and it drafts your first scope, risks, policies, Statement of Applicability and tasks, and its Recommended tasks list puts the rest of this checklist in order, most important first: whether you have 5 minutes or 5 hours, you work down the list. It emails people about their outstanding and overdue actions, and everything stays a draft until a named person approves it; the AI never approves anything.

We make the software. Your certification is yours, awarded by your certification body.

Take the 2-minute readiness check, or book a 20-minute call.