How ready are you for ISO 27001?

Eight questions, about two minutes. Answer honestly: "Partly" counts for half.

01Have you defined the scope of your ISMS: which people, sites, systems and data it covers?

Yes Partly No

02Does top management formally own information security, with assigned roles and responsibilities?

Yes Partly No

03Do you run a documented, repeatable information security risk assessment?

Yes Partly No

04Do you have a Statement of Applicability covering the Annex A controls?

Yes Partly No

05Are security policies approved, published and acknowledged by staff?

Yes Partly No

06Is there a security awareness programme, including phishing training?

Yes Partly No

07Do you have an incident management process that has actually been tested?

Yes Partly No

08Have you carried out an internal audit and a management review in the last 12 months?

Yes Partly No

Other readiness checks