# ISO 27001:2022 readiness checklist — for small SaaS teams

A practical working list of the Annex A controls an auditor will actually probe for a cloud-only small team, what evidence to have ready, and how to collect each item. 44 control groups covering all four themes.

This is self-assessment material, not audit advice. Your certification body decides what's sufficient.

Companion worksheet: `iso27001-readiness-checklist.csv` — add Status / Owner / Notes per row and run it as your working list.

## How to use it

1. Walk the CSV top to bottom; mark each row Not started / In progress / Ready.
2. Collect the artifact named in 'How to collect it' — screenshots and exports are legitimate evidence.
3. Re-run quarterly; most controls need a documented review cadence, not perfection.
4. Anything marked N/A (e.g. physical controls for cloud-only teams) needs a written rationale, not silence.

## Organisational controls

### A.5.1 — Policies for information security

- **Auditor asks:** The ISMS policy set, versions, approval dates, and who approved them
- **Collect via:** Export policy docs with version history; capture approval in meeting minutes or doc history
- **Cadence:** Annual review + on request

### A.5.2 — Information security roles

- **Auditor asks:** Named role assignments (part-time is fine); responsibilities written down
- **Collect via:** Roles table in the ISMS doc; job descriptions or team charter excerpt
- **Cadence:** Annual review

### A.5.6 — Contact with authorities

- **Auditor asks:** Evidence you know who to contact (regulator, CERT) in an incident
- **Collect via:** Incident-response runbook section listing contacts
- **Cadence:** Annual review

### A.5.7 — Threat intelligence

- **Auditor asks:** A lightweight process for reviewing relevant threats
- **Collect via:** Quarterly threat-review note (what you looked at, what changed)
- **Cadence:** Quarterly

### A.5.9 — Inventory of assets

- **Auditor asks:** Asset register: cloud services, SaaS subscriptions, endpoints, data stores
- **Collect via:** Spreadsheet export of cloud console + SaaS admin; owner per asset
- **Cadence:** Quarterly update

### A.5.10 — Acceptable use of assets

- **Auditor asks:** Acceptable use policy, and evidence staff saw it
- **Collect via:** Policy doc + acknowledged records or onboarding checklist
- **Cadence:** Annual re-ack

### A.5.11 — Return of assets

- **Auditor asks:** Offboarding checklist showing access and equipment return per leaver
- **Collect via:** Export offboarding tickets; sample 2-3 leavers
- **Cadence:** Per leaver

### A.5.12 — Classification of information

- **Auditor asks:** Simple classification scheme (Public/Internal/Confidential) applied to docs
- **Collect via:** Classification section in ISMS doc; sample labelled docs
- **Cadence:** Annual review

### A.5.14 — Information transfer

- **Auditor asks:** Rules for sharing customer and internal data (encryption, approved channels)
- **Collect via:** Transfer policy section; sample config showing TLS/SFTP enforcement
- **Cadence:** Annual review

### A.5.15 — Access control policy

- **Auditor asks:** Access control policy linking roles to least privilege
- **Collect via:** Policy doc; role-to-permission matrix
- **Cadence:** Annual review

### A.5.16 — Identity management

- **Auditor asks:** Unique accounts via SSO/IdP; no shared logins
- **Collect via:** IdP user export; screenshot of SSO config
- **Cadence:** Per change + quarterly sample

### A.5.17 — Authentication information

- **Auditor asks:** Password/MFA policy and enforcement evidence
- **Collect via:** Screenshot of MFA enforcement on IdP, cloud consoles, code repos
- **Cadence:** Quarterly

### A.5.18 — Access rights

- **Auditor asks:** Joiner-mover-leaver evidence: approvals for grants and timely revocations
- **Collect via:** Sample JML tickets; access-review export showing revocations
- **Cadence:** Quarterly access review

### A.5.19-5.23 — Supplier relationships

- **Auditor asks:** Vendor list with security review for critical suppliers; cloud agreements
- **Collect via:** Vendor register CSV; sample vendor risk note for top 5 vendors
- **Cadence:** Annual re-review

### A.5.24-5.28 — Incident management

- **Auditor asks:** Incident process + log of incidents (even 'none this period' with rationale)
- **Collect via:** Runbook; incident log export; post-mortem for real incidents
- **Cadence:** Continuous log

### A.5.29-5.30 — Business continuity / ICT readiness

- **Auditor asks:** BCP one-pager + last test or tabletop note
- **Collect via:** BCP doc; tabletop test summary with date and findings
- **Cadence:** Annual test

### A.5.31-5.34 — Legal, privacy, records

- **Auditor asks:** Register of legal/contractual requirements (GDPR, DPAs); records retention
- **Collect via:** Legal requirements register; signed customer DPAs; retention schedule
- **Cadence:** Per new contract + annual

### A.5.35 — Independent review

- **Auditor asks:** Evidence someone outside day-to-day ops reviewed the ISMS
- **Collect via:** External review note or documented management review with findings
- **Cadence:** Annual

### A.5.36-5.39 — Compliance and privacy

- **Auditor asks:** Compliance obligations checklist; privacy-by-design notes for new features
- **Collect via:** Compliance register; design review notes for latest feature
- **Cadence:** Per release + annual

## People controls

### A.6.1 — Screening

- **Auditor asks:** Background checks where lawful/appropriate, documented
- **Collect via:** Screening policy + completed check records
- **Cadence:** Per hire

### A.6.2 — Terms of employment

- **Auditor asks:** Confidentiality/NDA obligations in contracts or handbook
- **Collect via:** Signed NDAs / contract clauses; handbook section
- **Cadence:** Per hire

### A.6.3 — Security awareness

- **Auditor asks:** Training records: what staff completed and when
- **Collect via:** Training tracker (spreadsheet is fine); course completion exports
- **Cadence:** Annual + onboarding

### A.6.4 — Disciplinary process

- **Auditor asks:** Documented process for security violations
- **Collect via:** Employee handbook section
- **Cadence:** Annual review

### A.6.5 — Post-employment responsibilities

- **Auditor asks:** Contract clauses surviving employment end
- **Collect via:** Contract templates showing obligations
- **Cadence:** Per contract update

### A.6.7 — Remote working

- **Auditor asks:** Remote work security requirements (device rules, home network basics)
- **Collect via:** Remote work policy + endpoint policy cross-reference
- **Cadence:** Annual review

### A.6.8 — Event reporting

- **Auditor asks:** Clear reporting channel staff know about; log of reports
- **Collect via:** Policy page/channel doc; report log (lightweight is fine)
- **Cadence:** Continuous log

## Physical controls

### A.7.1-7.4 — Physical perimeters and offices

- **Auditor asks:** Where physical controls apply (offices) and how access is restricted
- **Collect via:** Office access list, or a cloud-only scope note explaining N/A
- **Cadence:** Annual + per change

### A.7.5-7.6 — Threat protection / secure off-site working

- **Auditor asks:** Laptop encryption, screen locks
- **Collect via:** MDM report showing disk encryption status on all endpoints
- **Cadence:** Quarterly export

### A.7.7-7.10 — Equipment disposal and media

- **Auditor asks:** Secure wipe before disposal; disposal records
- **Collect via:** Disposal log; MDM remote-wipe record for retired laptops
- **Cadence:** Per disposal

### A.7.12 — Cabling security

- **Auditor asks:** N/A for cloud-only teams - record the rationale
- **Collect via:** Note in ISMS scope doc explaining cloud-only coverage
- **Cadence:** Annual review

## Technological controls

### A.8.2 — Privileged access rights

- **Auditor asks:** List of admin accounts and why each exists
- **Collect via:** IdP/cloud admin role exports; documented justification
- **Cadence:** Quarterly review

### A.8.3 — Information access restriction

- **Auditor asks:** Permissions mapped to systems; least privilege in production
- **Collect via:** Cloud IAM policy export; production access list
- **Cadence:** Quarterly

### A.8.5 — Secure authentication

- **Auditor asks:** MFA enforced everywhere; strong password rules
- **Collect via:** MFA enforcement screenshots per system (IdP, cloud, repo, CI)
- **Cadence:** Quarterly

### A.8.7 — Protection against malware

- **Auditor asks:** Managed endpoints with OS protections; cloud malware handling
- **Collect via:** Endpoint security status export or EDR console report
- **Cadence:** Quarterly

### A.8.8 — Technical vulnerabilities

- **Auditor asks:** Vulnerability scanning evidence and patching cadence
- **Collect via:** Dependabot/scanner exports; patch log; triage notes
- **Cadence:** Weekly scan, monthly patch

### A.8.9 — Configuration management

- **Auditor asks:** Baseline configs for cloud resources; IaC where possible
- **Collect via:** Terraform repo; CIS benchmark config-scan output
- **Cadence:** Per change

### A.8.12 — Data leakage prevention

- **Auditor asks:** DLP posture: sharing restrictions on storage and email
- **Collect via:** Workspace admin settings export
- **Cadence:** Quarterly

### A.8.13 — Information backup

- **Auditor asks:** Backup configuration + evidence of a restore test
- **Collect via:** Backup settings export; restore-test record with date and result
- **Cadence:** Monthly check, annual restore test

### A.8.15 — Logging

- **Auditor asks:** Central logs for prod access, admin actions, auth events
- **Collect via:** Log config screenshots; retention settings
- **Cadence:** Continuous

### A.8.16 — Monitoring activities

- **Auditor asks:** Alerting on suspicious events; alert review cadence
- **Collect via:** Alert config; on-call or weekly review note
- **Cadence:** Weekly review

### A.8.20-8.22 — Network security

- **Auditor asks:** VPC/firewall rules reviewed; no open admin ports to 0.0.0.0/0
- **Collect via:** Cloud network config export; firewall rule review
- **Cadence:** Quarterly review

### A.8.24 — Cryptography

- **Auditor asks:** TLS everywhere, key management, encryption at rest
- **Collect via:** TLS config scan output; KMS/cloud encryption settings
- **Cadence:** Annual review

### A.8.25-8.31 — Secure development lifecycle

- **Auditor asks:** Secure coding policy, code review required, dependency scanning, env separation
- **Collect via:** SDLC policy section; PR review exports; SCA scan output; env diagram
- **Cadence:** Continuous

### A.8.32 — Change management

- **Auditor asks:** Change records linked to tickets/releases; approvals
- **Collect via:** Release log; sample change tickets with approval trail
- **Cadence:** Per change