# ISO 27001: trigger-to-evidence checklist

Use this when something lands on your desk and you need to know what the ISMS must be able to show.
Clause numbers are ISO/IEC 27001:2022.

## A customer security questionnaire or audit

- [ ] Scope of the ISMS, written down (clause 4.3)
- [ ] Information security policy, approved by top management (clause 5.2)
- [ ] Risk assessment results and risk treatment plan (clauses 6.1.2, 6.1.3, 8.2, 8.3)
- [ ] Statement of Applicability, with the reason each Annex A control is in or out (clause 6.1.3)
- [ ] Latest internal audit report (clause 9.2)

## A certification decision by the board

- [ ] Every item above, plus information security objectives and plans to meet them (clause 6.2)
- [ ] Evidence of competence and awareness for people doing the work (clauses 7.2, 7.3)
- [ ] Monitoring and measurement results (clause 9.1)
- [ ] Management review minutes (clause 9.3)
- [ ] Nonconformities and the corrective action taken (clause 10.2)

## NIS2 applies to the organization (Directive (EU) 2022/2555)

- [ ] Management body approval of the cybersecurity risk-management measures (Article 20)
- [ ] Training records for members of the management body (Article 20)
- [ ] The ten minimum measures of Article 21(2), each mapped to a policy, a control and an owner
- [ ] Incident reporting procedure that can meet 24 hours, 72 hours and one month (Article 23)

## DORA applies to the organization (Regulation (EU) 2022/2554)

- [ ] Management body approvals for ICT risk (Article 5)
- [ ] ICT risk management framework and its independent control function (Article 6)
- [ ] Security awareness training for all staff (Article 13(6))

## Before you call yourself ready

- [ ] Each item has an owner, a date and a place where the evidence lives
- [ ] Someone other than the author has checked the evidence against the clause