ISO 27001 Readiness Checklist | Netray

0%

0 of 32 items complete

12 critical items still open - these are the highest-risk gaps.

ISMS Foundations

A defined ISMS scope statement covers all in-scope business units, systems, and physical locationsCRITICALA documented information security policy is approved by top managementCRITICALAn ISMS owner (CISO or equivalent) has been assigned with real authority and budgetA Statement of Applicability (SoA) has been drafted covering all Annex A controls (ISO 27001:2022)An asset inventory of information assets, systems, and third parties is maintained and currentCRITICALRoles and responsibilities for information security are documented across the organization (RACI or equivalent)

Risk Assessment and Treatment

A formal, repeatable risk assessment methodology is defined and documentedCRITICALA risk register is populated with identified risks, likelihood, and impact ratingsA risk treatment plan maps each material risk to specific Annex A controls with owners and deadlinesCRITICALResidual risk that is not fully mitigated has been formally accepted by managementThe risk assessment is refreshed at least annually or after any major organizational or system changeThird-party and supplier risk assessments have been completed for all critical vendors

Annex A Controls Implementation

An access control policy enforces least privilege with periodic access reviewsCRITICALMulti-factor authentication is enforced for all privileged and remote accessCRITICALEncryption standards are defined and implemented for data at rest and in transitLogging and monitoring cover privileged actions and security-relevant eventsBusiness continuity and disaster recovery plans have been tested within the last 12 monthsCRITICALSecure development lifecycle controls are documented for any in-house software developmentPhysical security controls are documented for data centers, server rooms, and offices

Documentation and Evidence

All mandatory ISO 27001 documents are complete: scope, policy, SoA, risk assessment, risk treatment planCRITICALOperational evidence is retained systematically (access reviews, training logs, incident tickets)A version control and approval workflow governs all ISMS documentationDocument retention aligns with applicable regulatory and contractual requirements

Internal Audit and Management Review

An internal audit program is scheduled covering all Annex A control areasCRITICALInternal auditors are independent of the processes and controls they auditNonconformities are tracked to closure with documented root cause analysisA management review meeting is held at least annually with documented minutes and decisionsCRITICALA corrective action process is defined and has evidence of use

Certification Body Engagement

A certification body has been selected and is accredited by a recognized national accreditation bodyThe Stage 1 (documentation review) audit has been scheduledAt least 3 months of operating evidence exists before scheduling Stage 2, since auditors sample real operational records, not just documentsCRITICALThe ongoing surveillance audit cadence (typically annual across a 3-year certification cycle) is understood and budgeted

Score one point per checked item and divide by total items for a percentage. Below 60 percent overall, or any unresolved critical item, means you are not ready to engage a certification body; expect a 3 to 6 month closure sprint focused on critical items before scheduling a Stage 1 audit.

Get your ISO 27001 gap analysis

We will email you a detailed gap report against your checklist responses, mapped to a realistic certification timeline, and a Netray compliance specialist will follow up with a 30-minute review.

No spam. Your results stay private. Unsubscribe anytime.

Why ISO 27001 matters beyond the certificate

ISO 27001 certification is increasingly a contractual requirement from enterprise customers and prime contractors, not just a voluntary best practice. For manufacturers serving aerospace, defense, and regulated industries, ISO 27001 frequently sits alongside CMMC and customer-specific security questionnaires as a baseline expectation before a contract is even discussed. Beyond the certificate itself, the risk assessment and Annex A control work required to achieve it materially reduces real operational risk if implemented substantively rather than as a documentation exercise.

ISO 27001 certification is increasingly a prerequisite in enterprise vendor security questionnaires.
The 2022 revision restructured Annex A into 93 controls across 4 themes; confirm your SoA maps to the current version.
Certification typically takes 6 to 12 months from a standing start to Stage 2 audit for a mid-size organization.

The most common Stage 1 findings

Stage 1 audits (documentation review) most commonly flag an incomplete or inconsistent Statement of Applicability, a risk treatment plan that does not map cleanly to implemented controls, and insufficient operational evidence for controls that were only recently implemented. Auditors want to see that controls have been operating long enough to generate real evidence, typically a minimum of three months, not just that a policy document exists.

An SoA that excludes controls without documented justification is a near-universal Stage 1 finding.
Controls implemented less than 3 months before Stage 2 rarely have enough evidence to pass sampling.
Risk treatment plans without assigned owners and deadlines are treated as incomplete, not just weak.

Budgeting realistically for certification

Certification body audit fees for a mid-size organization typically run $15,000 to $40,000 across Stage 1 and Stage 2 combined, plus annual surveillance audit fees of $8,000 to $20,000. The larger cost is internal: gap remediation, policy development, and the operational time to actually run controls for long enough to generate audit evidence, which is why most organizations underestimate total first-year cost by 2 to 3x if they only budget for the audit fee itself.

How Netray supports ISO 27001 readiness

Netray helps aerospace, defense, and manufacturing clients build ISMS documentation, risk treatment plans, and Annex A control implementations that satisfy both ISO 27001 and overlapping CMMC requirements in a single coordinated effort, avoiding duplicate work across two compliance programs.

Frequently Asked Questions

How long does ISO 27001 certification take?

For an organization starting with no formal ISMS, a realistic timeline is 6 to 12 months from initial gap analysis to Stage 2 certification audit, including at least 3 months of operating history for implemented controls before Stage 2 can be scheduled. Organizations with existing security programs and documentation can sometimes compress this to 4 to 6 months.

How much does ISO 27001 certification cost?

Certification body audit fees for a mid-size organization (roughly 100 to 500 employees) typically run $15,000 to $40,000 for combined Stage 1 and Stage 2 audits, plus $8,000 to $20,000 annually for surveillance audits across the 3-year certification cycle. Internal remediation cost (consulting, tooling, staff time) is usually the larger expense and varies significantly based on starting security maturity.

What is the difference between Stage 1 and Stage 2 ISO 27001 audits?

Stage 1 is a documentation review confirming your ISMS scope, policy, Statement of Applicability, and risk treatment plan are complete and internally consistent. Stage 2 is an operational audit where the certification body samples actual evidence that controls are operating as documented, interviews staff, and reviews records like access reviews and incident tickets. Both must pass before certification is granted.

What is a Statement of Applicability?

The Statement of Applicability (SoA) is a mandatory ISO 27001 document listing all Annex A controls, whether each is implemented or excluded, and the justification for any exclusion. It is the single document auditors reference most heavily during both Stage 1 and Stage 2, and an incomplete or poorly justified SoA is the most common reason organizations fail or delay a Stage 1 audit.

Can ISO 27001 and CMMC compliance work overlap?

Yes, substantially. Both frameworks require formal risk assessment, access control, encryption, incident response, and continuous monitoring, though CMMC (built on NIST SP 800-171) has more prescriptive technical requirements for defense contractors handling controlled unclassified information. Organizations pursuing both should map controls once against a combined control set to avoid duplicating documentation and evidence-gathering effort.

Get a gap analysis against your completed checklist and a realistic path to Stage 1 audit.

Talk to an Expert Explore More Free Tools

Related Tools

Aerospace & Defense

SOC 2 Readiness Assessment

Answer 7 questions on policies, access control, monitoring, and evidence retention to get a scored SOC 2 readiness band with specific next steps before engaging an auditor.

Aerospace & Defense

Zero Trust Readiness Assessment

Answer 8 questions on identity, device posture, segmentation, and access policy to get a scored zero trust maturity band with a specific remediation roadmap.

ERP Operations

Vulnerability Remediation SLA Calculator

Estimate how many weeks it will take to burn down your priority vulnerability backlog given current findings volume, engineer capacity, and new findings arriving each week.

ISO 27001 Readiness Checklist: Are You Ready for Stage 1?