Assessment Guide

ISO 27001 Readiness Assessment Guide

Evaluate your organisation's readiness for ISO/IEC 27001:2022 certification and identify the gaps you need to close.

Synaptic Technologies · v1.0 · 2026

ISO/IEC 27001 is the internationally recognised standard for Information Security Management Systems (ISMS). Achieving certification demonstrates to customers, partners, and regulators that your organisation takes information security seriously. This readiness assessment helps you understand where you stand today and what work lies ahead.

For each control area, rate your current maturity level from 0 to 4 using the scale below. Total your scores to determine your overall readiness level.

Maturity Scale

0Not Implemented

No controls exist. The requirement has not been addressed.

1Initial / Ad Hoc

Some activity exists but it is informal, undocumented, and inconsistent.

2Developing

Controls are partially implemented and documented but not consistently applied.

3Defined

Controls are documented, implemented, and consistently applied across the organisation.

4Managed & Optimising

Controls are measured, reviewed, and continuously improved. Evidence is maintained.

Clause 4: Context of the Organisation

4.1Internal and external issues relevant to information security have been identified and documented.Rate 0–4

4.2Interested parties (stakeholders) and their requirements have been identified.Rate 0–4

4.3The scope of the ISMS has been defined and documented.Rate 0–4

Clause 5: Leadership

5.1Top management demonstrates leadership and commitment to the ISMS.Rate 0–4

5.2An information security policy has been established, approved by management, and communicated.Rate 0–4

5.3Roles, responsibilities, and authorities for information security have been assigned.Rate 0–4

Clause 6: Planning

6.1.1A formal risk assessment process has been defined and documented.Rate 0–4

6.1.2Information security risks have been identified, analysed, and evaluated.Rate 0–4

6.1.3A risk treatment plan has been developed and a Statement of Applicability (SoA) produced.Rate 0–4

6.2Information security objectives have been established and are measurable.Rate 0–4

Clause 7: Support

7.1Resources required for the ISMS have been determined and provided.Rate 0–4

7.2Staff competence in information security has been assessed and training provided.Rate 0–4

7.3Staff are aware of the information security policy and their contribution to the ISMS.Rate 0–4

7.4Internal and external communication relevant to the ISMS is managed.Rate 0–4

7.5Documented information (policies, procedures, records) is controlled and maintained.Rate 0–4

Clause 8: Operation

8.1Operational processes are planned, implemented, and controlled.Rate 0–4

8.2Information security risk assessments are performed at planned intervals or when significant changes occur.Rate 0–4

8.3The risk treatment plan is implemented and results are documented.Rate 0–4

Clause 9: Performance Evaluation

9.1The performance and effectiveness of the ISMS is monitored, measured, and evaluated.Rate 0–4

9.2Internal audits of the ISMS are conducted at planned intervals.Rate 0–4

9.3Management reviews of the ISMS are conducted and results are documented.Rate 0–4

Clause 10: Improvement

10.1Nonconformities are identified, corrected, and root causes addressed.Rate 0–4

10.2The ISMS is continually improved based on audit results, risk assessments, and management reviews.Rate 0–4

Annex A: Key Control Areas (ISO 27001:2022)

ISO 27001:2022 Annex A contains 93 controls across 4 themes. Rate your maturity in each theme:

5.xOrganisational Controls (37 controls)

Policies, roles, responsibilities, supplier relationships, incident management, business continuity.

Maturity: Rate 0–4

6.xPeople Controls (8 controls)

Screening, terms of employment, awareness, training, disciplinary process, remote working.

Maturity: Rate 0–4

7.xPhysical Controls (14 controls)

Physical security perimeters, entry controls, securing offices, clear desk/screen, equipment security.

Maturity: Rate 0–4

8.xTechnological Controls (34 controls)

Access control, cryptography, malware protection, logging, vulnerability management, network security, data masking, secure development.

Maturity: Rate 0–4

Readiness Score Interpretation

Add up your maturity scores across all controls to determine your readiness level:

0–30Not Ready

Significant foundational work is required before pursuing certification. Start with a formal gap analysis.

31–60Early Stage

Some controls are in place but major gaps remain. A structured implementation programme is needed.

61–90Progressing

Good progress has been made. Focus on closing remaining gaps and building evidence.

91–110Certification Ready

Strong ISMS in place. Engage a certification body for a formal audit.

Next Steps Toward Certification

Conduct a Formal Gap Analysis

Engage a qualified ISO 27001 consultant or auditor to conduct a formal gap analysis against the standard.

Develop Your ISMS Documentation

Create the mandatory documented information required by the standard: ISMS scope, information security policy, risk assessment methodology, Statement of Applicability, and risk treatment plan.

Implement Controls

Implement the technical and organisational controls identified in your risk treatment plan.

Run Internal Audits

Conduct internal audits to verify that controls are operating effectively before the certification audit.

Engage a Certification Body

Select an accredited certification body (e.g. BSI, Bureau Veritas, SGS) to conduct the Stage 1 and Stage 2 certification audits.

This assessment guide is provided by Synaptic Technologies for informational purposes. It does not replace a formal ISO 27001 gap analysis conducted by a qualified auditor. Contact us at [email protected] for ISO 27001 implementation support.

Ready to Pursue ISO 27001?

Our team can guide you through the full ISO 27001 implementation journey — from gap analysis to certification.