A practical, ordered path to ISO 27001:2022 certification — building an ISMS auditors recognise, without the busywork.
The checklist
- Secure leadership buy-in and assign an owner for the information security management system (ISMS).
- Define the ISMS scope — the boundaries, locations and assets it covers, and the interested parties.
- Run a risk assessment — identify risks to the confidentiality, integrity and availability of information, and score them.
- Decide risk treatment & select controls from Annex A (93 controls across four themes: organizational, people, physical, technological).
- Write your Statement of Applicability (SoA) — which Annex A controls apply, which don't, and why.
- Produce the mandatory documentation — policies, risk methodology, risk treatment plan, and security objectives.
- Implement the controls and your risk treatment plan across the organization.
- Train your people — security awareness plus role-specific competence.
- Operate the ISMS and collect evidence that it is working as intended.
- Run an internal audit of the ISMS against the standard.
- Hold a management review so leadership formally assesses the ISMS.
- Pass the Stage 1 audit — an accredited certification body reviews your documentation.
- Pass the Stage 2 audit — the body tests your ISMS in practice.
- Receive certification — valid three years, with annual surveillance audits.
The shortcutSteps 3–9 are where teams stall. Continuous automation keeps your risk register, Statement of Applicability and evidence current — so internal audits and surveillance visits become routine instead of a scramble.
A practical starting checklist, not certification advice. Certificates are issued by accredited certification bodies.