Readiness check — ISO 27001

Scope & context

Have you decided which parts of the organisation the ISMS will cover?

Yes — it's written downRoughly agreed, not writtenNot yet

How involved is senior management in information security?

Actively involved — security is on the leadership agendaThere is an executive sponsor, but involvement is occasionalNot involved yet

Existing ISMS

Which written security policies exist today?

A full ISMS-style set — security policy, access control, incident response, and moreA few core policies, e.g. acceptable use and access controlGeneral IT documentation onlyNone

Is there a maintained inventory of information assets — systems, data stores, devices?

Yes, and it is kept currentPartial or out of dateNo

Track record

Has the organisation been through a certification or formal audit before?

ISO 27001 — lapsed, or elsewhere in the groupAnother standard — ISO 9001, SOC 2, PCI DSS, …Customer or internal audits onlyNo

Risk

How are security risks assessed today?

A formal method, run on a scheduleA structured assessment has been done at least onceAd hoc — risks are discussed when they surfaceNot assessed

Controls in practice

How is access to systems granted and removed?

Centrally managed and periodically reviewedCentrally managed, rarely reviewedManually, per system

What happens when a security incident occurs?

A documented process, with records of past incidentsHandled informally by ITNothing defined

Are key suppliers' security arrangements reviewed?

Yes — security terms in contracts, plus periodic reviewSecurity terms in contracts onlyNo

Ways of working

When security work is done, does it leave a record — tickets, minutes, logs?

Yes, systematicallySometimes, in some teamsRarely — things get done but not recorded

Who will do the ISMS work?

A dedicated person or teamNamed people, part-time alongside their day jobsOne person, alongside everything else

Goal

What is driving certification?

A specific customer asked for itTenders / RFPs require itA regulator or framework expects itProactive — we want the discipline

When do you need the certificate?

Within about 3 monthsWithin about 6 monthsWithin a yearNo fixed date — exploring

0 of 13 answered — you can submit at any time.