ISO 27001 readiness checker

What certification readiness actually measures

The difficulty of ISO 27001:2022 is not the controls. Annex A controls are largely things a competent security team either already does or can implement. The difficulty is proving they operated consistently across the period an auditor examines.

An auditor does not accept that access is reviewed quarterly. They ask for the last four reviews, look at who signed them, check whether anything was revoked as a result, and notice if all four are dated in the same week.

So readiness is a question about evidence and about the management system, not about your security posture. Organisations with genuinely strong security fail readiness assessments routinely, because nothing was written down.

The management system is where first-timers underestimate

Clauses 4 to 10 of the standard, the part that is not Annex A, is where most of the authoring effort sits: context, interested parties, scope, leadership commitment, objectives, risk assessment methodology, internal audit, management review and continual improvement.

Internal audit and management review are the two most commonly missing entirely. Both require records showing decisions rather than attendance, and both need to have happened before certification rather than being produced for it.

Risk assessment is the other. A risk register is easy. A register where each accepted risk has a named accepter, a date and a review point, and each treated risk traces to the control that treats it, is what survives scrutiny.

The 2022 controls where evidence is thinnest

The revision restructured Annex A into 93 controls across four themes and introduced eleven new ones. Those eleven matter disproportionately for readiness because no organisation has years of accumulated artefacts behind them.

Threat intelligence, cloud services security, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

Information deletion and data masking overlap directly with DPDP Act obligations. Evidence collected once satisfies both, and organisations running privacy and ISO as separate programmes produce it twice.

How to move from this score to a date

Start the time-dimensioned evidence today, whatever your score. Access reviews, internal audit, management review and scan cycles cannot be produced retrospectively, and they are what determines the earliest possible certification date.

Then close the management system gaps, because they are authoring work with no external dependency and they block certification absolutely, unlike an Annex A control which can be justified as not applicable.

Then work the Annex A gaps in order of evidence lead time rather than in order of severity. A control you can implement and evidence in a week can wait; one that needs three months of records cannot.

A realistic first certification for an organisation starting from a middling score is nine to twelve months. Programmes compressed below six months are usually producing documentation rather than a management system, and it shows at the first surveillance audit.