Where do you stand on ISO 27001?
Check the controls already in place. Get your coverage and priorities to move toward the standard. References follow ISO/IEC 27001:2022.
Check the control themes already covered:
Get your ISO 27001 report
Your detailed coverage and priorities toward certification, by email.
Your ISO 27001 priorities
Each gap leads to the solution that closes it.
How to read this result
The checklist covers 10 control themes drawn from the standard's Annex A (policies, access, cryptography, incident management, continuity, etc.).
The percentage shown is a simple ratio: themes checked divided by 10 themes. It is not a certification audit — an ISO 27001 auditor verifies documented evidence for each control, not a self-declaration. The result helps you spot blind spots before starting a formal process, not replace the audit itself.
Each unchecked theme immediately becomes a priority in your recommendations, with a direct link to the service that addresses that gap. The priority order follows the theme order, not a weighted risk calculation — if one theme concerns you particularly, address it first even if it isn't at the top of the list.
What certification requires in addition: a documented management system (ISMS), a management review, a continuous improvement cycle, and an external audit by an accredited body. The checklist positions you on technical and organizational controls; formal certification is a separate project, typically spanning 6 to 12 months.
Frequently asked questions
Does an 80% score mean I'm ready for certification ?
No. It means 8 of the 10 themes have at least one control in place according to you. Certification requires documented evidence for every Annex A control, not a checked box.
Can I get certified without a SOC or a consultant ?
Technically yes, but rarely in practice: most SMEs lack the time or in-house expertise to document and operate the A.8.15 and A.5.24 controls on their own.
How long does an ISO 27001 process take ?
Generally 6 to 12 months between the starting point and the certification audit, depending on your initial coverage and your teams' availability.