ISO 27001 readiness quiz
Fourteen questions across the requirement clauses 4 to 10, one at a time, to show which part of the management system is furthest behind.
ISO 27001 readiness quiz
Fourteen questions across the ISO/IEC 27001:2022 requirement clauses 4 to 10.
Answer as your organisation is today, not as you intend it to be. Scoring is indicative — a self-assessment to show where to look next, not a certification assessment.
Question 1 of 14
Indicative readiness
0%
—
Questions answered: 0 of 14
By clause
Where to look first
Every clause above is a place where evidence has to live. See how a pre-built ISMS handles it.
Book a platform demoInformation security risk calculator
Score a risk on an example likelihood and impact scale, pick a treatment option, and build a starter risk register you can export.
Information security risk calculator
Score a risk on an example 5 × 5 scale, choose a treatment option and build a starter risk register.
Score one risk at a time, then add it to the register. The 5 × 5 scale below is an example. ISO/IEC 27001 expects you to define your own risk criteria — the wording of the levels, the bands and what each band obliges you to do are organisation-defined.
The four risk treatment options
- Modify
- Reduce the risk by applying controls — the option most Annex A controls serve.
- Avoid
- Stop or do not start the activity that creates the risk.
- Transfer
- Share the risk with a third party, for example insurance or a contractual allocation.
- Accept
- Knowingly retain the risk, within your risk appetite and signed off by the risk owner.
Whichever option you choose, ISO 27001 expects the decision to be recorded, owned and justified — and the controls you rely on to be reflected in your Statement of Applicability.
Risk register (0)
| Asset | Threat | L | I | Score | Band | Treatment | Actions |
|---|
The register lives in this browser tab only — nothing is sent anywhere, and it disappears when you close the page. Export it if you want to keep it.
A real risk register keeps owners, treatment decisions and evidence together — and feeds your Statement of Applicability.
Book a platform demoAnnex A (2022) controls explorer
All 93 Annex A controls in their four themes, with applicability toggles and a CSV export to start a Statement of Applicability.
Annex A (2022) controls explorer
All 93 Annex A controls in their four themes, with applicability toggles and a CSV you can use to start a Statement of Applicability.
The 93 Annex A controls of ISO/IEC 27001:2022, in their four themes. Mark the ones your risk assessment says do not apply, write the justification next to them, and export the list as the starting point for a Statement of Applicability.
| Control | Title | Applicability |
|---|---|---|
| 5.1 | Information Security PoliciesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.2 | Information Security Roles and ResponsibilitiesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.3 | Segregation of DutiesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.4 | Management ResponsibilitiesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.5 | Contact With Government AuthoritiesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.6 | Contact With Special Interest GroupsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.7 New in 2022 | Threat IntelligenceOrganisational | Applicable unless your risk assessment says otherwise |
| 5.8 | Information Security in Project ManagementOrganisational | Applicable unless your risk assessment says otherwise |
| 5.9 | Inventory of Information and Other Associated AssetsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.10 | Acceptable Use of Information and Other Associated AssetsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.11 | Return of AssetsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.12 | Classification of InformationOrganisational | Applicable unless your risk assessment says otherwise |
| 5.13 | Labelling of InformationOrganisational | Applicable unless your risk assessment says otherwise |
| 5.14 | Information TransferOrganisational | Applicable unless your risk assessment says otherwise |
| 5.15 | Access ControlOrganisational | Applicable unless your risk assessment says otherwise |
| 5.16 | Identity ManagementOrganisational | Applicable unless your risk assessment says otherwise |
| 5.17 | Authentication InformationOrganisational | Applicable unless your risk assessment says otherwise |
| 5.18 | Access RightsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.19 | Information Security in Supplier RelationshipsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.20 | Addressing Information Security Within Supplier AgreementsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.21 | Managing Information Security in the ICT Supply ChainOrganisational | Applicable unless your risk assessment says otherwise |
| 5.22 | Monitoring and Review and Change Management of Supplier ServicesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.23 New in 2022 | Information Security for Use of Cloud ServicesOrganisational | Applicable unless your risk assessment says otherwise |
| 5.24 | Information Security Incident Management Planning and PreparationOrganisational | Applicable unless your risk assessment says otherwise |
| 5.25 | Assessment and Decision on Information Security EventsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.26 | Response to Information Security IncidentsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.27 | Learning From Information Security IncidentsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.28 | Collection of EvidenceOrganisational | Applicable unless your risk assessment says otherwise |
| 5.29 | Information Security During DisruptionOrganisational | Applicable unless your risk assessment says otherwise |
| 5.30 New in 2022 | ICT Readiness for Business ContinuityOrganisational | Applicable unless your risk assessment says otherwise |
| 5.31 | Legal, Statutory, Regulatory and Contractual RequirementsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.32 | Intellectual Property RightsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.33 | Protection of RecordsOrganisational | Applicable unless your risk assessment says otherwise |
| 5.34 | Privacy and Protection of PIIOrganisational | Applicable unless your risk assessment says otherwise |
| 5.35 | Independent Review of Information SecurityOrganisational | Applicable unless your risk assessment says otherwise |
| 5.36 | Compliance With Policies, Rules and Standards for Information SecurityOrganisational | Applicable unless your risk assessment says otherwise |
| 5.37 | Documented Operating ProceduresOrganisational | Applicable unless your risk assessment says otherwise |
| 6.1 | ScreeningPeople | Applicable unless your risk assessment says otherwise |
| 6.2 | Terms and Conditions of EmploymentPeople | Applicable unless your risk assessment says otherwise |
| 6.3 | Information Security Awareness, Education, and TrainingPeople | Applicable unless your risk assessment says otherwise |
| 6.4 | Disciplinary ProcessPeople | Applicable unless your risk assessment says otherwise |
| 6.5 | Responsibilities After Termination or Change of EmploymentPeople | Applicable unless your risk assessment says otherwise |
| 6.6 | Confidentiality or Non-Disclosure AgreementsPeople | Applicable unless your risk assessment says otherwise |
| 6.7 | Remote WorkingPeople | Applicable unless your risk assessment says otherwise |
| 6.8 | Information Security Event ReportingPeople | Applicable unless your risk assessment says otherwise |
| 7.1 | Physical Security PerimetersPhysical | Applicable unless your risk assessment says otherwise |
| 7.2 | Physical EntryPhysical | Applicable unless your risk assessment says otherwise |
| 7.3 | Securing Offices, Rooms and FacilitiesPhysical | Applicable unless your risk assessment says otherwise |
| 7.4 New in 2022 | Physical Security MonitoringPhysical | Applicable unless your risk assessment says otherwise |
| 7.5 | Protecting Against Physical and Environmental ThreatsPhysical | Applicable unless your risk assessment says otherwise |
| 7.6 | Working In Secure AreasPhysical | Applicable unless your risk assessment says otherwise |
| 7.7 | Clear Desk and Clear ScreenPhysical | Applicable unless your risk assessment says otherwise |
| 7.8 | Equipment Siting and ProtectionPhysical | Applicable unless your risk assessment says otherwise |
| 7.9 | Security of Assets Off-PremisesPhysical | Applicable unless your risk assessment says otherwise |
| 7.10 | Storage MediaPhysical | Applicable unless your risk assessment says otherwise |
| 7.11 | Supporting UtilitiesPhysical | Applicable unless your risk assessment says otherwise |
| 7.12 | Cabling SecurityPhysical | Applicable unless your risk assessment says otherwise |
| 7.13 | Equipment MaintenancePhysical | Applicable unless your risk assessment says otherwise |
| 7.14 | Secure Disposal or Re-Use of EquipmentPhysical | Applicable unless your risk assessment says otherwise |
| 8.1 | User Endpoint DevicesTechnological | Applicable unless your risk assessment says otherwise |
| 8.2 | Privileged Access RightsTechnological | Applicable unless your risk assessment says otherwise |
| 8.3 | Information Access RestrictionTechnological | Applicable unless your risk assessment says otherwise |
| 8.4 | Access to Source CodeTechnological | Applicable unless your risk assessment says otherwise |
| 8.5 | Secure AuthenticationTechnological | Applicable unless your risk assessment says otherwise |
| 8.6 | Capacity ManagementTechnological | Applicable unless your risk assessment says otherwise |
| 8.7 | Protection Against MalwareTechnological | Applicable unless your risk assessment says otherwise |
| 8.8 | Management of Technical VulnerabilitiesTechnological | Applicable unless your risk assessment says otherwise |
| 8.9 New in 2022 | Configuration ManagementTechnological | Applicable unless your risk assessment says otherwise |
| 8.10 New in 2022 | Information DeletionTechnological | Applicable unless your risk assessment says otherwise |
| 8.11 New in 2022 | Data MaskingTechnological | Applicable unless your risk assessment says otherwise |
| 8.12 New in 2022 | Data Leakage PreventionTechnological | Applicable unless your risk assessment says otherwise |
| 8.13 | Information BackupTechnological | Applicable unless your risk assessment says otherwise |
| 8.14 | Redundancy of Information Processing FacilitiesTechnological | Applicable unless your risk assessment says otherwise |
| 8.15 | LoggingTechnological | Applicable unless your risk assessment says otherwise |
| 8.16 New in 2022 | Monitoring ActivitiesTechnological | Applicable unless your risk assessment says otherwise |
| 8.17 | Clock SynchronisationTechnological | Applicable unless your risk assessment says otherwise |
| 8.18 | Use of Privileged Utility ProgramsTechnological | Applicable unless your risk assessment says otherwise |
| 8.19 | Installation of Software on Operational SystemsTechnological | Applicable unless your risk assessment says otherwise |
| 8.20 | Network SecurityTechnological | Applicable unless your risk assessment says otherwise |
| 8.21 | Security of Network ServicesTechnological | Applicable unless your risk assessment says otherwise |
| 8.22 | Segregation of NetworksTechnological | Applicable unless your risk assessment says otherwise |
| 8.23 New in 2022 | Web FilteringTechnological | Applicable unless your risk assessment says otherwise |
| 8.24 | Use of CryptographyTechnological | Applicable unless your risk assessment says otherwise |
| 8.25 | Secure Development Life CycleTechnological | Applicable unless your risk assessment says otherwise |
| 8.26 | Application Security RequirementsTechnological | Applicable unless your risk assessment says otherwise |
| 8.27 | Secure System Architecture and Engineering PrinciplesTechnological | Applicable unless your risk assessment says otherwise |
| 8.28 New in 2022 | Secure CodingTechnological | Applicable unless your risk assessment says otherwise |
| 8.29 | Security Testing in Development and AcceptanceTechnological | Applicable unless your risk assessment says otherwise |
| 8.30 | Outsourced DevelopmentTechnological | Applicable unless your risk assessment says otherwise |
| 8.31 | Separation of Development, Test and Production EnvironmentsTechnological | Applicable unless your risk assessment says otherwise |
| 8.32 | Change ManagementTechnological | Applicable unless your risk assessment says otherwise |
| 8.33 | Test InformationTechnological | Applicable unless your risk assessment says otherwise |
| 8.34 | Protection of Information Systems During Audit TestingTechnological | Applicable unless your risk assessment says otherwise |
A Statement of Applicability is more than this list: it records every control you need to treat your risks, why each one is included, whether it is implemented, and your justification for any Annex A control you leave out. This export gives you the control column — the reasoning is yours.
Turning 93 controls into an evidenced Statement of Applicability is the slow part. See it pre-built.
Book a platform demo2013 to 2022 transition checker
The 11 controls introduced in the 2022 revision, one at a time as in place, partly or not yet, ending in your gap list.
2013 to 2022 transition checker
The 11 controls introduced in ISO/IEC 27001:2022, as a have-it / partly / not-yet checklist.
ISO/IEC 27001:2022 brought 11 new Annex A controls. The transition period for certificates issued against the 2013 revision ended on 31 October 2025, so these are now part of a normal certification — not a future project. Mark where you stand on each.
Question 1 of 11
Your gap list
Nothing marked as a gap yet — answer the questions above.
The other changes in the 2022 revision are structural: the same 93 controls regrouped into four themes with attributes, and the requirement clauses 4–10 tightened rather than rewritten. A transition is mostly evidence work — showing that each new control is either implemented or justified as out of scope in your Statement of Applicability.
Mapping the new controls onto what you already run is the whole job. See how the platform tracks it.
Book a platform demoSecurity awareness quiz
Ten everyday scenarios, each with the reasoning behind the best answer, for an awareness session rather than an exam.
Security awareness quiz
Ten everyday scenarios, with the reasoning behind each best answer.
Ten situations that come up in ordinary working weeks. Pick what you would actually do; the explanation for each one appears with your score.
Question 1 of 10
Your score
0 / 10
0%
Why
Nothing you choose here leaves the page, and no score is recorded. Use it as a conversation starter for an awareness session rather than as a test of individuals.
Awareness only counts when you can show who was trained, on what, and when.
Book a platform demo
