"A 45-person MSP in Manchester achieved ISO 27001 certification in 11 months — no dedicated compliance team."
ISO 27001 is the most internationally recognised information security standard. Certification signals to clients, partners, and regulators that your ISMS is legitimate — not just a policy document. We built the readiness checklist and training programme that gets SMBs to audit-ready in under a year.
The checklist below maps all 93 Annex A controls to their four domain groups. Your Statement of Applicability must address each applicable control with evidence of implementation and review.
The SoA is the first thing a certification auditor reviews. It must list every Annex A control, state whether it applies, and provide a justification for each. Teams that skip the SoA or under-document it fail Stage 1 before the audit even starts. The checklist includes a SoA structure guide with justification templates.
ISO 27001 Clause 9.2 requires at least one internal audit per year before external certification. Most SMBs skip this because "we're busy enough." Auditors check the internal audit report — if it doesn't exist, you fail Stage 1. If it exists but findings aren't closed, you fail Stage 2. Build the audit into your ISMS from month one.
Scoping the ISMS too narrowly means you miss controls that apply. Scoping it too broadly means you have an unmanageable control set and fail the audit. Certification bodies look at your scope statement carefully — it must be accurate, cover all data flows and locations in scope, and align with the SoA. The checklist covers scope definition.
Annex A.15 requires documented supplier assessments for all third parties with access to your data or systems. Most SMBs have no supplier register, no contracts with security clauses, and no annual review process. A single supplier without a DPA can disqualify your certification. The checklist covers the supplier risk management controls in detail.
93 controls · 14 Annex A domains · SoA structure guide included
Used by SMBs and management consultancies building an ISMS from scratch or preparing for external certification. Includes control mapping by domain, evidence checklist, SoA structure guide, and risk treatment plan template.
No spam. Unsubscribe any time. Checklist delivered via Postmark within seconds.
Our Business session ($900) delivers ISO 27001-aligned training for all personnel in a single 2-hour live webinar. Individual attendance records with timestamps — the A.7.2 evidence your certification auditor will ask for. We provide an evidence packet including the session summary, curriculum outline, and attendance log.
Personal — $150 → Executive — $390 → Business — $900 flat →Every ISO 27001 training engagement includes these artefacts for your ISMS evidence management:
Employee name, timestamp, session ID — A.7.2 training evidence for your Stage 2 audit file.
Date, duration, topics covered, instructor name — A.5 information security policy training evidence.
Versioned curriculum with date — suitable for auditor review and Stage 2 evidence package.
Annex A.16 walkthrough materials — used in the session and provided as a reusable incident response template.
Most SMBs take 6–18 months from initial gap assessment to certification. Teams with existing information security practices can move faster. The checklist covers the Annex A controls your auditor will examine in Stage 1.
ISO 27001 certifies a full Information Security Management System (ISMS) — it's a management standard, not just a controls checklist. SOC 2 is an AICPA attestation focused on a defined set of controls (the Trust Services Criteria). ISO 27001 is internationally recognised (ISO/IEC 27001:2022), globally portable, and often preferred in supply chain and enterprise contexts. Many companies pursue both.
Annex A in ISO 27001:2022 organises 93 controls into four groups: Organizational (A.5–A.8), People (A.9–A.10), Physical (A.11–A.12), and Technological (A.13–A.14). There is no fifth group — this is a common misconception. The checklist covers all 93 controls mapped to their domains.
ISO 27001 applies to any organisation regardless of size or sector. The key decisions are your ISMS scope (what's in and out) and which Annex A controls are applicable (documented in the Statement of Applicability). SMBs typically scope to their core business processes, cloud infrastructure, and key personnel — not the whole org if it's not necessary.
The SoA is a document listing every Annex A control, whether it applies to your organisation, and the justification for inclusions and exclusions. It's the first thing a certification auditor reviews. A poorly structured SoA is the most common reason SMBs fail Stage 1. The checklist includes a SoA structure guide.
Our ISO 27001-aligned training covers Annex A controls by domain — specifically the human-factors controls your staff need to understand: A.5 (information security policies), A.6 (organisation of information security), A.7 (human resource security), A.8 (asset management), A.9 (access control), A.10 (cryptography), and A.11–A.14 (physical, operations, communications, and system acquisition). Individual attendance records with timestamps are provided for your audit evidence.
No-form call. 30 minutes. We map your current Annex A coverage, identify your ISMS scope, and give you a 6-month certification sequence — free.