Readiness checklist Where do you actually stand on ISO 27001 & SOC 2? Forty concrete items covering the controls that most often trip up early-stage programs. Print it, tick what you have, and you'll see exactly where the gaps are - no sales call required.
Free download · updated 2026-08-22
Print this checklist
Inventory. You maintain a current inventory of assets (systems, data, people) and know which handle sensitive data.Risk register. You have a living risk register with owners, likelihood/impact, and treatment decisions.Roles & responsibilities. Security and compliance ownership is assigned - someone can name who owns the program.Policies. Core policies exist and are versioned: information security, access control, incident response, backup, and acceptable use.Access reviews. Access is reviewed on a schedule, and revocations actually happen.MFA. Multi-factor authentication is enforced on all remote and administrative access.Least privilege. Users and service accounts have only the permissions they need, and privilege escalation is rare and logged.Onboarding/offboarding. Joiner, mover, leaver processes are defined and followed - accounts are disabled on departure.Authentication. Password policy, lockout, and session controls are configured - and you can prove it.Secrets. Secrets and keys are stored in a vault or secret manager, not in code or config files.Logging. Authentication, access, and change events are logged centrally with a retention policy.Log review. Logs are actually reviewed on a schedule, and anomalies get followed up.Time sync. Systems are time-synchronized (NTP) so audit trails are trustworthy.Vulnerability scanning. You scan for vulnerabilities on a schedule and track remediation to closure.Patch management. Patching has owners, SLAs, and an exception process.Dependency hygiene. You can identify your critical third-party libraries and their versions, and you monitor for known CVEs.Data classification. Sensitive data is classified, and handling rules differ by class.Encryption at rest. Sensitive data at rest is encrypted with managed keys.Encryption in transit. TLS is enforced everywhere, with HSTS on public endpoints.Backups. Backups run on a schedule, are tested for restore, and have a defined retention period.Disaster recovery. You have documented recovery objectives (RTO/RPO) and have tested a restore at least once.Incident response. An IR plan exists, roles are assigned, and you can produce an incident log.Security training. Employees complete security awareness training, and new hires do it on arrival.Vendor management. You maintain a subprocessor/vendor list and review critical vendors on a schedule.DPAs. You sign DPAs with vendors that process personal data.Data retention. Retention schedules exist, and data is actually deleted on expiry.Privacy program. You can answer "where is our personal data, and who can touch it?" without a panic.Business continuity. You've identified critical functions and the people/systems that keep them running.Change management. Production changes follow a defined, reviewed process - including code changes.Code review. All code is reviewed before merge, with security-sensitive changes flagged.Secret scanning. You scan code and CI for leaked secrets, and blocks them from landing.SAST/DAST. Static and dynamic analysis run in CI on a schedule, and findings are triaged.Evidence. You can produce evidence that each of the above is true - dated, not just asserted.Audit trail. Key controls leave an audit trail tied to the control they satisfy.Continuous evidence. Controls are evidenced on an ongoing basis, not reconstructed once a year.Gap ownership. Every known gap has an owner and a target date - none are just "noted."Scope definition. You can state your compliance scope in one sentence (systems, data, processes).Management buy-in. Leadership has formally sponsored the program and understands what it costs.Timeline. You have a realistic timeline that accounts for your current gaps - not a back-of-napkin "six months."Tooling. You've picked the mechanism (spreadsheets, GRC tool, or a mix) that will keep evidence current between audits.
Tick off more than 30? You're in strong shape - your gaps are likely in evidence and automation. Under 20? Start with the inventory, risk register, and access controls; they unlock most of the rest.