← All readiness checks
Answer for where you are today. "Not sure" is a fine answer: it shows up as something to find out.
1. Have you defined the scope of your information security management system?
2. Have you identified interested parties and their security requirements?
3. Has top management approved an information security policy and assigned roles?
4. Do you have a documented risk assessment method and a current risk register?
5. Do you have a Statement of Applicability covering the Annex A controls?
6. Are competence, awareness and document control managed?
7. Do you keep an asset inventory with owners?
8. Do you manage supplier security and incidents?
9. Do you screen staff and run awareness training?
10. Are physical access and clear-desk rules in place where relevant?
11. Are access control, MFA, logging and backups in place?
12. Do you follow secure development and vulnerability management practices?
13. Have you run an internal audit of the ISMS?
14. Has management reviewed the ISMS and recorded decisions?
15. Do you track nonconformities and corrective actions to closure?
See my readiness score