Checklist: introducing an ISMS to ISO 27001
For: Management, IT and security owners
Updated: 2026-11
Introducing an ISO 27001 ISMS follows fixed steps: define the scope, appoint roles, inventory assets, assess risks, select controls in the statement of applicability, introduce policies, train staff, audit internally and have management review the system.
An ISMS is not a project with an end date but a cycle. The first round, however, lays the foundation for everything that follows and decides whether the system is lived or filed away.
The checklist follows the structure of the standard and keeps each step as lean as possible.
The checklist
- 01
Define the scope
Decide which sites, services and systems the ISMS covers, aligned with customer requirements.
Done when: The scope is defined in writing and confirmed by management.
- 02
Appoint roles
Name a person responsible for the ISMS and assign responsibility for risks and controls.
Done when: Roles and responsibilities are documented and known.
- 03
Inventory assets
Record information, systems, providers and sites within scope.
Done when: An inventory with owners exists.
- 04
Assess risks
Evaluate threats and vulnerabilities and rate risks by likelihood and impact.
Done when: A risk register with ratings and treatment decisions exists.
- 05
Select controls
Select controls from Annex A and justify them in the statement of applicability, including exclusions.
Done when: The statement of applicability is complete and reasoned.
- 06
Policies and training
Introduce lean policies and train all staff on their duties.
Done when: Policies are published and training records exist.
- 07
Audit and review
Carry out an internal audit and address the results in the management review.
Done when: Audit report and management review minutes exist.
Common mistakes
- —The scope is chosen too broadly and the project loses focus.
- —Policies are copied from templates that do not fit the organisation.
- —The risk assessment stays abstract and does not lead to concrete measures.
What this checklist does not cover
- —The checklist does not replace the standard itself or an audit by a certification body.
- —Sector standards such as TISAX contain additional requirements.
Parent service: Cyber readiness & IT security
FAQ
Who should own the ISMS?
A person with time, management backing and access to all areas. In small firms this is often the head of IT or a member of management.
Do we need a special tool?
Not necessarily to start. Many SMEs begin with well-structured documents and spreadsheets and switch later if needed.
More checklists
Checklist: being ready for supplier and security questionnaires
Suppliers receiving security questionnaires should be prepared: one responsible person, current core documents on security and data protection, a list of their own providers, evidence for backups and access protection, an answer library and a clear rule on how gaps are handled.
Checklist: taking out cyber insurance without jeopardising cover
Cyber insurance is taken out properly in seven steps: clarify needs and risks, implement the baseline measures the insurer requires, answer the questionnaire honestly and checked by IT, compare cover and limits, understand exclusions, add emergency rules to the incident response plan and keep evidence current.
Checklist: securing MCP servers and AI agents
An MCP server is secured in seven steps: narrowly limit the use case, grant least privilege per tool, use dedicated credentials instead of shared accounts, tie consequential actions to human approval, treat content from external sources as data, log all calls and introduce new servers through an approval process.