ISO 27001 Readiness Assessment

Do you have an approved information-security policy?

Have you defined the scope of your information-security management system?

Do you maintain an inventory of important information assets?

Do you have a formal information-security risk assessment process?

Do identified risks have owners and treatment actions?

Have you defined security objectives and responsibilities?

Do you have documented procedures for key security processes?

Are access rights reviewed and controlled?

Do you have an incident-management and reporting process?

Do employees receive information-security awareness training?

Do you perform internal reviews/audits of security controls?

Does management regularly review information-security performance?