ISO 27001 Readiness Assessment: How Close Are You to Stage 1?

How This ISO 27001 Readiness Assessment Works

This 8-question assessment maps your current ISMS against the four Annex A 2022 themes: Organizational, People, Physical, and Technological. The questions cover information security policies, risk assessment and treatment, asset inventory, awareness training, physical access, access management with MFA, cryptography, and centralized logging plus incident response. The output gives you a percentage readiness score, a status flag for every theme, a prioritized gap list ranked by Stage 1 audit severity, and a directional estimate of remediation weeks before you are ready for documentation review.

The Four Annex A 2022 Themes Explained

The 2022 version of Annex A consolidated the 114 controls in the 2013 standard down to 93. Eleven controls are net new: threat intelligence, ICT readiness for business continuity, configuration management, secure coding, web filtering, data masking, data leakage prevention, monitoring activities, identity management, information deletion, and cloud services. Programs running on the 2013 mapping had to transition by October 2025 or risk certificate validity, so first-time programs should align directly to 2022 and not waste time on legacy crosswalks. The clause structure (Clauses 4 to 10) is unchanged, so management-system work on context, leadership, planning, support, operation, performance evaluation, and improvement carries directly across versions.

What "Audit-Ready" Actually Means

75 percent or higher

Strong foundation. Most policies, controls, and processes exist. Focus on polish, evidence quality, and internal audit before scheduling Stage 1. Realistic timeline: 2 to 4 weeks of remediation.

50 to 74 percent

Meaningful progress with material gaps. Expect 4 to 8 weeks of focused remediation. Prioritize critical-severity gaps first because Stage 1 will flag them as findings.

Below 50 percent

Significant build still needed. Plan for 8 to 16 weeks of remediation, often staged. Policies and risk treatment plan typically come first, then technical controls, then awareness training and management review.

Common Gaps Across Each Theme

The most common reason first-timers fail Stage 1 is skipping a theme they assumed did not apply. Cloud-native SaaS companies routinely write off the Physical theme on the basis that AWS handles the data center. Auditors disagree. BYOD laptops, home offices, clear desk practices, and equipment disposal all keep Physical controls in scope, even when you have no server room of your own. The People theme is the second blind spot. Awareness training, screening, and disciplinary processes are non-negotiable and frequently informal. The Organizational theme tends to fail on supplier security and threat intelligence, where teams have onboarding paperwork but no continuous review. The Technological theme typically fails on centralized logging across services, cryptography key management, and secure development controls including code review and dependency scanning. Hicomply ships pre-built policy templates aligned to the 2022 standard, automated evidence collection through 75+ integrations, and an Annex A 2022 mapping that flags missing themes before your auditor does.

Closing the Gaps Faster

Three paths exist for ISO 27001 readiness. DIY using spreadsheets and policy templates is the cheapest on paper but typically takes 600 to 1,000 hours and leaves Stage 1 findings unaddressed. A consultant accelerates the work but adds significant fees and creates dependency. A platform-led approach blends automation with structured guidance through every clause and Annex A control. The Annex A policy and standard guide walks through the documentation each control expects, and the six-step certification path shows where remediation fits in the wider program.

Hicomply plans start from £6,995 per year with unlimited users. The platform covers SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CCPA/CPRA, NIST CSF, SOX IT controls, Cyber Essentials, and TX-RAMP. Organizations using the platform are typically audit-ready in 8 to 12 weeks.

How to Use Your Score

The score is a starting point. Walk it back to your security lead and CTO. Decide which themes to attack first based on which gaps your buyers are flagging in security questionnaires. Then set a realistic Stage 1 target date that accounts for the remediation weeks the assessment estimated, plus the 4 to 6 weeks most certification bodies allow between Stage 1 and Stage 2. Pair this assessment with the ISO 27001 cost calculator to size the budget, the SoA builder to map controls to your scope, and the certification timeline tool to lay out phase-by-phase milestones. Book a demo when you are ready to see automated readiness in action.