[organization name]
Project Checklist for ISO 27001 Implementation
Implementation Tasks Documents from toolkit to be Done
phases used
Obtain Research which benefits of ISO -
management 27001 would be applicable to your
support company
Present the benefits to the -
management and get their
commitment
Get formal approval for starting the -
project planning
Prepare for your Write procedure for document 01 – Procedure for Document
project control and Record Control
Educate your project team -
Write the project plan including the 02 – Project Plan
definition of project manager,
project team, project sponsor,
required resources and milestones
Define which stakeholders need to -
be informed about each step in the
project
Organize kick-off meeting -
Identify Define procedure for identifying 03 – Procedure for
requirements interested parties Identification of Requirements
Identify the requirements of 03.1 – List of Legal, Regulatory,
interested parties Contractual and Other
Requirements
Define the Write the ISMS Scope Document 04 – ISMS Scope
scope,
management Write the Information Security 05 – Information Security
Policy Policy
Project Checklist for ISO 27001 ver [version] from [date] Page 1 of 4
©2022 27001Academy advisera.com
[organization name]
intention and Decide on the information security 05 – Information Security
responsibilities objectives Policy
Perform risk Develop the risk assessment 06 – Risk Assessment and Risk
management methodology Treatment Methodology
Perform risk assessment 06.1 – Risk Assessment Table
Perform risk treatment 06.2 – Risk Treatment Table
Write the risk assessment & 06.3 – Risk Assessment and
treatment report Risk Treatment Report
Develop security Develop the Statement of 07 – Statement of Applicability
profile of your Applicability
company and
action plan on Accept the residual risks 07 – Statement of Applicability
how to achieve it
Develop the Risk Treatment Plan 08 – Risk Treatment Plan
Implement the Implement all the controls defined Documents in the Folder
controls in Risk Treatment Plan 09_Annex_A_Security_Control
s
Maintain records of For ISMS documents this is
implementation visible through the version
history of a document; for
software this could be some
log about its testing and
release.
Perform training Perform training for all employees 10 – Training and Awareness
and awareness who lack required skills Plan
programs
Perform awareness programs for all 10 – Training and Awareness
employees and third parties that Plan
have a role in your ISMS
Implement Write procedure for internal audit 11 – Internal Audit Procedure
Project Checklist for ISO 27001 ver [version] from [date] Page 2 of 4
©2022 27001Academy advisera.com
[organization name]
management Develop the audit program 11.1 – Annual Internal Audit
procedures Program
Define which measurements are to 12.1 – Measurement Report
be performed related to the
objectives for the ISMS and for
controls
Identify information sources to be 12.2 – Management Review
used in the management review Minutes
Write procedure for corrective 13 – Procedure for Corrective
action Action
Operate the Maintain all the records required by Various records and logs that
ISMS your own policies and procedures are created because of ISMS
documents – e.g., backup log
(from the backup software),
filled out List of Legal,
Regulatory and Contractual
Requirements, etc.
Perform corrective actions as 13.1 – Corrective Action Form
needed as a consequence of
improvements needed in the
operation of the ISMS
Monitor & Make sure you monitor all your Monitoring records defined in
measure the systems each implemented document,
ISMS e.g., number of incidents,
number of errors in a particular
system, etc.
Measure if you have achieved the 12.1 – Measurement Report
objectives set for your ISMS and for
your controls
Perform internal Perform internal audit(s) 11.3 – Internal Audit Checklist
audit
Write an internal audit report 11.2 – Internal Audit Report
Project Checklist for ISO 27001 ver [version] from [date] Page 3 of 4
©2022 27001Academy advisera.com
[organization name]
Perform corrective actions as a 13.1 – Corrective Action Form
consequence of nonconformities
found during the internal audit
Perform Perform management review -
management
review Maintain records from 12.2 – Management Review
management review Minutes
Perform corrective actions as a 13.1 – Corrective Action Form
consequence of improvements
identified during the management
review
Certification Obtain proposals from several -
audit certification bodies
Select the certification body -
Stage 1 certification audit -
Stage 2 certification audit -
Surveillance visits -
Project Checklist for ISO 27001 ver [version] from [date] Page 4 of 4
©2022 27001Academy advisera.com
