ISO 27001 Readiness: What to Fix Before the Audit

Many organisations approach an ISO 27001 audit with policies written but not practised. Auditors look for evidence that controls actually operate. Fixing these common gaps first saves time and avoids major nonconformities.

Scope. Define clearly which locations, teams, systems and services are in scope. A vague scope leads to confusion during the audit.

Risk assessment. Document your assets, threats and risks, and show how each risk is treated. The Statement of Applicability must link back to this assessment.

Policies that match reality. Policies copied from templates often describe processes nobody follows. Align them with how your team really works.

Access control. Show joiner, mover and leaver records, periodic access reviews and multi-factor authentication for critical systems.

Supplier management. Keep a list of key vendors with security reviews and contract clauses.

Incident and continuity. Record incidents, lessons learned and at least one tested continuity exercise.

Internal audit and management review. Both are mandatory, and both must be completed before certification.

Starting with a gap assessment shows exactly where you stand. Organisations preparing for certification can benefit from ISO 27001 consulting and readiness support that turns these gaps into a clear, prioritised plan.