ISO 27001 pre-audit checklist: 2 weeks before Stage 2

Stage 2 is two weeks away. This 22-point checklist covers everything auditors typically ask for — if even one box is missing, fix it now.

Two weeks before Stage 2. This is no longer the time to build anything substantial — it's time to make sure everything is in order. Work through these 22 points.

Documentation

\n
1. Security policy is up to date, an owner is named, and an annual review date is scheduled.
\n
2. Statement of Applicability is current (all Annex A controls: implemented / N/A + reason).
\n
3. All 8–12 policies are on the correct version number, with a visible changelog.
\n
4. Risk register review date falls within the last quarter.
\n
5. Asset inventory is current (including the SaaS inventory).
\n

Operational evidence

\n
6. Most recent access review completed, with a PDF report including decisions and sign-offs.
\n
7. Privileged access inventory is current, with the latest review within the past 3 months.
\n
8. Last 2 offboardings fully documented.
\n
9. Onboarding process for at least 1 recent hire complete.
\n
10. Backup test performed, with evidence of a successful restore.
\n
11. Incident register for the last quarter present (even "nothing happened" must be logged).
\n

Governance

\n
12. Most recent management review within the last 12 months, with minutes available.
\n
13. Internal audit completed, report available, and findings closed or included in an action plan.
\n
14. Training log: everyone has completed security awareness training this year.
\n
15. Roles and responsibilities document in place (CISO role filled, even if that's the director themselves).
\n

Technical controls

\n
16. MFA enforced on critical systems (M365 admin, accounting, cloud infrastructure).
\n
17. Password policy enforced (at minimum: length requirements + common password blocking).
\n
18. Patches: last quarter's OS/browser patches applied to > 95% of devices.
\n
19. Anti-malware installed on all endpoints.
\n
20. Disk encryption enabled on all company laptops.
\n

Contracts

\n
21. Data processing agreements in place with key suppliers (see processor register).
\n
22. Confidentiality and security clauses included in employment contracts.
\n

Everything ticked off → you're ready for Stage 2.