Skip to content
Varmo
DeutschSign inRequest a demo
FEATURES · READINESS CHECK

How ready are you for ISO/IEC 27001?

The Varmo ISO/IEC 27001 readiness check covers clauses 4 to 10 of the standard including Annex A, mostly from the data in your ISMS. For each clause, it shows whether an auditor would be likely to raise a major or minor nonconformity.

Included from the Starter plan

Request a demoTry it free
WHAT YOU GET
  • Checks clauses 4 to 10 of the standard including Annex A
  • 23 checkpoints from your data, three from data with a short confirmation
  • Traffic light per clause and likely finding per gap
  • Completed checks as a report, with history

Method: what the check covers

The check lays a test bench over your ISMS. Varmo answers most questions from what you record anyway: is there an approved scope, a valid information security policy, assessed risks with approved treatment plans, an up-to-date SoA, an internal audit and a management review from the last 12 months?

  • 26 checkpoints for clauses 4 to 10, 23 of them from your data
  • Three checkpoints (Risks and opportunities addressed, Changes carried out in a planned manner, Communication) first show what Varmo knows from your data; you confirm them with a justification and, if you wish, with evidence. Confirmations are valid for 12 months
  • Annex A: applicability, justified exclusions, cross-check with risk treatment and implementation level per theme A.5 to A.8 (up to 7 checkpoints, depending on the applicable themes)
  • Six critical checkpoints; if one stays open, it counts as a likely major nonconformity

Checkpoints per clause

The overview lists each checkpoint with the clause of the standard and a short label from Varmo, not the text of the standard. You will find the exact wording of the requirements in ISO/IEC 27001:2022.

Clause 4: Context of the organisation

  • Clause: 4.1Internal and external issuesBasis: Data in Varmo
  • Clause: 4.1Climate change assessedBasis: Data in Varmo
  • Clause: 4.2Interested parties and their requirementsBasis: Data in Varmo
  • Clause: 4.3Scope approvedBasis: Data in Varmo · critical
  • Clause: 4.4ISMS established and in operationBasis: Data in Varmo

Clause 5: Leadership

  • Clause: 5.1Leadership and commitment of managementBasis: Data in Varmo
  • Clause: 5.2Information security policyBasis: Data in Varmo · critical
  • Clause: 5.3Roles and responsibilitiesBasis: Data in Varmo

Clause 6: Planning

  • Clause: 6.1.1Risks and opportunities addressedBasis: Data in Varmo + short confirmation
  • Clause: 6.1.2Risk assessmentBasis: Data in Varmo · critical
  • Clause: 6.1.3Risk treatment and Statement of ApplicabilityBasis: Data in Varmo · critical
  • Clause: 6.2Information security objectivesBasis: Data in Varmo
  • Clause: 6.3Changes carried out in a planned mannerBasis: Data in Varmo + short confirmation

Clause 7: Support

  • Clause: 7.1ResourcesBasis: Data in Varmo; until the first management review, also a short confirmation
  • Clause: 7.2Competence of key rolesBasis: Data in Varmo
  • Clause: 7.3AwarenessBasis: Data in Varmo
  • Clause: 7.4CommunicationBasis: Data in Varmo + short confirmation
  • Clause: 7.5Documented informationBasis: Data in Varmo

Clause 8: Operation

  • Clause: 8.1Operational planning and controlBasis: Data in Varmo
  • Clause: 8.2Risk assessment at intervalsBasis: Data in Varmo
  • Clause: 8.3Risk treatment implementedBasis: Data in Varmo

Clause 9: Performance evaluation

  • Clause: 9.1Monitoring and measurementBasis: Data in Varmo
  • Clause: 9.2Internal audit (last 12 months)Basis: Data in Varmo · critical
  • Clause: 9.3Management review (last 12 months)Basis: Data in Varmo · critical

Clause 10: Improvement

  • Clause: 10.1Continual improvementBasis: Data in Varmo
  • Clause: 10.2Nonconformities and corrective actionsBasis: Data in Varmo

Annex A

  • Clause: Annex AApplicability assessedBasis: Data in Varmo
  • Clause: Annex AExclusions justifiedBasis: Data in Varmo
  • Clause: Annex ACross-check with risk treatmentBasis: Data in Varmo
  • Clause: A.5–A.8Implementation level per theme (4 checkpoints)Basis: Data in Varmo

Traffic light per clause

Each checkpoint is met, partially met, open or not yet assessed; met counts in full, partially met counts half. For each clause and overall, a traffic light shows the status: green from 90%, amber from 60%. An open critical checkpoint turns the clause red. In the overall status, clauses 4 to 10 count for 75% and Annex A for 25%.

Overall status in the readiness check report: 81 per cent, 0 expected major and 7 minor nonconformities, below it the status for each of clauses 4 to 10 and for Annex A with icon and text.
Overall grade, expected nonconformities and a traffic light per clause, from the data of the demo organisation.

Gap list with likely findings

For every gap, the check names the clause of the standard, an auditor’s likely finding (major nonconformity, minor nonconformity or note) and exactly what is missing, such as “3 risks have not yet been reviewed or assessed”. A link takes you straight to the place where you close the gap.

Gap list of the readiness check: for each check point the clause of the standard, the status “Partial”, the expected finding “Minor nonconformity” and what is missing, e.g. “3 risks have not yet been reviewed or assessed”.
For each gap the clause of the standard, the expected finding and what exactly is missing.

Report and history

With “Complete check” you freeze the status with date, person and a note as a report, for management or the auditor. The history shows all completed checks and the change in percentage points, so you can demonstrate your progress. If you later move to a smaller plan, saved reports remain readable.

Completed readiness checks over time: 42 per cent, then 72 per cent (+29 percentage points), most recently 81 per cent (+9 percentage points), each with date, person, note and report.
Three completed checks: from 42 % via 72 % to 81 %, each with its own report.

Clearly a self-assessment

The readiness check helps you prepare. Whether your organisation is certified is decided solely by an accredited certification body.

Related

Frequently asked questions

Is the readiness check an ISO 27001 gap analysis?

Yes, a continuous one: for each clause and for Annex A, it shows where your ISMS does not yet meet the requirements, with the likely finding and a link to the place where you close the gap. Because it evaluates the data in Varmo, you can run it again at any time, not just once before the audit.

How can we tell whether we are ready for the certification audit?

When no critical checkpoint is open and the traffic light shows green, meaning at least 90% is met. Varmo treats open critical checkpoints such as scope, risk assessment or internal audit as a likely major nonconformity. The result remains a self-assessment.

Which checkpoints can Varmo not answer from the data?

None entirely without data. For three checkpoints (Risks and opportunities addressed, Changes carried out in a planned manner, Communication), Varmo first shows what it knows from your data, such as opportunities with a measure or communication per interested party; you confirm the checkpoint with a justification and, if you wish, with evidence. Resources is assessed by management in the management review; until then you confirm the checkpoint, and it counts as partially met at most. Confirmations are valid for 12 months.

Does a green readiness check guarantee certification?

No. The check is a self-assessment based on your data. Certification is carried out by an accredited certification body, which also checks whether the ISMS is actually lived.

How long does ISO 27001 certification take?

That depends on your starting point. Many SMEs reckon on six to twelve months from start to certificate, because the ISMS has to run for a while before the audit, including an internal audit and a management review.

How close are you to ISO/IEC 27001?

In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.

Request a demoTry it free