The Readiness check shows how far your ISMS is towards certification to ISO/IEC 27001:2022; the Maturity level assesses, per requirement, how mature the implementation is. Both are a self-assessment based on your data, not an audit: only a certification body confirms conformity. This guide is aimed at ISMS managers and at top management.

Before you start

  • The readiness check is available from the Starter plan, the maturity level from the Pro plan. In Free, the readiness check is locked; checks completed earlier remain readable.
  • By default, the ISMS managers, top management and “Internal audit & review (read only)” may view the readiness check. The ISMS managers may answer questions and complete the check.
  • People who manage requirements may assess the maturity level; by default, these are the ISMS managers.
  • The more of your work is in Varmo (scope, risks, Statement of Applicability, audits, management review), the more meaningful the result.

Carrying out the readiness check

  1. Open ISMS management › Readiness check and click Start check.
  2. Varmo checks clauses 4–10 of the standard and Annex A against your data. You see the overall status, the status per clause and the gaps with an auditor's likely finding: major nonconformity, minor nonconformity or note.
  3. The “What happens next?” box names the most important gap. The button next to it takes you straight to where you close it.
  4. Under Self-assessment, you answer the points that Varmo cannot identify from your data, for example on opportunities (6.1.1), planned changes (6.3) or communication (7.4). Click Answer, choose Yes, Partially or No and give a short justification. A document as evidence is optional.
  5. With Check again, you recalculate the status after changes.
  6. If you want to record the status, for example before the audit, click Complete check under Completed checks and optionally add a note. The report can be output with Print / PDF.

Assessing the maturity level

The maturity level ranges from 0 to 4, as in the assessment tool for the ICT Minimum Standard (Switzerland): 0 “Not implemented”, 1 “Partial, not defined”, 2 “Partial, defined and accepted”, 3 “Implemented” and 4 “Dynamic, reviewed and improved”.

  1. For the ICT Minimum Standard (Switzerland) catalogue, the maturity level is always enabled. For other catalogues, you enable it on the catalogue page with Enable maturity level.
  2. Open Requirements › Maturity level and choose the catalogue.
  3. Open a category and click Assess for a requirement. Choose the level and justify it; the justification is required.
  4. Varmo suggests a level for each requirement, based on implementation, evidence, approved policies and documents, regular internal controls as well as improvements and reviews in the last 12 months. With Adopt suggestion …, you adopt it; nothing is saved without your confirmation.
  5. If you have reviewed a requirement and changed nothing, record this with Record review (date, result, justification). This counts as evidence of review for level 4.
  6. Under Settings, you define the Target. The default is 2.6, as in the assessment tool.

You do not assess requirements that are not applicable; they are not included in the evaluation, nor are requirements that have not been assessed.

What happens next

  • The Maturity level page shows the overall value against the target and the values per function and per category. The calculation is the same as in the assessment tool: category from the assessed requirements, function from the categories, overall from the functions. As long as requirements have not been assessed, the value is considered “provisional”.
  • An assessment is valid for 12 months. If it is older or higher than the current suggestion, Varmo marks it with “Check assessment”, and the people who manage requirements receive the task Assess maturity level or Review maturity level. Varmo never lowers a value by itself.
  • You export the evaluation as CSV. For the ICT Minimum Standard, there is also Assessment tool (Excel): the official tool, filled in with your values.

Frequently asked questions

Does the readiness check replace an internal audit?

No. It shows where gaps are likely and helps with preparation. You still carry out the internal audit according to clause 9.2, see Handling internal audits and findings.

What is the difference between implementation and maturity level?

The implementation (from open to implemented) remains in place; evidence and the Statement of Applicability are based on it. The maturity level additionally assesses how well established the implementation is.

Why is my suggestion lower than my assessment?

When in doubt, the suggestion chooses the lower level. Level 4, for example, requires a regular internal control of the requirement and evidence of an improvement or review in the last 12 months. Next to the suggestion, you can see what is missing for the next level.