Skip to content
Varmo
DeutschSign inRequest a demo
ISO 27001 SELF-ASSESSMENT · FREE

How ready is your ISMS for ISO 27001?

Answer 29 short questions and see straight away where your organisation stands: a traffic light per clause, your next steps and the right plan. About 5 minutes, no sign-up and no email.

How far along is your ISMS?

Five questions about your organisation, then 24 questions on clauses 4 to 10 and Annex A. No sign-up and no email; your answers stay in your browser.

HOW IT WORKS

What the self-assessment checks.

The test follows the requirements of clauses 4 to 10 of ISO/IEC 27001 and asks about the four themes of Annex A. It uses the same structure and the same traffic light as the readiness check in Varmo.

  • Five questions about your organisationNumber of people, companies, further requirements such as NIS2 or DORA, sign-in with Microsoft 365 and your goal. This determines the plan recommendation.
  • 24 questions about evidenceNot “Are you planning to …?” but “Is there … in writing and approved?”. Six points are critical, such as the scope, the risk assessment and the internal audit.
  • A result with next stepsOverall result, a traffic light per clause, likely major nonconformities and up to two concrete next steps per clause. Ready to print or save as PDF.
  • Your answers stay with youEverything runs in your browser; nothing is sent to us. If you open an account, you can import the result into the setup assistant with one click.
THE QUESTIONS

All questions at a glance.

Answer each question with “No”, “Started”, “Yes, but not up to date or not approved”, “Yes, up to date and evidenced” or “Don’t know”.

Clause 4 · Context of the organization
  1. Have you recorded which internal and external issues affect your information security?
  2. Do you know which interested parties (customers, authorities, partners) place which requirements on your information security?
  3. Is it defined in writing and approved which sites, areas and processes your ISMS covers? (critical)
Clause 5 · Leadership
  1. Has top management approved an information security policy, and do employees know it? (critical)
  2. Are roles and responsibilities for information security assigned and known?
  3. Does top management visibly support the ISMS, for example with time, budget and decisions?
Clause 6 · Planning
  1. Have you defined a risk assessment method and used it to assess your risks? (critical)
  2. Is risk treatment planned, and is there a Statement of Applicability (SoA)? (critical)
  3. Are there measurable information security objectives with owners and deadlines?
Clause 7 · Support
  1. Is there evidence that the people in key roles have the necessary competence?
  2. Are all employees regularly trained or made aware of information security?
  3. Are your ISMS documents controlled, with version, approval and a fixed storage location?
Clause 8 · Operation
  1. Are the measures from risk treatment implemented and tracked until completion?
  2. Do you repeat the risk assessment regularly and after significant changes?
Clause 9 · Performance evaluation
  1. Do you measure whether your measures are effective, for example with metrics or controls?
  2. Has there been an internal audit of the ISMS in the last 12 months? (critical)
  3. Has top management reviewed the ISMS in the last 12 months (management review)? (critical)
Clause 10 · Improvement
  1. Do you handle nonconformities with a root cause and a corrective action?
  2. Do you record improvements continuously, for example from incidents, audits and feedback?
Annex A · Annex A controls
  1. How far are the organisational controls relevant to you implemented, for example for suppliers, incidents and access rights?
  2. How far are the people controls implemented, for example for joiners, leavers and training?
  3. How far are the physical controls implemented, for example for access to premises and equipment?
  4. How far are the technological controls implemented, for example backup, vulnerabilities and logging?
  5. Have you decided for every Annex A control whether it applies to you, and justified any exclusions?

Questions in our own words, without the text of the standard. The self-assessment is your own estimate; certification is decided by an accredited certification body.

READ ON

From self-assessment to ISMS.

QUESTIONS

Frequently asked questions.

Does the self-assessment replace an audit?
No. The self-assessment is your own estimate and gives you a first orientation. Whether your ISMS meets the standard is assessed by an accredited certification body during certification.
What happens to my answers?
Your answers stay in your browser and are not sent to us. If you later open an account in the same browser, you can import the result in the setup assistant; nothing is saved until you confirm.
How long does the test take?
About five minutes: five short questions about your organisation and 24 questions on clauses 4 to 10 and Annex A.
How is the result calculated?
Each answer scores between 0 and 1. Each clause counts the average; the overall result weights clauses 4 to 10 at 75% and Annex A at 25%. If a critical point such as the internal audit is open, the clause is at most amber, and the result names a likely major nonconformity.
Why am I recommended a plan?
The recommendation is based on what you tell us about your organisation: number of people, companies, further requirements, sign-in with Microsoft 365 and your goal. You can change plans at any time.