ISO 27001 · Preparation Kit

ISO 27001 Certification Readiness

ISO 27001 preparation from gap analysis to the Stage 2 audit, for Vietnamese businesses selling into Japan, the EU and Singapore.

Get pTrackly support →

1. Gap Analysis

□ Assess current state against 93 Annex A controls (ISO 27001:2022)
□ Classify: Implemented / Partially / Not implemented
□ Define ISMS scope, what's included, what's excluded
□ Estimate remediation effort per control
□ Prioritize high-risk controls to address first

2. Risk Assessment

□ Build information asset register
□ Identify threats and vulnerabilities per asset
□ Assess likelihood and impact
□ Determine risk treatment: accept / mitigate / transfer / avoid
□ Create Risk Treatment Plan

3. Statement of Applicability (SoA)

□ List all 93 Annex A controls
□ For each control: applicable / not applicable + justification
□ Implementation status: implemented / planned / not applicable
□ Reference related policies and procedures

4. Policies & Procedures (minimum set)

□ Information Security Policy (mandatory)
□ Access Control Policy
□ Incident Response Policy & Procedure
□ Supplier Security Policy
□ Asset Management Policy
□ Business Continuity Plan (BCP)
□ Internal Audit Procedure

5. Certification Audit

□ Stage 1: Document review, auditor reviews policies, SoA, risk assessment
□ Stage 2: On-site/remote assessment, actual controls audit
□ Nonconformity response plan, handle findings
□ Select Certification Body (CB) accredited by IAF members

6. Post-certification maintenance

□ Surveillance audits year 1 and year 2 (annual)
□ Internal audit at least once per year
□ Annual management review
□ Recertification audit after 3 years
□ Update risk assessment when significant changes occur

pTrackly helps you implement ISO 27001 faster with ready-made templates and automated evidence collection.

pTrackly compliance platform

Turn compliance knowledge into work that gets done

Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.

See pTrackly Demo See how it works

In the call, we map your framework, system scope, and how pTrackly fits your current workflow.

Does not replace an independent auditor or certification body.