The 2026 ISO 27001:2022 Checklist your certification body expects.

All 93 Annex A controls from ISO 27001:2022, organized by the four themes, Organizational (37 controls under A.5), People (8 under A.6), Physical (14 under A.7), Technological (34 under A.8). Each control entry includes the official ID, the title, a one-line implementation prompt, and a Statement of Applicability column (Included/Excluded + justification) so the same row that captures readiness becomes the source row for your SoA. The PDF is 28 pages including cover, the 4-theme summary, the 11 new-controls deep dive, the SoA primer, and a stage 2 audit-prep section. The accompanying Excel SoA template repeats the 93 controls in editable form.

Three big shifts. (1) Control count dropped from 114 to 93, 24 of the new controls merged 2 or 3 of the old ones. (2) The structure changed from 14 domains to 4 themes (Organizational/People/Physical/Technological), aligning to ISO 27002:2022. (3) 11 controls are net new: threat intelligence (A.5.7), cloud services (A.5.23), ICT readiness for business continuity (A.5.30), physical security monitoring (A.7.4), configuration management (A.8.9), information deletion (A.8.10), data masking (A.8.11), data leakage prevention (A.8.12), monitoring activities (A.8.16), web filtering (A.8.23), and secure coding (A.8.28). The checklist marks each of the 11 with implementation guidance so existing :2013 programs can prioritize the gap.

You're not alone, UKAS, ANAB, and the other accreditation bodies confirmed the transition deadline was firm. To regain certified status you need a new stage 1 + stage 2 audit against ISO 27001:2022. Most certification bodies will pick up the recertification rather than restart fresh, but you'll need updated SoA, gap analysis against the 11 new controls, and evidence of the merged-control restructuring. The checklist's SoA template is structured exactly the way most CB auditors expect to see it.

An internal audit (per Clause 9.2) is the formal documented audit of your ISMS at planned intervals against your defined audit programme. This checklist is the readiness diagnostic that tells you whether you're ready to commission that internal audit, and whether your existing program would survive a Stage 2 certification audit. Many teams use the checklist as the pre-flight before scheduling the certification body, then the Excel SoA becomes the artifact the CB auditor reviews.

The SoA template ships with ISO 27001:2022 control numbering as the spine. The PDF appendix includes the cross-mapping reference for the most common adjacent frameworks: SOC 2 Trust Services Criteria, HIPAA Security Rule §164.308–.312, GDPR Article 32, NIST CSF 2.0 functions, and NIST 800-53 Rev 5 control families. If you outgrow the spreadsheet, the platform automates the cross-mapping so a single control implementation scores against multiple regimes.

Yes. Built by RiskWatch's compliance team, drawing on the same controls library and stage 2 audit-prep work we use with SaaS, healthcare, financial-services, and MSP customers running our compliance platform. The checklist mirrors the question library inside the platform, so if you outgrow the PDF, your work translates directly.

No. We send the checklist + SoA template immediately. We add you to a low-frequency newsletter (one email per month, ISO 27001:2022 and adjacent-framework updates). One-click unsubscribe. We don't sell or share your email, see the privacy policy linked in the footer.

If you're past the checklist stage and ready to operationalize: the platform runs continuous ISO 27001:2022 + ISO 27002:2022 + cross-framework scoring across every system in scope, with SoA generation and stage-2-audit-binder export built in. Start a 30-day free trial (no credit card) or book a 30-minute walkthrough, both available without leaving this page.