Free ISO 27001 checklist for UK small businesses

How you get certified, step by step

Fifteen stages from “we should do this” to a certificate on the wall. Each one says what to do and what to keep as proof. Times are typical for a small firm, not a promise.

1. Get ready

   • Decide why, and write down what it covers

     Say plainly why you want the certificate — a customer contract, a tender, or peace of mind — then write one paragraph on what it covers: which office, which systems, which services.

     What to do:

     1. Write one sentence on why you want the certificate — for example, a tender asks for it.
     2. List the offices, systems and services it will cover.
     3. Turn that into one short paragraph — that is your scope statement.
     4. Get whoever signs the policy to agree and date it.

     Keep as proof: A one-paragraph scope statement, dated and agreed by whoever signs the policy.

     Typical: A day or twoRead the free guides first

   • Check where you stand

     Answer the fifteen plain-English questions on this page and get a score out of 100. The gaps it lists are your starting to-do list.

     What to do:

     1. Open the free ISO 27001 checklist using the link below.
     2. Answer each question honestly — “partly” is fine, it still counts.
     3. Read your score and the list of gaps it gives you.
     4. Save or screenshot the result so you can compare it later.

     Keep as proof: A printout or screenshot of your score and gap list, dated.

     Typical: Ten minutesFree ISO 27001 checklist

   • Get management behind it and name a lead

     A director signs a short information security policy, and one named person owns it day to day. In a small firm that is often the owner or the office manager.

     What to do:

     1. Open the free templates using the link below and download the security policy.
     2. Fill in your company name and details.
     3. Ask a director to sign and date it.
     4. Pick one named person to own it day to day and write their name in it.

     Keep as proof: The signed, dated policy and the name of the person who owns it.

     Typical: A weekSecurity policy template

2. Build your system

   • Write your risk register and asset register

     List the risks to your information with a score and a fix for each, and list every device, system, data set and cloud service with a named owner.

     What to do:

     1. Open the free templates using the link below.
     2. Download the risk register: list each risk, give it a score, and write the fix.
     3. Download the asset register: list every device, system, data set and cloud service.
     4. Put a named owner and a review date on every line of both.

     Keep as proof: Both registers, with owners and review dates filled in.

     Typical: Two or three weeksRisk and asset register templates

   • Write your Statement of Applicability

     Go through the ISO 27001 control list and say which controls you use, which you do not, and why not. Auditors look for this document first.

     What to do:

     1. Open the free templates using the link below and download the Statement of Applicability.
     2. Go through the control list one line at a time.
     3. For each control, mark whether you use it.
     4. For every control you do not use, write one sentence on why not.

     Keep as proof: A Statement of Applicability with a reason for every exclusion.

     Typical: A week or twoStatement of Applicability template

   • Get the technical basics right

     Patching within fourteen days, multi-factor sign-in on email and cloud accounts, tested backups, access removed when someone leaves. These are the same basics Cyber Essentials checks.

     What to do:

     1. Open the free Cyber Essentials check using the link below.
     2. Answer the ten questions — they cover exactly these technical basics.
     3. Work through the gaps it lists, one at a time.
     4. Keep the screenshots and notes it suggests as your proof.

     Keep as proof: Your Cyber Essentials readiness score and the evidence you keep for it.

     Typical: A month or twoFree Cyber Essentials check

   • Train staff and keep the records

     Everyone gets a short awareness session when they join and once a year. Kept's free staff training covers phishing, passwords and reporting mistakes.

     What to do:

     1. Open the free staff training using the link below.
     2. Send the link to every member of staff.
     3. Ask each person to finish the lessons and pass the short quiz.
     4. Write down who completed it and when, and repeat once a year.

     Keep as proof: A list of who completed the training and when.

     Typical: A weekFree staff training

3. Prove it works

   • Run it for a few months and keep the records

     An auditor cannot certify a system that has only existed on paper. Work to your own rules for a few months and keep proof: incidents logged, backups tested, access reviews, changes approved.

     What to do:

     1. Work to your own policy and registers day to day.
     2. Log every incident, however small, in one place.
     3. Test a backup restore and write down the result.
     4. Review who has access to what, and note any changes you approved.
     5. Save each piece of proof in your Kept evidence page as you go.

     Keep as proof: Three months of records: incident log, backup test results, access reviews, change notes.

     Typical: Three months, usuallyKeep the proof in your evidence page

   • Audit yourself first

     Pick each control in turn, look at the evidence, and write down what is not working. Finding it yourself is far cheaper than an auditor finding it.

     What to do:

     1. Take your Statement of Applicability and pick each control in turn.
     2. For each one, open the evidence and ask: does this actually work?
     3. Write down everything that is not working, however small.
     4. Fix each item, or write a dated plan to fix it.

     Keep as proof: An internal audit report with a list of things to fix.

     Typical: A week or twoRe-run the checklist as a self-audit

   • Hold a management review

     Sit down with whoever signs the policy: incidents, audit results, risks, and what to improve next year. Keep the minutes.

     What to do:

     1. Book an afternoon with whoever signs the policy.
     2. Bring the incident log, the internal audit results and the risk register.
     3. Talk through what happened, what you fixed and what to improve next year.
     4. Write minutes of the meeting, date them, and get them signed.

     Keep as proof: Management review minutes, dated and signed.

     Typical: An afternoonBring your registers from the templates

4. Get certified

   • Choose a certification body and get quotes

     Ask three accredited bodies for written quotes. Price depends on your headcount, number of sites and how wide your scope is. Check the body is accredited — in the UK that means UKAS accreditation — or your customers may not accept the certificate.

     What to do:

     1. Search for UKAS-accredited certification bodies online.
     2. Write to three of them with your headcount, sites and scope paragraph.
     3. Ask each for a written quote and their earliest audit dates.
     4. Check each one is UKAS-accredited, then choose and keep the quotes.

     Keep as proof: Three written quotes, and the one you chose with the reason.

     Typical: Two to four weeksRead what the audits involve

   • Stage 1: they check your documents

     The auditor reads your policy, registers and Statement of Applicability and tells you whether you are ready for the real audit, and what to fix first.

     What to do:

     1. Send the auditor your policy, registers and Statement of Applicability when asked.
     2. Walk them through your documents on the day.
     3. Write down everything they say to fix.
     4. Fix each item and keep the proof before Stage 2.

     Keep as proof: The Stage 1 report and your reply to anything it flags.

     Typical: Half a day to a dayStore the report in your evidence page

   • Stage 2: they check what you actually do

     The auditor interviews staff, looks at your records and samples the evidence. Expect findings — most businesses get some.

     What to do:

     1. Tell staff the audit dates and what the auditor may ask them.
     2. Have your records ready: incident log, backup tests, access reviews, training list.
     3. Answer questions honestly — show what you really do, not the ideal.
     4. Write down every finding the auditor raises.

     Keep as proof: The Stage 2 report with its findings listed.

     Typical: One to three days, depending on sizeHave your evidence page ready

   • Close any findings

     For each finding, say what you will do, do it, and show the proof within the timescale your certification body sets. Serious findings must be closed before a certificate is issued.

     What to do:

     1. List every finding from the audit report.
     2. For each one, write what you will do and by when.
     3. Do the fix and take a screenshot or note as proof.
     4. Send the proof to your certification body within their timescale.

     Keep as proof: Corrective actions with evidence, accepted by your certification body.

     Typical: A few weeks to a few monthsKeep the proof in your evidence page

5. Keep it

   • Certificate issued — now keep it alive

     Certificates run three years with a check-up audit each year and a full recertification at the end. Keep the dates in your Kept workspace and we will nudge you well before they slip.

     What to do:

     1. Save the certificate PDF somewhere safe and share it with anyone who asked for it.
     2. Open your certificate tracker using the link below.
     3. Enter the issue and expiry dates from the certificate.
     4. Kept reminds you before each check-up audit — act on the first reminder, not the last.

     Keep as proof: The certificate itself, plus the annual check-up audit dates.

     Typical: A three-year cycleCertificate tracker

Growth customers can tick these off as they go in their Kept workspace, with the certificate tracker and reminders alongside them. See the plans.