Stage 1 Readiness Pack Template (ISO/IEC 27001 Certification)

Stage 1 Readiness Pack: [Organization name]

Readiness pack and checklist for the Stage 1 certification audit of the information security management system (ISMS) of [Organization name] against ISO/IEC 27001:2022 + Amd 1:2024. It explains what Stage 1 reviews under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, lists the document pack mapped to the documented information the standard requires, sets go or no-go readiness criteria, covers logistics, and gives typical Stage 1 findings with the way to close them before Stage 2. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. What Stage 1 reviews
3. Timeline to Stage 1 and Stage 2
4. Document pack checklist
5. Records that show the ISMS operates
6. Readiness criteria (go or no-go)
7. Logistics
8. Typical Stage 1 findings and how to close them
9. Stage 1 report and closure tracker
10. Size tiers
11. Records and evidence
12. References

1. Purpose and scope

This pack prepares [Organization name] for the Stage 1 audit of its ISMS. It gives the ISMS manager one checklist to confirm that the required documents exist and are approved, that the ISMS has produced records, that people and systems are available, and that known weak points are closed or planned before Stage 2.

2. What Stage 1 reviews

Under ISO/IEC 17021-1:2015 the initial certification audit has two stages. Stage 1 is mainly about the documented system, its readiness and the planning of Stage 2. The list below is our own paraphrase of the Stage 1 objectives as commonly summarised from ISO/IEC 17021-1:2015; the standard and the CB's audit plan are the authority. In practice the auditor will typically:

1. read your core documents (scope, policy, risk method, SoA, objectives and the records listed in section 4) and look for gaps against clauses 4 to 10 of ISO/IEC 27001:2022 + Amd 1:2024;
2. test whether the scope on paper matches the real business: which entities, sites, teams and suppliers are in or out, and whether the headcount and site data behind the audit-day quote are still right;
3. ask how you reached your risk decisions, which laws and contracts drive them, and what the business context looks like;
4. look for proof that the improvement loop has started (an internal audit done, a management review held) and form a view on whether Stage 2 can go ahead;
5. walk a site or a system demonstration and talk to the people who run the ISMS, to see whether they understand what the standard expects;
6. settle the practical details of Stage 2 with you: who, where, which evidence and when.

ISO/IEC 27006-1:2024 adds ISMS-specific expectations for Stage 1, which in practice centre on the auditor understanding the ISMS design, the risk assessment and treatment, the SoA, and the information security policy and objectives before Stage 2 (check the standard for the exact requirements). The CB decides whether Stage 1 is on site, remote or mixed under its rules and IAF MD 4:2025, now re-issued by Global ACI as Global ACI-TECH-3-003 (check the current issue).

A note on CB practice: certification bodies usually expect one full internal audit of the ISMS and one management review before Stage 2 (CB practice, not a clause), and enough operating time for the ISMS to have produced records. This is CB practice and the auditor's judgement of readiness, not a clause in ISO/IEC 27001. Ask your CB what it expects and record the answer in section 6.

3. Timeline to Stage 1 and Stage 2

Example plan (Example: Quillmere Analytics Ltd, target certificate within 6 months of project start; audit days as quoted by the selected CB: Stage 1 1.5 days over two calendar days, Stage 2 3.5 days over three calendar days; certification decision 2027-06-15):

4. Document pack checklist

4.1 Documented information the standard explicitly requires

Clause 6.3 (planning of changes, new in 2022) has no explicit documented information requirement, but auditors often ask how changes to the ISMS are planned. Include DOC-ISMS-025 (ISMS change plan) if you keep one. Amendment 1:2024 added climate change to the context analysis: decide whether it matters for your ISMS (4.1) and check whether any stakeholder has climate-related demands (4.2). Make sure DOC-ISMS-003 shows that decision.

4.2 Supporting documents auditors usually ask for

4.3 Pack rules

• Send documents as read-only exports with the Document ID, version and approval date visible.
• Send through the channel agreed with the CB, following DOC-ISMS-043 (information transfer policy). Do not send Restricted records (for example vulnerability details or personal data); offer them for viewing during the audit instead.
• Keep an index of exactly what was sent and when (section 11).

5. Records that show the ISMS operates

The counts are Example values for Quillmere Analytics Ltd. The 46 persons match the scope headcount (38 employees and 8 contractors); the 2 persons not yet trained must be trained before Stage 2 or the gap shown with a dated plan.

6. Readiness criteria (go or no-go)

Decision rule (Example): go if R1 to R5 and R8 are met and any other gap has an owner and a date before Stage 2.

7. Logistics

8. Typical Stage 1 findings and how to close them

9. Stage 1 report and closure tracker

Summary (Example): 3 areas of concern, all 3 closed by 2027-05-07, before the Stage 2 start date of 2027-05-10.

10. Size tiers

11. Records and evidence

Register these in DOC-ISMS-028 and link the evidence locations in isms/control-evidence-matrix.

12. References

Related templates: isms/certification-body-selection, isms/stage-2-audit-evidence-index, isms/certification-findings-action-plan, isms/isms-documented-information-register, isms/control-evidence-matrix, compliance/ms-scope, compliance/statement-of-applicability, compliance/internal-audit-program, compliance/management-review, isms/certification-audit-explained.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10 and the documented information they require) and with the Stage 1 requirements for certification bodies in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The checklists, readiness criteria, typical findings and examples are original; no ISO/IEC text is reproduced, and the required items are paraphrased by clause number. ISO and IEC standards are copyrighted: obtain the official text from ISO (https://www.iso.org/standard/82875.html) or your national standards body. Check the current editions and your certification body's audit plan and rules before use. Completing this pack does not guarantee certification; the certification decision belongs to the certification body. Template licence: MIT.