What is an ISO 27001 checklist?

It is a list of the tasks ISO/IEC 27001:2022 requires, each tied to the clause or control it comes from and the evidence that shows it is done. This one covers clauses 4 to 10, the device-related Annex A controls and the certification steps, with all 93 Annex A controls in the Excel tracker.

What are the ISO 27001 requirements?

The requirements are in clauses 4 to 10: understand your context and set the scope, get leadership commitment and a policy, assess and treat information security risks and write a Statement of Applicability, provide resources and control documents, run the plan, monitor, audit and review it, and fix nonconformities. Annex A controls are selected through the risk assessment.

How many controls are in ISO 27001:2022?

Annex A has 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. Eleven are new in 2022, including threat intelligence, configuration management, information deletion, data leakage prevention and web filtering. The 2013 version had 114 controls.

What documents are mandatory for ISO 27001?

The clauses require documented information for the ISMS scope, the security policy, the risk assessment and treatment processes, the Statement of Applicability, the risk treatment plan, objectives, evidence of competence, operational records, risk assessment and treatment results, monitoring results, the internal audit programme and results, management review results, and nonconformities and corrective actions. Annex A controls add more where they apply.

Who issues ISO 27001 certification?

Certification bodies do, not ISO. Choose one accredited by a national accreditation body such as UKAS or ANAB, and check certificates on IAF CertSearch. A certificate should name the full version, for example ISO/IEC 27001:2022.

How long is an ISO 27001 certificate valid?

Three years. The certification body runs surveillance audits in the first and second years and a recertification audit before the end of the third year.

Are ISO 27001:2013 certificates still valid?

No. The transition to the 2022 version ended on 31 October 2025, and all certificates to the 2013 version expired or were withdrawn then. An organization that missed the transition usually starts again with an initial audit.

ISO 27001 Checklist for IT Teams (PDF + Excel)

Q: What is a Statement of Applicability?

It is the document clause 6.1.3 d) requires: a list of every Annex A control, whether it applies, why it is included or excluded, and whether it is implemented. It links your risk assessment to the controls you run, and auditors use it to plan what to sample.

An ISO 27001 checklist turns the standard into tasks you can assign, finish and prove. This one follows ISO/IEC 27001:2022 and has 45 items: 29 for the requirements in clauses 4 to 10, 11 for the Annex A device controls that land on IT, and 5 for the steps to certification. It also lists all 93 Annex A controls, explains the Statement of Applicability, and shows the evidence an auditor will ask for.

It is written for the people who do the work: IT managers, sysadmins and MSPs at companies building an information security management system (ISMS) for the first time, or tidying one up before an audit. Use it as a gap analysis: go row by row, mark what you already have, and the gaps become your plan.

Download it as a printable PDF and an Excel tracker with a dashboard, a clause checklist, all 93 Annex A controls laid out as a Statement of Applicability, a risk register that scores each risk, a mandatory documents tracker, an internal audit plan and a corrective action log. Or work through it below.

Preview of the ISO 27001 checklist PDF and Excel tracker

In short

ISO/IEC 27001:2022 is the current version. Certificates to the 2013 version expired or were withdrawn on 31 October 2025.
Clauses 4 to 10 are the requirements: context and scope, leadership, risk assessment and treatment, support, operation, evaluation and improvement.
Annex A lists 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. You choose the ones your risks need.
The Statement of Applicability records every Annex A control, whether it applies, why, and whether it is in place.
ISO does not certify anyone. A certification body, ideally an accredited one, audits you in two stages, and the certificate lasts three years with yearly surveillance audits.

What ISO 27001:2022 is, and who certifies it

ISO/IEC 27001 sets the requirements for an information security management system: the policies, risk process, controls and reviews an organization uses to protect information. The current edition was published on 25 October 2022. It suits any size or sector, and certification is optional: some companies use it only as a framework.

How ISO/IEC 27001:2022 is built: clauses 4 to 10 as requirements, and 93 Annex A controls in four themes

ISO does not certify. Certificates come from certification bodies, ideally ones accredited by a national accreditation body such as UKAS or ANAB (ISO on certification). You can check a certificate on IAF CertSearch.
The 2013 version is gone. Under IAF MD 26, every certificate to ISO/IEC 27001:2013 expired or was withdrawn at the end of the transition on 31 October 2025.
A 2024 amendment added one question. Amendment 1:2024 asks you to decide whether climate change is a relevant issue for your ISMS (clause 4.1), and notes that interested parties can have climate requirements (4.2). It adds no new security controls.
ISO 27002 is the guidance. ISO/IEC 27002:2022 explains each Annex A control in detail. You certify to 27001, not to 27002.

Comparing frameworks? See ISO 27001 vs SOC 2 and NIST vs ISO. Smaller team? Our guide to ISO 27001 for small businesses covers what to plan for.

ISO 27001 requirements: clauses 4 to 10

Clauses 0 to 3 set the context. Clauses 4 to 10 hold the requirements, and you can't leave any of them out if you claim conformity. Only Annex A controls can be excluded, with a reason in the Statement of Applicability.

Clause	Title	What it asks for
4	Context of the organization	Issues, interested parties and their requirements, the ISMS scope, and the ISMS processes.
5	Leadership	Top management commitment, the information security policy, and assigned roles.
6	Planning	Risk assessment and treatment, the Statement of Applicability, objectives, and planned changes.
7	Support	Resources, competence, awareness, communication, and control of documents.
8	Operation	Run the processes, repeat risk assessments, and carry out the treatment plan.
9	Performance evaluation	Monitoring and measurement, internal audit, and management review.
10	Improvement	Continual improvement, and nonconformity and corrective action.

Start here: a 90-day plan

Do the groundwork first. 14 items are marked "first 30 days": the scope, the policy, the risk method and register, document control, and the device basics.

In the Excel tracker, filter the Phase column to see each list, and give every item an owner and a due date before you start. Certification usually follows once the ISMS has run for a while and produced records: the auditor needs evidence that it works, not only documents.

The ISO 27001 checklist

Each item lists the clause or control it comes from and the evidence to keep. "Documented" in the evidence column means the standard asks for documented information. The Excel tracker adds an owner, a frequency, a status and a due date for every row.

Context (clause 4) (4 items)

Start by writing down what the ISMS covers and why. A tight, clear scope saves work everywhere else, but it must include the people, systems and devices that handle the information you are protecting.

ID	What to do	Reference	Evidence to keep
CL-01	List the internal and external issues that affect your ISMS, and decide whether climate change is one of them (first 30 days)	4.1; Amd 1:2024	Context analysis
CL-02	List interested parties (customers, regulators, staff, suppliers), their security requirements, and which of them the ISMS will address (first 30 days)	4.2	Interested parties register
CL-03	Define the ISMS scope: locations, teams, systems, devices and the interfaces with what is out of scope (first 30 days)	4.3	Scope statement (documented)
CL-04	Set up the ISMS processes and show how they connect	4.4	ISMS process map

Leadership (clause 5) (3 items)

Top management owns the ISMS. Auditors look for real commitment: an approved policy, named roles, budget, and attendance at reviews. Our information security policy template gives you a starting draft.

ID	What to do	Reference	Evidence to keep
CL-05	Get visible commitment from top management: budget, people, and security built into business processes (first 30 days)	5.1	Minutes; resource plan
CL-06	Write the information security policy, have top management approve it, and share it with staff (first 30 days)	5.2	Signed policy (documented)
CL-07	Assign ISMS roles and responsibilities, including who reports on ISMS performance (first 30 days)	5.3	Roles and responsibilities list

Planning and risk (clause 6) (8 items)

This is the core of ISO 27001. You assess risks, choose how to treat them, check your controls against Annex A, and record the result in the Statement of Applicability. Our technology risk assessment template helps with the first step.

ID	What to do	Reference	Evidence to keep
CL-08	Define how you assess risk: the method, the scales and the criteria for accepting risk (first 30 days)	6.1.2	Risk assessment process (documented)
CL-09	Identify risks to confidentiality, integrity and availability, name a risk owner for each, then analyse and rate them (first 30 days)	6.1.2	Risk register (the Excel tab)
CL-10	Choose a treatment for each risk (for example modify, avoid, share or retain) and decide which controls you need	6.1.3	Risk treatment process (documented)
CL-11	Compare the controls you chose with all 93 in Annex A, so nothing necessary is missed	6.1.3 c)	Annex A comparison
CL-12	Write the Statement of Applicability: every Annex A control, included or excluded, why, and whether it is implemented	6.1.3 d)	Statement of Applicability (the Excel tab)
CL-13	Write the risk treatment plan, and get risk owners to approve it and accept the residual risk	6.1.3 e)–f)	Risk treatment plan; sign-offs
CL-14	Set measurable security objectives, with who, what, by when and how you will check them	6.2	Objectives (documented)
CL-15	Plan changes to the ISMS before you make them	6.3	Change records

Support (clause 7) (5 items)

The ISMS needs people who know what to do and documents that are controlled. Version, approve and review every document the ISMS depends on.

ID	What to do	Reference	Evidence to keep
CL-16	Give the ISMS the people, time and budget it needs	7.1	Budget; resource plan
CL-17	Define the competence each ISMS role needs, close the gaps, and keep proof	7.2	Competence records (documented)
CL-18	Make sure staff know the policy, their part in it, and what happens if they ignore it	7.3	Awareness training records
CL-19	Decide what you communicate about security, to whom, when and how	7.4	Communication plan
CL-20	Control your ISMS documents: owner, version, approval, access, retention (first 30 days)	7.5	Document register

Operation (clause 8) (3 items)

Run the plan. Repeat the risk assessment at planned intervals and whenever something significant changes, such as a new office, system or supplier, and keep the results.

ID	What to do	Reference	Evidence to keep
CL-21	Plan and control the processes that deliver security, including services from suppliers and cloud providers	8.1	Operating records
CL-22	Repeat the risk assessment at planned intervals and after significant change, and keep the results	8.2	Risk assessment results (documented)
CL-23	Carry out the risk treatment plan and keep the results	8.3	Risk treatment results (documented)

Performance evaluation (clause 9) (4 items)

Measure whether the ISMS works, audit it yourself, and have top management review it. Stage 1 of the certification audit checks that these have happened.

ID	What to do	Reference	Evidence to keep
CL-24	Decide what to monitor and measure, how and when, and who analyses the results	9.1	Monitoring results (documented)
CL-25	Plan an internal audit programme that covers the whole ISMS, with impartial auditors	9.2	Audit programme (documented)
CL-26	Run the internal audits, report the results to management, and keep the evidence	9.2	Audit reports (documented)
CL-27	Hold management reviews with the required inputs, and record the decisions	9.3	Management review minutes (documented)

Improvement (clause 10) (2 items)

When something goes wrong, or an audit finds a gap, fix the cause, not only the symptom, and record it.

ID	What to do	Reference	Evidence to keep
CL-28	Keep a list of improvements and act on it	10.1	Improvement log
CL-29	For each nonconformity: contain it, find the cause, fix it, check the fix worked, and record it all	10.2	Nonconformity and corrective action log (documented)

Device controls (Annex A) (11 items)

Laptops and phones carry information out of the office, so several Annex A controls land on IT. These are the device items most ISMS scopes need; your SoA decides which apply. See also our BYOD policy template and patch management policy template.

ID	What to do	Reference	Evidence to keep
DV-01	Keep an inventory of laptops, phones and tablets with an owner for each, and reconcile it (first 30 days)	A.5.9	Device inventory export
DV-02	Encrypt every laptop (BitLocker, FileVault) and keep recovery keys off the device (first 30 days)	A.8.1, A.8.24	Encryption status per device
DV-03	Encrypt phones and tablets and require a passcode (first 30 days)	A.8.1	Mobile encryption and passcode report
DV-04	Lock screens after a short idle time (first 30 days)	A.7.7, A.8.1	Screen-lock settings report
DV-05	Install OS updates on a set timeline, fastest for actively exploited flaws (first 30 days)	A.8.8, A.8.32	Patch compliance report
DV-06	Control which apps can be installed on company devices	A.8.19, A.8.7	App allow and block lists
DV-07	Have a lost-device process: report at once, lock, and wipe if needed	A.7.9, A.6.7	Incident record with actions and times
DV-08	Wipe devices before reuse or disposal, and keep a record	A.7.14, A.8.10	Wipe and disposal records
DV-09	Document a secure configuration baseline for endpoints and check devices against it	A.8.9	Baseline; compliance report
DV-10	Recover or wipe company devices when people leave	A.5.11, A.5.18	Leaver records
DV-11	Write a topic-specific policy for endpoint devices, including personal devices (BYOD)	A.8.1, A.6.7	Endpoint and BYOD policy

Certification (5 items)

Certification is optional, but many companies doing this work want the certificate for customers. The audit happens in two stages, then repeats every year.

ID	What to do	Reference	Evidence to keep
CT-01	Decide whether to certify. If yes, choose an accredited certification body and check its accreditation	ISO/IEC 27006-1	Certification body contract
CT-02	Run at least one full internal audit and one management review before the Stage 1 audit	9.2, 9.3	Audit report; review minutes
CT-03	Stage 1: the auditor reviews your documents and readiness. Fix the findings before Stage 2	Certification	Stage 1 report; actions
CT-04	Stage 2: the auditor tests that the ISMS and controls work, through interviews and samples of evidence	Certification	Stage 2 report; certificate
CT-05	Keep it running: surveillance audits every year and a recertification audit before the third year ends	Certification	Surveillance reports

ISO 27001 mandatory documents

The standard asks for "documented information", not named documents in a set format. These are the items clauses 4 to 10 require for every certified ISMS:

Documented information	Clause
ISMS scope	4.3
Information security policy	5.2
Risk assessment process	6.1.2
Risk treatment process	6.1.3
Statement of Applicability	6.1.3 d)
Risk treatment plan	6.1.3 e), 8.3
Information security objectives	6.2
Evidence of competence	7.2
Other documents you decide the ISMS needs	7.5.1 b)
Operational records, enough to show processes ran as planned	8.1
Results of risk assessments	8.2
Results of risk treatment	8.3
Monitoring and measurement results	9.1
Internal audit programme and results	9.2
Management review results	9.3
Nonconformities, actions taken and results of corrective action	10.2

Annex A adds more, but only for the controls you include in your SoA. The common ones are topic-specific policies (A.5.1), an asset inventory (A.5.9), acceptable use rules (A.5.10), access control rules (A.5.15), an incident management plan (A.5.24), endpoint device rules (A.8.1), secure configurations (A.8.9), cryptography rules (A.8.24) and a change management procedure (A.8.32). Our templates cover several of these: access control, acceptable use, IT asset management, data encryption, configuration management and remote work, plus a cybersecurity incident response plan.

The Statement of Applicability (SoA)

The Statement of Applicability is one of the first documents an auditor asks for. Clause 6.1.3 d) asks for it: every Annex A control, whether it applies to you, why it is included or excluded, and whether it is implemented. It ties your risk assessment to the controls you run.

From risk assessment to risk treatment, the Annex A comparison, the Statement of Applicability and the risk treatment plan

Here is what three rows can look like:

Control	Applicable?	Justification	Status
A.8.1 User endpoint devices	Yes	Risk R-03: staff laptops and phones hold customer data and leave the office	Implemented
A.7.4 Physical security monitoring	No	No company premises: staff work from home or from co-working spaces where the provider runs the building security	N/A
A.8.28 Secure coding	Yes	We develop our own customer-facing software (risk R-07)	In progress

Exclusions need a real reason. "Not relevant" is not enough; say why, for example no premises or no in-house development.
Link each included control to a risk (or to a legal or contractual requirement), so the auditor can trace it.
Keep it current. Update the SoA when the risk assessment, the scope or the controls change.

ISO 27001 risk assessment and treatment

Clause 6.1.2 asks you to define a risk process and apply it consistently: criteria for accepting risk, a way to identify risks to confidentiality, integrity and availability, an owner for each risk, and a rating. Clause 6.1.3 asks you to treat the risks, and clauses 8.2 and 8.3 ask you to repeat the assessment and keep the results.

ID	Asset	Threat and weakness	Score (L×I)	Treatment and controls
R-03	Staff laptops	Loss or theft: unencrypted disk on some devices	4×4 = 16	Modify: A.8.1, A.8.24, A.7.9
R-05	Customer database	Unauthorized access: shared admin account	3×5 = 15	Modify: A.5.15, A.5.18, A.8.2, A.8.5
R-07	Customer app	Exploited code flaw: no secure coding standard	3×4 = 12	Modify: A.8.25, A.8.28, A.8.29

The Excel risk register scores likelihood times impact on a 1 to 5 scale, flags scores of 15 and above, and has columns for the treatment, linked controls, residual risk and the owner's acceptance. Choose your own scale and acceptance level; the standard doesn't set one.

ISO 27001 Annex A controls list (2022)

Annex A lists 93 controls in four themes. The 2013 version had 114 controls in 14 clauses; the 2022 version merged and renamed many of them and added 11 new ones: A.5.7, A.5.23, A.5.30, A.7.4, A.8.9, A.8.10, A.8.11, A.8.12, A.8.16, A.8.23, A.8.28. ISO/IEC 27002 explains each control and tags it with attributes such as preventive or detective, and confidentiality, integrity or availability.

You don't have to implement all 93. You choose the controls your risks need, then check the full list so nothing necessary is missed. The "Device-related" column marks the controls where laptops and phones usually play a part. The Excel tracker has every control as an SoA row.

Organizational controls (37)

Control	Title	Device-related
A.5.1	Policies for information security
A.5.2	Information security roles and responsibilities
A.5.3	Segregation of duties
A.5.4	Management responsibilities
A.5.5	Contact with authorities
A.5.6	Contact with special interest groups
A.5.7	Threat intelligence (new in 2022)
A.5.8	Information security in project management
A.5.9	Inventory of information and other associated assets	Yes
A.5.10	Acceptable use of information and other associated assets	Yes
A.5.11	Return of assets	Yes
A.5.12	Classification of information
A.5.13	Labelling of information
A.5.14	Information transfer
A.5.15	Access control	Yes
A.5.16	Identity management
A.5.17	Authentication information
A.5.18	Access rights	Yes
A.5.19	Information security in supplier relationships
A.5.20	Addressing information security within supplier agreements
A.5.21	Managing information security in the ICT supply chain
A.5.22	Monitoring, review and change management of supplier services
A.5.23	Information security for use of cloud services (new in 2022)
A.5.24	Information security incident management planning and preparation
A.5.25	Assessment and decision on information security events
A.5.26	Response to information security incidents
A.5.27	Learning from information security incidents
A.5.28	Collection of evidence
A.5.29	Information security during disruption
A.5.30	ICT readiness for business continuity (new in 2022)
A.5.31	Legal, statutory, regulatory and contractual requirements
A.5.32	Intellectual property rights
A.5.33	Protection of records
A.5.34	Privacy and protection of PII
A.5.35	Independent review of information security
A.5.36	Compliance with policies, rules and standards for information security
A.5.37	Documented operating procedures

People controls (8)

Control	Title	Device-related
A.6.1	Screening
A.6.2	Terms and conditions of employment
A.6.3	Information security awareness, education and training
A.6.4	Disciplinary process
A.6.5	Responsibilities after termination or change of employment
A.6.6	Confidentiality or non-disclosure agreements
A.6.7	Remote working	Yes
A.6.8	Information security event reporting

Physical controls (14)

Control	Title	Device-related
A.7.1	Physical security perimeters
A.7.2	Physical entry
A.7.3	Securing offices, rooms and facilities
A.7.4	Physical security monitoring (new in 2022)
A.7.5	Protecting against physical and environmental threats
A.7.6	Working in secure areas
A.7.7	Clear desk and clear screen	Yes
A.7.8	Equipment siting and protection
A.7.9	Security of assets off-premises	Yes
A.7.10	Storage media	Yes
A.7.11	Supporting utilities
A.7.12	Cabling security
A.7.13	Equipment maintenance
A.7.14	Secure disposal or re-use of equipment	Yes

Technological controls (34)

Control	Title	Device-related
A.8.1	User endpoint devices	Yes
A.8.2	Privileged access rights
A.8.3	Information access restriction
A.8.4	Access to source code
A.8.5	Secure authentication	Yes
A.8.6	Capacity management
A.8.7	Protection against malware	Yes
A.8.8	Management of technical vulnerabilities	Yes
A.8.9	Configuration management (new in 2022)	Yes
A.8.10	Information deletion (new in 2022)	Yes
A.8.11	Data masking (new in 2022)
A.8.12	Data leakage prevention (new in 2022)	Yes
A.8.13	Information backup
A.8.14	Redundancy of information processing facilities
A.8.15	Logging	Yes
A.8.16	Monitoring activities (new in 2022)	Yes
A.8.17	Clock synchronization
A.8.18	Use of privileged utility programs
A.8.19	Installation of software on operational systems	Yes
A.8.20	Networks security
A.8.21	Security of network services
A.8.22	Segregation of networks
A.8.23	Web filtering (new in 2022)
A.8.24	Use of cryptography	Yes
A.8.25	Secure development life cycle
A.8.26	Application security requirements
A.8.27	Secure system architecture and engineering principles
A.8.28	Secure coding (new in 2022)
A.8.29	Security testing in development and acceptance
A.8.30	Outsourced development
A.8.31	Separation of development, test and production environments
A.8.32	Change management	Yes
A.8.33	Test information
A.8.34	Protection of information systems during audit testing

The certification audit, and what auditors look for

ISO 27001 certification path: build the ISMS, internal audit, management review, Stage 1 and Stage 2 audits, then surveillance audits and recertification

Stage 1 is mostly a review of your documents and readiness: scope, policy, risk assessment, SoA, and whether an internal audit and a management review have happened. It also plans Stage 2.
Stage 2 tests whether the ISMS and the controls work, through interviews, observation and samples of evidence. Expect to show records, not only documents.
After certification, the certificate is valid for three years. Surveillance audits follow each year, and a recertification audit comes before the end of the third year.
Cite it correctly. ISO asks for the full reference, such as "certified to ISO/IEC 27001:2022".

Time and cost vary with your scope, headcount and certification body; the number of audit days depends on headcount in scope. Ask two or three accredited bodies for quotes. For an internal ISO 27001 audit checklist, use clauses 4 to 10 above as the audit criteria and sample the SoA controls.

The device side of ISO 27001

ISO 27001 names no product. But several Annex A controls depend on the laptops and phones your people carry, and auditors sample them: show me this laptop's encryption, show me how a lost phone was handled, show me that this leaver's device was wiped.

Device controls such as inventory, encryption, screen lock, OS updates and remote wipe, mapped to the ISO 27001 Annex A controls they support

A.8.1 User endpoint devices: a topic-specific policy for endpoints, then the settings that carry it out: encryption, screen lock, updates and app control. Evidence: the policy and a per-device compliance report.
A.5.9 Inventory: every device, with an owner. Evidence: an inventory export reconciled with HR and purchasing.
A.8.24 Cryptography: rules for encryption and key management. Evidence: encryption status per device and where recovery keys are kept. See our guide to full disk encryption.
A.8.8 Vulnerabilities and A.8.32 Change management: OS updates on a timeline. Evidence: patch compliance over time.
A.8.9 Configuration management: a documented baseline and checks against it. Evidence: the baseline and drift reports.
A.7.9 Off-premises, A.7.14 Disposal and A.8.10 Deletion: lock or wipe lost devices, and wipe before reuse or disposal. Evidence: incident and disposal records with times. Our asset disposal policy template covers the procedure.
A.6.7 Remote working: the same protections wherever the device is. Evidence: the remote working rules and the device reports above.

Common mistakes

Starting with Annex A. Controls come after the risk assessment. Without it, the SoA has nothing to justify its choices.
Excluding controls without a reason. Every exclusion needs a written justification.
Documents without records. Stage 2 samples evidence that the controls run: logs, reports, tickets, minutes.
Skipping the internal audit or the management review before Stage 1. Both must have happened.
Leaving devices out of scope. Laptops and phones that reach in-scope information are part of the ISMS.
Calling yourself "ISO 27001 compliant" without a certificate, or citing the old 2013 version. Use the full reference: ISO/IEC 27001:2022.

More ISO 27001 guides for IT teams

How trio.so helps with the device controls

ISO 27001 is a management system: the scope, policies, risk assessment, SoA, audits and reviews are your organization's work, and certification depends on all of it. trio.so covers the device settings behind most of the device items in this checklist from one console, across Windows, Mac, iOS and Android:

Encryption: enforce BitLocker on Windows and FileVault on Mac, with FileVault recovery key escrow, enforce encryption on phones, and see encryption status per device (DV-02, DV-03).
Passcodes and screen lock: passcode and screen-lock policies on enrolled devices (DV-03, DV-04).
OS updates: manage OS updates across the fleet (DV-05).
Apps: allow and block lists for company devices (DV-06).
Lost devices and leavers: lock a lost Mac, iPhone or Android device, and wipe company-owned devices (DV-07, DV-08, DV-10).
Inventory and evidence: device inventory for every enrolled device, and a compliance engine that includes ISO 27001 as a framework for device controls, with evidence you can export for your auditor (DV-01, DV-09, CL-24).

trio.so does not write your SoA, risk register or policies, and it does not certify you. It gives you the device settings and the device evidence for them.

Comparing tools? Our guide to ISO 27001 compliance software covers what automation can and can't do. Learn more about compliance automation.

Start free trial Book a demo

14-day free trial. No credit card required.

Handling personal data too? See the ISO 27701 checklist for privacy management, and our GDPR compliance checklist.

Sources. Last reviewed October 2026. Requirements are paraphrased, not quoted; check wording against your licensed copy of the standard. This article is guidance, not legal or certification advice. The mapping of device controls to Annex A is ours.