The Founder's ISO 27001 Checklist: What You've Already Done Without Knowing

You’re probably further along on ISO 27001 than you think.

Most founders hear “ISO 27001” and assume they’re starting from zero. They picture months of implementing complex security controls from scratch.

The reality? Most startups have already covered 30-50% of ISO 27001 requirements through basic security practices they’ve been doing all along.

This checklist helps you see exactly what you’ve already done—no security expertise required.

Why you’re further ahead than you think

ISO 27001 isn’t about implementing exotic security measures. It’s about having systematic, documented approaches to information security. Most technically-minded founders already do this intuitively.

You’ve probably already:

• Set up proper cloud access controls
• Enforced multi-factor authentication
• Conducted code reviews
• Had security discussions in team meetings
• Written some documentation about your practices

The gap isn’t usually implementation—it’s documentation and formalization.

The quick assessment: what you’ve likely already covered

Infrastructure & Operations (You’re probably 80% done)

Requirement	What you’ve probably done	What ISO 27001 calls it
Cloud access control	AWS IAM roles, least privilege principles	A.9.2.1 - Access control policy
Server hardening	Following cloud provider best practices	A.12.1.2 - Secure configuration
Backup procedures	Automated database backups	A.12.3.1 - Backup procedures
Monitoring	Basic logging and alerting	A.12.4.1 - Event logging
Network security	VPC, security groups, firewalls	A.13.1.1 - Network controls

Development Practices (You’re probably 70% done)

Requirement	What you’ve probably done	What ISO 27001 calls it
Code reviews	Pull request reviews before merge	A.14.2.5 - Secure development lifecycle
Secrets management	Environment variables, secret managers	A.13.2.1 - Information transfer
Dependency scanning	GitHub Dependabot, Snyk, similar tools	A.14.2.4 - System security testing
Deployment security	CI/CD with proper access controls	A.14.2.3 - Change management
Testing	Unit tests, integration tests	A.14.2.2 - System testing

People & Processes (You’re probably 40% done)

Requirement	What you’ve probably done	What ISO 27001 calls it
Onboarding/offboarding	Basic employee setup/teardown	A.7.1.1 - Screening
Security awareness	Occasional security discussions	A.7.2.2 - Information security awareness
Incident response	Basic “what if” discussions	A.16.1.1 - Incident management
Remote work policy	Basic guidelines for WFH	A.6.2.1 - Mobile working
Vendor assessment	Due diligence on key tools	A.15.1.1 - Supplier relationships

The detailed checklist

✅ Section A.5: Information Security Policies (40% done)

What you’ve done:

• [ ] Discussed security priorities in team meetings
• [ ] Made decisions about security vs. speed tradeoffs
• [ ] Communicated security expectations to the team

What’s missing:

• [ ] Formal information security policy document
• [ ] Annual policy review process
• [ ] Policy acknowledgment from team members

✅ Section A.6: Organization of Information Security (60% done)

What you’ve done:

• [ ] Defined who makes security decisions
• [ ] Separated development and production access
• [ ] Basic contact information for security issues

What’s missing:

• [ ] Formal roles and responsibilities document
• [ ] Segregation of duties documentation
• [ ] Contact with security groups (industry forums)

✅ Section A.7: Human Resource Security (50% done)

What you’ve done:

• [ ] Basic employee onboarding process
• [ ] Offboarding when employees leave
• [ ] Some security discussions in team meetings

What’s missing:

• [ ] Formal screening process documentation
• [ ] Security awareness training program
• [ ] Disciplinary process for security violations
• [ ] Formal employment termination checklist

✅ Section A.8: Asset Management (30% done)

What you’ve done:

• [ ] Basic inventory of production systems
• [ ] Classification of sensitive data (you know what’s important)

What’s missing:

• [ ] Formal asset inventory
• [ ] Information classification scheme
• [ ] Acceptable use policies
• [ ] Return of assets process

✅ Section A.9: Access Control (70% done)

What you’ve done:

• [ ] MFA on critical systems
• [ ] AWS IAM with least privilege
• [ ] Regular access reviews (informal)
• [ ] Removed access when people left

What’s missing:

• [ ] Formal access control policy
• [ ] documented access review process
• [ ] Privileged access management procedures
• [ ] Remote access policy

✅ Section A.10: Cryptography (60% done)

What you’ve done:

• [ ] HTTPS for all web traffic
• [ ] Database encryption at rest
• [ ] API encryption

What’s missing:

• [ ] Cryptography policy
• [ ] Key management procedures
• [ ] Cryptographic algorithm guidelines

✅ Section A.11: Physical and Environmental Security (40% done)

What you’ve done:

• [ ] Cloud provider handles physical security
• [ ] Basic laptop security (passwords, encryption)

What’s missing:

• [ ] Physical security perimeter documentation
• [ ] Secure working area guidelines
• [ ] Equipment disposal procedures
• [ ] Clear desk policy (if you have an office)

✅ Section A.12: Operations Security (70% done)

What you’ve done:

• [ ] Change management through GitHub/CI/CD
• [ ] Basic monitoring and alerting
• [ ] Backup procedures
• [ ] Some logging

What’s missing:

• [ ] Formal change management procedures
• [ ] Capacity management planning
• [ ] Malware protection procedures
• [ ] Logging and monitoring policy

✅ Section A.13: Communications Security (60% done)

What you’ve done:

• [ ] Network security groups/VPC configuration
• [ ] HTTPS everywhere
• [ ] Secrets management (environment variables)

What’s missing:

• [ ] Network security controls documentation
• [ ] Information transfer policies
• [ ] Message security procedures

✅ Section A.14: System Acquisition, Development and Maintenance (70% done)

What you’ve done:

• [ ] Code reviews
• [ ] Security testing (basic)
• [ ] Secure deployment practices
• [ ] Dependency scanning

What’s missing:

• [ ] Secure development lifecycle policy
• [ ] System security requirements
• [ ] Development security testing procedures
• [ ] Outsource development agreements

✅ Section A.15: Supplier Relationships (30% done)

What you’ve done:

• [ ] Basic due diligence on key vendors
• [ ] Some security requirements in contracts

What’s missing:

• [ ] Supplier risk assessment process
• [ ] Supplier security agreements
• [ ] Supplier monitoring procedures

✅ Section A.16: Information Security Incident Management (40% done)

What you’ve done:

• [ ] Basic incident response discussions
• [ ] Some monitoring/alerting

What’s missing:

• [ ] Formal incident response plan
• [ ] Incident reporting procedures
• [ ] Incident response testing
• [ ] Evidence collection procedures

✅ Section A.17: Information Security Aspects of Business Continuity Management (30% done)

What you’ve done:

• [ ] Basic business continuity discussions
• [ ] Some redundancy in systems

What’s missing:

• [ ] Business continuity impact assessment
• [ ] Business continuity plan
• [ ] Backup and recovery testing

✅ Section A.18: Compliance (40% done)

What you’ve done:

• [ ] Basic understanding of legal requirements
• [ ] Some security discussions

What’s missing:

• [ ] Identification of applicable laws
• [ ] Intellectual property procedures
• [ ] Privacy protection procedures
• [ ] Compliance review process

What this means for your timeline

Based on typical startup coverage:

Your current coverage	Estimated time to ISO 27001
30-40% (typical early startup)	4-6 months
40-50% (typical growth startup)	3-4 months
50-60% (security-conscious startup)	2-3 months
60%+ (mature startup)	1-2 months

The key insight: most of your remaining work isn’t implementing new controls—it’s documenting what you already do and formalizing processes.

The 80/20 rule for ISO 27001

Focus on these high-impact items first:

Quick wins (1-2 weeks each)

1. Document existing processes - Write down what you already do
2. Formalize access reviews - Make your informal reviews systematic
3. Create basic policies - Start with 3-5 core policies
4. Set up regular security meetings - Make discussions systematic

Medium effort (2-4 weeks each)

1. Risk assessment - Systematic approach to what you already worry about
2. Incident response plan - Document your emergency procedures
3. Vendor assessment process - Formalize your due diligence
4. Business continuity basics - Document your backup and recovery plans

Longer effort (1-2 months each)

1. Comprehensive documentation - Fill in all policy gaps
2. Formal training program - Systematic security awareness
3. Audit preparation - Evidence collection and organization

Common surprises for founders

“We already do that!”

Most founders are surprised to discover they’re already compliant with 40-60% of ISO 27001. The gap is documentation, not implementation.

“That’s all?”

The standard looks intimidating, but most controls are common-sense security practices you’re already following.

“The audit cares about documentation”

Auditors don’t care about your security practices as much as they care about your ability to prove you follow them consistently.

“We need to start over”

You don’t need to rip out existing systems. You need to document how they work and show you follow your own processes.

Your next steps

1. Don’t panic - You’re probably further along than you think
2. Assess honestly - Use this checklist to identify your actual coverage
3. Focus on documentation - Write down what you already do
4. Create a plan - Prioritize the 80/20 items first
5. Get help if needed - Consider tools or consultants for the documentation work

The bottom line

ISO 27001 isn’t about becoming a security expert or implementing exotic controls. It’s about having systematic, documented approaches to information security.

You’ve already done most of the hard work. The remaining effort is primarily documentation and process formalization.

The right first step isn’t a massive implementation project. It’s understanding exactly where you stand and what you’ve already covered.

Ready to see your actual ISO 27001 readiness score? Get your personalized checklist in 15 minutes →