Stage 1 Readiness Worksheet

Introduction

This comprehensive self-assessment worksheet helps you objectively evaluate your Stage 1 readiness. Use it 2-4 weeks before your scheduled Stage 1 audit to identify any gaps that need addressing.

How to Use This Worksheet:

1. Be Brutally Honest - This is for YOUR benefit; self-deception helps no one
2. Gather Evidence - Don't just check boxes; verify everything exists and is complete
3. Score Each Section - Use the provided scoring system
4. Calculate Total - Determine your overall readiness score
5. Make Go/No-Go Decision - Use the decision criteria to determine if you should proceed
6. Address Gaps - Create action plan for any items scored low
7. Reassess - Complete this worksheet again after addressing gaps

Scoring System:

For each item, assign a score:

• 2 points = Complete, excellent quality, ready to demonstrate
• 1 point = Exists but needs improvement, or partially complete
• 0 points = Missing, inadequate, or not started

Timing:

• Complete this worksheet 3-4 weeks before Stage 1
• Reassess 1 week before Stage 1 after addressing gaps

Section 1: Core ISMS Documentation

1.1 Scope and Context (Clause 4)

Total Possible: 20 points

Section 1.1 Total: _____ / 20

Quality Check Questions:

• Can you clearly explain why your scope is what it is?
• Would an outsider understand your boundaries?
• Is your context analysis specific to YOUR organization or generic?
• Have you identified all relevant legal/regulatory requirements?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.2 Leadership and Policy (Clause 5)

Total Possible: 16 points

Section 1.2 Total: _____ / 16

Quality Check Questions:

• Is the policy signed by your CEO or equivalent?
• Can you prove that all employees have seen the policy?
• Does everyone know their ISMS role and responsibilities?
• Can you demonstrate top management commitment?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.3 Risk Assessment and Treatment (Clause 6)

Total Possible: 28 points

Section 1.3 Total: _____ / 28

Quality Check Questions:

• Is your risk assessment based on YOUR actual assets and environment?
• Are risk owners real people who have accepted their risks?
• Does your SoA cover all 93 Annex A controls?
• Is there clear traceability from risks → treatment → SoA → controls?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.4 Information Security Objectives (Clause 6.2)

Total Possible: 10 points

Section 1.4 Total: _____ / 10

Quality Check Questions:

• Are your objectives SMART (Specific, Measurable, Achievable, Relevant, Time-bound)?
• Can you demonstrate progress toward achieving them?
• Are they meaningful for your organization, not generic?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.5 Support Resources (Clause 7)

Total Possible: 18 points

Section 1.5 Total: _____ / 18

Quality Check Questions:

• Do you have training records for all employees on information security?
• Can you demonstrate that people are aware of the ISMS and policy?
• Is your document control actually being followed?
• Do you have evidence of competence (certifications, training, experience)?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.6 Operation (Clause 8)

Total Possible: 16 points

Section 1.6 Total: _____ / 16

Quality Check Questions:

• Can you demonstrate that your ISMS processes are actually operating?
• Do you have evidence that changes are being managed?
• Have you performed a risk assessment (not just created the methodology)?
• Are controls from your SoA actually implemented and operational?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.7 Performance Evaluation (Clause 9) - CRITICAL SECTION

Total Possible: 20 points

Section 1.7 Total: _____ / 20

⚠️ CRITICAL REQUIREMENTS:

Items 59 and 63 (Internal Audit and Management Review) are MANDATORY for Stage 1.

Score 0 on either item 59 or 63?

• YES → You are NOT ready for Stage 1. STOP. Complete these first.
• NO → Continue assessment

Quality Check Questions:

• Has your internal audit been completed within the last 3 months?
• Did the internal audit cover all clauses (4-10) and all Annex A controls?
• Was the auditor sufficiently independent (didn't audit their own work)?
• Has management review been held with real management participation?
• Do you have minutes/documentation from management review?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

1.8 Improvement (Clause 10)

Total Possible: 8 points

Section 1.8 Total: _____ / 8

Quality Check Questions:

• Do you have a defined process for handling nonconformities?
• If your internal audit found issues, were they addressed?
• Can you point to improvements made to the ISMS?

Critical Issues: (score 0 on any item)

Improvement Actions Needed:

Section 2: Supporting Documentation

2.1 Mandatory Policies and Procedures

Total Possible: 30 points

Based on your SoA, you may need various Annex A policies and procedures. Score each:

Section 2.1 Total: _____ / 30 (only score items marked "Yes")

Quality Check:

• All policies/procedures marked as "applicable" in SoA exist
• All policies/procedures are approved and version-controlled
• All policies/procedures have been communicated

Critical Issues:

Improvement Actions Needed:

2.2 Records and Evidence

Total Possible: 34 points

Section 2.2 Total: _____ / 34

Quality Check:

• Records are organized and easily accessible
• Records cover at least 2-3 months of ISMS operation
• Records demonstrate controls are actually operating
• Records are retained according to retention schedule

Critical Issues:

Improvement Actions Needed:

Section 3: Implementation Status

3.1 Control Implementation

Total Possible: 20 points

Section 3.1 Total: _____ / 20

Control Implementation Maturity:

For each control category, rate maturity (0 = Not implemented, 1 = Partially, 2 = Fully):

Category Maturity Total: _____ / 20

Quality Check:

• No control is completely unimplemented
• Most controls score 2 (fully implemented)
• Controls scoring 1 have clear implementation plans
• Evidence exists for all implemented controls

Critical Issues:

Improvement Actions Needed:

3.2 ISMS Operational Maturity

Total Possible: 20 points

Section 3.2 Total: _____ / 20

Operational Timeline:

Operational Duration: _____ months (minimum 3 months recommended)

Quality Check:

• ISMS has been operational long enough to demonstrate a complete cycle
• Multiple examples of evidence from different time periods
• Staff can articulate ISMS processes from experience, not just training
• The ISMS is part of "how we work," not a separate compliance exercise

Critical Issues:

Improvement Actions Needed:

Section 4: Team Readiness

4.1 Knowledge and Understanding

Total Possible: 18 points

Section 4.1 Total: _____ / 18

Key Questions Team Should Be Able to Answer:

Test your team with these questions (all key members should know):

Basic ISMS Questions:

• What is our ISMS scope?
• What is our information security policy?
• What are our main information security risks?
• What controls have we implemented?
• What are our information security objectives?

Personal Role Questions:

• What is your role in the ISMS?
• What are your information security responsibilities?
• What ISMS processes do you participate in?
• How do you contribute to information security?

Quality Check:

• All key team members have been briefed on the ISMS
• Everyone knows the audit schedule and their participation
• Team members can confidently discuss their areas
• No one is defensive or uncertain about the ISMS

Team Knowledge Gaps:

Training/Briefing Needed:

4.2 Audit Participation Readiness

Total Possible: 12 points

Section 4.2 Total: _____ / 12

Audit Day Roles:

Quality Check:

• Everyone knows when and where to be
• Everyone knows their role during the audit
• Backups identified in case someone is unavailable
• Team has practiced or rehearsed key elements

Participation Concerns:

Actions Needed:

Section 5: Logistics and Administration

5.1 Audit Logistics

Total Possible: 16 points

Section 5.1 Total: _____ / 16

For On-Site Audits:

• Guest Wi-Fi credentials prepared
• Parking instructions sent to auditor
• Building access arranged
• Security/reception notified of visitor
• Audit room set up with needed materials
• Name cards/badges prepared

For Remote Audits:

• Video conferencing links tested and sent
• Screen sharing tested
• Document sharing platform accessible
• All participants can access video conference
• Backup communication method arranged
• Virtual meeting backgrounds professional

Quality Check:

• Nothing will prevent the audit from starting on time
• Auditor has everything they requested
• Technology works reliably
• Professional environment prepared

Logistics Concerns:

Actions Needed:

5.2 Document Organization

Total Possible: 14 points

Section 5.2 Total: _____ / 14

Document Folder Structure Example:

ISMS Documentation/
|-- 00-Document Index.xlsx
|-- 01-Context and Scope/
|   |-- Context Analysis.docx
|   |-- Interested Parties.docx
|   `-- ISMS Scope Statement.docx
|-- 02-Leadership/
|   |-- Information Security Policy.pdf
|   `-- Roles and Responsibilities.docx
|-- 03-Planning/
|   |-- Risk Assessment Methodology.docx
|   |-- Risk Assessment Results.xlsx
|   |-- Risk Treatment Plan.xlsx
|   `-- Statement of Applicability.xlsx
|-- 04-Support/
|   |-- Policies/
|   |-- Procedures/
|   `-- Training Records/
|-- 05-Operation/
|   `-- Operational Records/
|-- 06-Performance Evaluation/
|   |-- Internal Audit Report.docx
|   |-- Management Review Minutes.docx
|   `-- Monitoring Results/
`-- 07-Improvement/
    `-- Corrective Actions/

Quality Check:

• Structure is logical and easy to navigate
• Nothing is missing or difficult to find
• Auditor can access easily (permissions set correctly)
• All cross-references work

Organization Issues:

Actions Needed:

Readiness Score Summary

Section Scores

Go / No-Go Decision Framework

Critical Showstoppers (Automatic No-Go)

These items MUST score 2 (full points). If any score 0 or 1, you are NOT ready for Stage 1:

Absolute Requirements:

• Item 59: Internal audit has been conducted (Required)
• Item 63: Management review has been conducted (Required)
• Item 21: Risk assessment has been conducted (Required)
• Item 28: Risk treatment plan exists (Required)
• Item 31: Statement of Applicability is complete (Required)

Did ANY of the above score less than 2?

• YES → NO-GO: Do not proceed with Stage 1. Complete these first.
• NO → Continue to readiness assessment

Readiness Assessment by Score

Overall Score: _____ / 320 (_____%)

Decision Criteria:

90-100% (288-320 points) - STRONG GO ✓✓

• Decision: Proceed with Stage 1 with high confidence
• Expectation: Excellent chance of passing Stage 1 with no issues
• Action: Minor polish only, maintain momentum

80-89% (256-287 points) - GO ✓

• Decision: Proceed with Stage 1
• Expectation: Good chance of passing, may have minor observations
• Action: Address items scoring 0 or 1 before Stage 1

70-79% (224-255 points) - CONDITIONAL GO ⚠️

• Decision: Proceed only if critical items are complete
• Expectation: Will likely pass but with improvement areas identified
• Action: Focus on items scoring 0, strengthen items scoring 1
• Risk: May receive minor findings or substantial observations

60-69% (192-223 points) - WEAK GO ⚠️⚠️

• Decision: High risk of "not ready" determination
• Recommendation: Consider delaying Stage 1 by 2-4 weeks
• Action: Address all items scoring 0, improve items scoring 1
• Risk: May not be ready for Stage 2, wasted audit fee

Below 60% (<192 points) - NO-GO ✗

• Decision: Do NOT proceed with Stage 1
• Recommendation: Delay Stage 1 by 4-8 weeks
• Action: Significant work needed across multiple areas
• Risk: Will not be ready, wasted time and money

Section-by-Section Analysis

If your overall score is marginal, analyze by section:

Section 1 (Core ISMS) - Must score 85%+

• Your Score: _____ / 136 (_____%)
• Pass (≥85%) - Core documentation is strong
• Borderline (75-84%) - Address gaps immediately
• Fail (<75%) - Significant documentation gaps, delay Stage 1

Section 2 (Supporting Docs) - Must score 75%+

• Your Score: _____ / 64 (_____%)
• Pass (≥75%) - Supporting documentation adequate
• Borderline (65-74%) - Complete missing items
• Fail (<65%) - Substantial documentation missing, delay Stage 1

Section 3 (Implementation) - Must score 80%+

• Your Score: _____ / 60 (_____%)
• Pass (≥80%) - Good operational evidence
• Borderline (70-79%) - Need more operational evidence
• Fail (<70%) - Not operational long enough, delay Stage 1

Section 4 (Team Readiness) - Must score 70%+

• Your Score: _____ / 30 (_____%)
• Pass (≥70%) - Team is prepared
• Borderline (60-69%) - Additional training/briefing needed
• Fail (<60%) - Team not ready, conduct training

Section 5 (Logistics) - Must score 80%+

• Your Score: _____ / 30 (_____%)
• Pass (≥80%) - Logistics handled
• Borderline (70-79%) - Address logistics items
• Fail (<70%) - Logistics not ready, delay Stage 1

Final Decision

Date of Assessment: _____________________

Stage 1 Scheduled Date: _____________________

Overall Score: _____ / 320 (_____%)

Decision:

• STRONG GO - Proceed with confidence
• GO - Proceed after addressing items scored 0-1
• CONDITIONAL GO - Proceed with caution, address critical gaps
• WEAK GO - High risk, consider delaying
• NO-GO - Delay Stage 1, significant work needed

Critical Gaps to Address:

If Proceeding:

• All "High" priority gaps will be addressed by: _____________________
• Team briefing scheduled for: _____________________
• Final document review scheduled for: _____________________
• Pre-audit confidence level: [ ] High [ ] Medium [ ] Low

If Delaying:

• New target Stage 1 date: _____________________
• Action plan created for addressing gaps
• Responsibilities assigned
• Weekly progress reviews scheduled
• Reassessment date: _____________________

Action Plan Template

Use this template to address identified gaps:

Gap Remediation Plan

Gap #1:

• Item Number: _____
• Current Score: _____
• Description: _______________________________________________________________
• Root Cause: _______________________________________________________________
• Action Required: ___________________________________________________________
• Owner: _____________________
• Target Completion: _____________________
• Evidence Required: _________________________________________________________
• Status: [ ] Not Started [ ] In Progress [ ] Complete

Gap #2:

• Item Number: _____
• Current Score: _____
• Description: _______________________________________________________________
• Root Cause: _______________________________________________________________
• Action Required: ___________________________________________________________
• Owner: _____________________
• Target Completion: _____________________
• Evidence Required: _________________________________________________________
• Status: [ ] Not Started [ ] In Progress [ ] Complete

Gap #3:

• Item Number: _____
• Current Score: _____
• Description: _______________________________________________________________
• Root Cause: _______________________________________________________________
• Action Required: ___________________________________________________________
• Owner: _____________________
• Target Completion: _____________________
• Evidence Required: _________________________________________________________
• Status: [ ] Not Started [ ] In Progress [ ] Complete

(Add more as needed)

Reassessment Schedule

After addressing gaps, reassess your readiness:

First Assessment: _____________________

• Overall Score: _____ / 320 (_____%)
• Decision: _____________________
• Gaps Identified: _____

Second Assessment: _____________________

• Overall Score: _____ / 320 (_____%)
• Decision: _____________________
• Remaining Gaps: _____
• Improvement: _____ points (_____%)

Final Assessment (1 week before Stage 1): _____________________

• Overall Score: _____ / 320 (_____%)
• Decision: _____________________
• Remaining Gaps: _____
• Confidence Level: [ ] High [ ] Medium [ ] Low

Tips for Using This Worksheet

Be Honest and Objective

This worksheet only helps if you're brutally honest. Scoring yourself higher than reality only hurts you during the actual audit.

Red Flags of Over-Scoring:

• Scoring items 2 when you can't immediately show evidence
• Assuming documents are "good enough" without review
• Giving credit for plans rather than completed actions
• Scoring based on what you know should exist, not what you've verified exists

Gather Evidence

Don't score items from memory. Actually pull up the documents and records:

• Can you find it in under 2 minutes?
• Is it complete and current?
• Does it meet the requirement?
• Can you explain it to an auditor?

Involve Your Team

Don't complete this worksheet alone:

• Have process owners verify their sections
• Ask your internal auditor to validate scoring
• Test team knowledge before scoring high on team readiness
• Get a second opinion on documentation quality

Use Multiple Times

Complete this worksheet:

1. First Time: 4-6 weeks before Stage 1 to identify gaps
2. Second Time: 2-3 weeks before Stage 1 after addressing gaps
3. Final Time: 1 week before Stage 1 for final confidence check

Don't Aim for Perfect

Stage 1 doesn't require perfection:

• 85-90% readiness is excellent
• Minor gaps are expected and acceptable
• Observations are learning opportunities
• Some items will improve after Stage 1 feedback

Focus on Critical Items

If time is limited, prioritize:

1. Internal audit (must be complete)
2. Management review (must be complete)
3. Risk assessment and treatment (must be complete)
4. SoA completeness
5. Core documentation (Clauses 4-6)
6. Evidence of operation
7. Everything else

Know When to Delay

It's better to delay Stage 1 than to:

• Fail and have to reschedule anyway
• Damage team confidence
• Waste audit fees
• Create adversarial relationship with auditor
• Rush and make mistakes

Delay Stage 1 if:

• Any critical showstopper scores less than 2
• Overall score is below 70%
• Section 1 (Core ISMS) scores below 85%
• You're not confident explaining your ISMS

Conclusion

This readiness worksheet is your honest assessment tool. Use it wisely:

✓ Be honest - Only you suffer from over-optimistic scoring ✓ Gather evidence - Verify everything before scoring ✓ Address gaps systematically - Use the action plan template ✓ Reassess regularly - Track your improvement ✓ Make confident decision - Go only when truly ready

Remember: Stage 1 is designed to verify readiness. If you're not ready, it's better to discover that through this worksheet than during the actual audit.

Your goal: Score 85%+ and proceed to Stage 1 with confidence, knowing you're prepared for success.

Next Lesson: In Lesson 8.5, we'll cover Stage 2 preparation and what to expect during the main certification audit where your ISMS will be thoroughly tested.