ISO 27001 checklist for Norwegian SMBs
Define scope, assess risk, implement controls and gather evidence. A practical checklist for preparing a Norwegian SMB for ISO 27001 assessment.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
An ISO 27001 project needs a clear owner and a scope the business can defend. Before buying templates or tools, decide which services the certificate must cover and why the business wants it.
Use ISO/IEC 27001:2022, including applicable amendments, as the requirements reference. This checklist helps organise the work; the standard and the certification body’s assessment remain the basis for certification.
1. Establish scope and responsibility
Describe the services, locations, teams and systems covered by the management system. Include the dependencies needed to deliver those services. A narrow scope still needs to account for relevant suppliers and shared infrastructure.
Have management approve the direction, assign an ISMS owner and allocate time from the people who operate the controls. Set security objectives that can be evaluated, with owners and a way to measure progress.
2. Assess risks and choose treatment
Agree a repeatable method for assessing likelihood and consequences. Identify risks to information and business services, decide how to treat them and assign risk owners.
Determine the controls needed for treatment and compare them with Annex A so necessary controls are not overlooked. The Statement of Applicability should record necessary controls, reasons for inclusion, implementation status and justifications for excluding Annex A controls. Controls may also be needed beyond Annex A.
3. Close the gaps and keep records
Compare the plan with reality. Give missing controls an owner and a completion date. Check that policies describe what people actually do.
Collect evidence as work happens: access decisions, supplier assessments, restore exercises, change approvals and follow-up on security findings. Keep records proportionate and retrievable. A screenshot without a date, scope or explanation may be difficult to use.
4. Assess the management system
Plan an internal audit with objectivity and impartiality. Check requirements and implementation, record findings and follow up corrective actions.
Hold a management review using the required inputs, including performance, audit results and relevant changes. Record decisions and resource needs. These activities should reveal where the system needs improvement before the external assessment.
5. Arrange certification and ongoing work
Choose a certification body with appropriate accreditation. Norsk akkreditering provides information about accreditation in Norway. Agree the audit scope, dates and evidence expectations early.
Prepare for both audit stages and allow time for findings and the certification decision. Once certified, maintain the system and plan surveillance and recertification with the body.
For scheduling, see how long ISO 27001 takes. For technical testing records, see application pentest evidence.
