ISO/IEC 27001:2022 ISMS Audit & Readiness Assessment — Sample Report

An ISO/IEC 27001 audit is a structured review of an organization's Information Security Management System (ISMS) against the requirements of ISO/IEC 27001:2022 — the internationally recognized standard for establishing, implementing, maintaining, and continually improving an ISMS. A formal certification audit is performed by an accredited independent certification body and results in a certification decision; TMG Security is not an accredited ISO/IEC 27001 certification body and this document is not a certification audit of any kind.

An ISO/IEC 27001 readiness assessment — the type of engagement this sample illustrates — is a gap-analysis-style review performed ahead of a formal certification audit. It evaluates ISMS context, governance, risk management, the Statement of Applicability, and Annex A control implementation to identify gaps and produce prioritized remediation guidance, so an organization can strengthen its ISMS before engaging an accredited certification body. A readiness assessment does not itself produce a certification decision or a certificate, and it is not a substitute for one.

This sample report shows how TMG Security structures that deliverable. It is built around NorthBridge Digital Services, Inc., a fictional cloud software / SaaS / enterprise technology organization headquartered in Denver, Colorado, and covers a simulated assessment period of 01 January – 31 August 2026, evaluated against ISO/IEC 27001:2022 together with Amendment 1:2024.

The illustrative scope below reflects the ISMS boundary TMG Security would define and document under Clause 4.3 ahead of an ISO/IEC 27001:2022 readiness engagement, covering the fictional information systems, cloud infrastructure, and critical third-party services in scope for NorthBridge's ISMS.

NorthBridge's fictional environment operates on a shared-responsibility cloud model (AWS, Kubernetes, and managed data services), which is why several facility-level Annex A physical controls (A.7.11, A.7.12) are assessed as Not Applicable — those responsibilities sit with the underlying cloud infrastructure provider rather than NorthBridge directly.

ISMS context (Clause 4.1) is the set of external and internal issues that can affect an organization's ability to achieve its ISMS objectives. This fictional assessment reviewed five illustrative external issues — enterprise SaaS market competition, the evolving cloud threat landscape, customer contractual security requirements, regulatory and privacy expectations, and climate-related operational disruption — alongside five illustrative internal issues: rapid engineering headcount growth, multi-team ownership of cloud infrastructure, maturing GRC platform adoption, a distributed/remote workforce model, and multiple critical third-party dependencies.

Interested parties (Clause 4.2) are the people and organizations whose requirements are relevant to the ISMS. NorthBridge's fictional interested-party analysis covers customers, employees and contractors, executive leadership and the board, regulators, contractual partners and channel resellers, suppliers and subprocessors, cloud infrastructure providers, independent auditors, cyber insurers, and shareholders/investors — each mapped to its expectations, security relevance, and an accountable ISMS owner.

Clause 5 requires top management to demonstrate leadership and commitment to the ISMS. NorthBridge's fictional governance structure runs from the Board and Executive Leadership through the CISO, down to the GRC Manager, Security Operations Lead, and Internal Audit Lead, with further accountability distributed to the IAM Program Manager, Engineering Director, IT Director, and HR Manager. Governance and leadership commitment were assessed as Effective for this fictional sample, and no findings were raised against this section.

NorthBridge's fictional information security policy framework spans twelve reviewed policy areas — including access control, asset management, cryptography, incident response, business continuity, supplier security, vulnerability management, secure development, acceptable use, data classification, backup, and logging & monitoring — each on an annual review cycle. Roles, responsibilities, and authorities (Clause 5.3) were reviewed through a full RACI matrix spanning ten ISMS activities across ten accountable roles, from the CEO and CISO down to functional leads.

Clause 6.1.2 requires a defined, repeatable risk assessment methodology. NorthBridge's fictional methodology rates each risk on a five-level likelihood scale (Rare, Unlikely, Possible, Likely, Almost Certain) and a five-level impact scale (Insignificant, Minor, Moderate, Major, Severe), then applies risk treatment (Clause 6.1.3) — reduce, avoid, transfer, or accept — with an owner and target date recorded for every open action. The full illustrative risk register covers twelve enterprise risks; representative examples are shown below.

A Statement of Applicability (SoA) is the documented list of Annex A controls, together with their applicability, justification, and implementation status, required by Clause 6.1.3(d) of ISO/IEC 27001:2022. It is one of the central deliverables of an ISMS and a mandatory input to a formal certification audit. This fictional sample includes a comprehensive illustrative SoA covering all 93 Annex A:2022 controls for NorthBridge's environment, each with a TMG-authored plain-language applicability justification — the full SoA is presented in the complete sample PDF.

Of the 93 controls considered, 90 were determined applicable to NorthBridge's fictional environment and 3 were determined not applicable — reflecting NorthBridge's shared-responsibility cloud model and the fact that no in-house software development was outsourced during the assessment period.

An Annex A control assessment evaluates the 93 information security controls listed in Annex A of ISO/IEC 27001:2022, organized across four themes — A.5 Organizational, A.6 People, A.7 Physical, and A.8 Technological — determining applicability, implementation status, and, where applicable, illustrative testing results. TMG's control descriptions below are original plain-language summaries of each control's intent; no copyrighted ISO/IEC control text is reproduced, and no controls beyond those defined in Annex A:2022 are introduced.

TMG Security's fictional assessment methodology combines multiple evidence-gathering techniques — document review, simulated interviews, observation, technical evidence, sampling, walkthroughs, configuration review, testing, and management-record review — to form an evidence-based, illustrative view of ISMS design and operation. The full sample references thirty illustrative evidence entries (policies, registers, review artifacts, technical configurations, and test records), ten simulated role-holder interviews, and fourteen illustrative control-testing procedures with documented populations, samples, results, and finding references. Every evidence reference, interview, and test result in this sample is illustrative — no actual client evidence was collected or reviewed, and no actual interviews were conducted.

This fictional sample identified 14 total findings and observations across 96 illustrative ISMS areas assessed: 0 rated Critical, 3 High, 6 Medium, 3 Low, and 2 forward-looking Observations. Every finding, evidence reference, and management response below is fictional.

Clause 10 requires continual improvement, including corrective action on nonconformities. Every High-severity finding, and a representative Medium-severity finding, was carried through a fictional 5-Whys root-cause analysis to move from the immediate condition to an underlying, addressable root cause — for example, ISMS-H-001's tracking lapse traced back to the risk-treatment process never having been re-engineered to take advantage of current GRC tooling. Corrective actions are logged in a centralized register with owner, priority, target date, and an independent retest validation method for every finding, consolidating root cause, action, and ownership into a single fictional Corrective Action Plan and Management Action Plan.

NorthBridge's fictional management team reviewed and formally accepted each finding, assigning Priority 1 to the three High-severity findings, Priority 2 to the six Medium-severity findings, Priority 3 to the three Low-severity findings, and Priority 4 to the two forward-looking Observations — each with a documented target date and an independent retest sample planned for the subsequent assessment cycle.

Clause 9.3 requires top management to review the ISMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. NorthBridge's fictional Q3 2026 management review considered the status of previous actions, changes in context, risk status, security objectives, audit results, incidents, supplier performance, and resourcing — producing six illustrative action items, including migrating risk-treatment tracking to the centralized GRC platform and extending the IAM governance platform to privileged account tiers.

Clause 9.1 performance evaluation reviewed trend data across the ISMS objectives dashboard. Selected illustrative KPIs: MFA coverage 100% (on target), vulnerability SLA compliance 88% against a 95% target, security training completion 94% against a 98% target, and supplier reassessment coverage 58% against a 100% target — each reconciling to the findings above. Performance evaluation and continual improvement practices were themselves assessed as Partially Effective for this fictional sample, reflecting the internal audit follow-up and metrics-automation observations rather than a control design deficiency.

The fictional maturity model below rates twelve ISMS domains on a five-level scale (1 Initial, 2 Developing, 3 Defined, 4 Managed, 5 Optimized), reflecting the fictional findings identified throughout this sample.

The fictional 90-day remediation roadmap sequences remediation activity ahead of an actual, independent ISO/IEC 27001:2022 certification audit, prioritizing the three High-severity findings for early closure. All dates and timelines shown are illustrative.

Illustrative readiness conclusion: Partially Ready for Formal Certification Audit. This conclusion is illustrative only — it is not an ISO/IEC 27001 certification decision, and a formal certification decision must be made by an appropriately accredited independent certification body following an actual certification audit.

This fictional assessment demonstrates that NorthBridge has established an ISMS foundation with major governance processes in place: leadership commitment is visible, risk management is operational, the Statement of Applicability is comprehensive, and a substantial majority of Annex A:2022 controls — 79 of 90 applicable controls — were assessed as Effective in this sample. The difference between this readiness assessment and a certification audit is that a readiness assessment identifies and helps remediate gaps like these in advance; a certification audit, performed by an accredited body, tests whether the ISMS conforms to ISO/IEC 27001:2022 and results in a formal certification decision. None of the fictional findings in this sample indicate an absent control programme — they reflect documentation, consistency, and evidence-retention gaps within an otherwise well-designed ISMS, the pattern TMG Security would expect to identify and help remediate during a readiness engagement conducted ahead of an organization's first, or a subsequent, certification audit.

Strengths (Fictional)

• Visible executive leadership commitment and a well-structured governance and reporting model
• Comprehensive, current information security policy framework reviewed on a defined annual cycle
• Mature technical control baseline: enforced MFA/SSO, centralized SIEM/EDR, strong cryptography and key management practices
• Documented, exercised incident management and business continuity/disaster recovery programmes
• A comprehensive, well-justified Statement of Applicability covering all 93 Annex A:2022 controls

Improvement Areas (Fictional)

• Enterprise risk treatment tracking evidence and cross-system status reconciliation
• Privileged access recertification evidence retention across cloud, container, and database administrative tiers
• Supplier security reassessment cadence enforcement for High/Medium risk-tier suppliers
• Internal audit finding closure — independent verification prior to marking findings resolved
• Vulnerability remediation exception governance, backup restoration evidence, and change-management security-review consistency

This conclusion, and every figure, finding, and status referenced throughout this sample, is entirely fictional and constructed for demonstration purposes only. It does not describe the security, availability, or ISMS posture of any real organization, and does not constitute an ISO/IEC 27001 certificate, certification decision, or independent certification audit report.

Preparing for a first, or a subsequent, ISO/IEC 27001:2022 certification audit? TMG Security's GRC & Compliance team can scope a real ISMS audit-readiness assessment built with the same structure, methodology, and reporting depth shown in this sample — ISMS context and scope definition, governance and risk review, a comprehensive Statement of Applicability, Annex A control testing, a finding register, and a remediation roadmap your team can execute against before engaging an accredited certification body. Not sure which framework applies to your organization? See how ISO/IEC 27001 compares to other frameworks in TMG's ISO 27001 vs SOC 2 vs PCI DSS comparison guide.