VaultISO 27001Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist
ISO 27001 · Clause 9.2

Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist

Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist

24 August 20261 min read
Book a discovery call

Key Takeaways

Stage 2 tests whether your ISMS operates the way your documentation says it does — auditors sample evidence, not just policies.

Evidence window
Auditors typically sample the last 3–6 months
Common finding
Risk register not kept current after Stage 1

Stage 2 auditors are checking for operating effectiveness, not just documented intent. Expect them to ask for evidence — ticket trails, meeting minutes, access logs — that controls were actually followed during the audit period.

Run an internal audit and a management review before the external Stage 2 visit. Both are explicit requirements, and auditors will look for them as evidence the ISMS is self-correcting.

Brief control owners ahead of time. Auditors interview staff directly, and a control owner who cannot explain their own process is a more common nonconformity trigger than missing documentation.

Standard engine

ISO 27001 reference directory.

Every control in this framework and the clause guides that sit above them, grouped by control domain. Open any entry for its control definition, implementation steps and the audit evidence it expects. Dimmed entries are planned.

ClausesThe management systemClause guides · 23 guides
Clause 4.1Understanding the organization and its context→Clause 4.2Understanding the needs and expectations of interested parties→Clause 4.3Determining the scope of the information security management system→Clause 4.4Information security management system→Clause 5.1Leadership and commitment→Clause 5.2Policy→Clause 5.3Organizational roles, responsibilities and authorities→Clause 6.1Actions to address risks and opportunities→Clause 6.2Information security objectives and planning to achieve them→Clause 7.1Resources→Clause 7.2Competence→Clause 7.3Awareness→Clause 7.4Communication→Clause 7.5Documented information→Clause 8.1Operational planning and control→Clause 8.2Information security risk assessment→Clause 8.3Information security risk treatment→Clause 9.1Monitoring, measurement, analysis and evaluation→Clause 9.2Internal audit→Clause 9.2Preparing for Your ISO 27001 Stage 2 Audit: A Practical Checklist→Clause 9.3Management review→Clause 10.1Continual improvement→Clause 10.2Nonconformity and corrective action→
A.5Organizational Controls37 guides
A.5.1Policies for information security→A.5.2Information security roles and responsibilities→A.5.3Segregation of duties→A.5.4Management responsibilities→A.5.5Contact with authorities→A.5.6Contact with special interest groups→A.5.7Threat intelligence→A.5.8Information security in project management→A.5.9Inventory of information and other associated assets→A.5.10Acceptable use of information and other associated assets→A.5.11Return of assets→A.5.12Classification of information→A.5.13Labelling of information→A.5.14Information transfer→A.5.15Access control→A.5.16Identity management→A.5.17Authentication information→A.5.18Access rights→A.5.19Information security in supplier relationships→A.5.20Addressing information security within supplier agreements→A.5.21Managing information security in the ICT supply chain→A.5.22Monitoring, review and change management of supplier services→A.5.23Information security for use of cloud services→A.5.24Information security incident management planning and preparation→A.5.25Assessment and decision on information security events→A.5.26Response to information security incidents→A.5.27Learning from information security incidents→A.5.28Collection of evidence→A.5.29Information security during disruption→A.5.30ICT readiness for business continuity→A.5.31Legal, statutory, regulatory and contractual requirements→A.5.32Intellectual property rights→A.5.33Protection of records→A.5.34Privacy and protection of PII→A.5.35Independent review of information security→A.5.36Compliance with policies, rules and standards for information security→A.5.37Documented operating procedures→
A.6People Controls8 guides
A.6.1Screening→A.6.2Terms and conditions of employment→A.6.3Information security awareness, education and training→A.6.4Disciplinary process→A.6.5Responsibilities after termination or change of employment→A.6.6Confidentiality or non-disclosure agreements→A.6.7Remote working→A.6.8Information security event reporting→
A.7Physical Controls14 guides
A.7.1Physical security perimeters→A.7.2Physical entry→A.7.3Securing offices, rooms and facilities→A.7.4Physical security monitoring→A.7.5Protecting against physical and environmental threats→A.7.6Working in secure areas→A.7.7Clear desk and clear screen→A.7.8Equipment siting and protection→A.7.9Security of assets off-premises→A.7.10Storage media→A.7.11Supporting utilities→A.7.12Cabling security→A.7.13Equipment maintenance→A.7.14Secure disposal or re-use of equipment→
A.8Technological Controls34 guides
A.8.1User endpoint devices→A.8.2Privileged access rights→A.8.3Information access restriction→A.8.4Access to source code→A.8.5Secure authentication→A.8.6Capacity management→A.8.7Protection against malware→A.8.8Management of technical vulnerabilities→A.8.9Configuration management→A.8.10Information deletion→A.8.11Data masking→A.8.12Data leakage prevention→A.8.13Information backup→A.8.14Redundancy of information processing facilities→A.8.15Logging→A.8.16Monitoring activities→A.8.17Clock synchronization→A.8.18Use of privileged utility programs→A.8.19Installation of software on operational systems→A.8.20Networks security→A.8.21Security of network services→A.8.22Segregation of networks→A.8.23Web filtering→A.8.24Use of cryptography→A.8.25Secure development life cycle→A.8.26Application security requirements→A.8.27Secure system architecture and engineering principles→A.8.28Secure coding→A.8.29Security testing in development and acceptance→A.8.30Outsourced development→A.8.31Separation of development, test and production environments→A.8.32Change management→A.8.33Test information→A.8.34Protection of information systems during audit testing→
OtherAdditional Guides7 guides
GuideISO 27001 Statement of Applicability: what it is, with a worked example→GuideISO 27001 implementation→GuideISO 27001 certification and audit process→GuideISO 27001 mandatory documents and records→GuideISO 27001 gap analysis→GuideISO 27001 certification cost→GuideISO 27001 Annex A controls→
ISO 27001 Accelerator

Ready to accelerate your path to certification?

Work with a Trust Architect to scope your ISMS, close the gaps, and get audit-ready — without stalling your roadmap.

Book a Call →
GRCMANA
  • About
  • Insights
  • Contact
Ask the Trust ArchitectBook a Call →
  • About
  • Insights
  • The Vault
    Compliance VaultCyber Essentials→ISO 27001→SOC 2→ISO 42001→
    Domain VaultGRC Fundamentals→Risk Management→AI Governance→GRC Engineering→
    Other ResourcesFree Tools→Templates→Newsletter→
  • Contact
Book a Call →Ask the Trust ArchitectFixed fee. ISO 27001 in as few as six weeks.
GRCMANA

Helping high-growth B2B tech startups close the Enterprise Trust Gap through security, governance, and AI resilience.

ISO 27001ISO 42001ISO 9001Cyber EssentialsEU AI Act ReadyNIST AI RMF

The Vault

GRC EngineeringAI GovernanceISO 27001ISO 42001All Vault Resources

Resources

BlogFree ToolsTemplatesNewsletter

Company

About GRCMANAContactPrivacy PolicyTerms & ConditionsCookie Policy
© 2025 GRCMANA · All rights reservedRegistered in England & Wales under company registration 16810805. VAT Registration 506308024