You've finished this phase Next phase: How mature am I compared to peers?
Mark which of the 93 ISO/IEC 27001:2022 Annex A controls you have implemented. The right-hand panel shows in real time which CRA requirements you already cover, and where the gap is.
Information security policy and topic-specific policies defined, approved by management, published, communicated to and acknowledged by relevant personnel and interested parties.
Roles and responsibilities defined and allocated according to the organization needs.
Conflicting duties and areas of responsibility segregated.
Management requires personnel to apply information security in accordance with the policies and procedures.
Contact with relevant authorities maintained.
Contact with special interest groups, forums and professional associations maintained.
Information relating to information security threats collected and analysed to produce threat intelligence.
Information security integrated into project management.
Inventory of information and other associated assets, including owners, developed and maintained.
Rules for the acceptable use and procedures for handling assets identified, documented and implemented.
Personnel and other interested parties return all the assets in their possession upon change or termination.
Information classified according to legal, statutory, business value, criticality and sensitivity.
Procedures for information labelling implemented in line with the classification scheme.
Rules, procedures or agreements for information transfer for all types of transfer facilities.
Rules to control physical and logical access to information and other associated assets established and implemented.
Full life cycle of identities managed.
Allocation and management of authentication information controlled by a management process.
Access rights provisioned, reviewed, modified and removed in accordance with the topic-specific policy on and rules for access control.
Processes and procedures to manage the information security risks associated with the use of supplier products or services.
Relevant information security requirements established and agreed with each supplier.
Processes and procedures to manage information security risks associated with the ICT products and services supply chain.
Regular monitoring, review, evaluation and change management of supplier information security practices and service delivery.
Processes for acquisition, use, management and exit from cloud services established.
Incident management planned and prepared by defining, establishing and communicating processes, roles and responsibilities.
Information security events assessed and decided on whether they qualify as information security incidents.
Response to information security incidents in accordance with the documented procedures.
Knowledge gained from incidents used to strengthen and improve the controls.
Procedures for the identification, collection, acquisition and preservation of evidence.
Information security maintained at appropriate levels during disruption.
ICT readiness planned, implemented, maintained and tested based on business continuity objectives.
Legal, statutory, regulatory and contractual requirements identified, documented and kept up to date.
Procedures implemented to protect intellectual property rights.
Records protected from loss, destruction, falsification, unauthorized access and unauthorized release.
Requirements regarding preservation of privacy and protection of PII identified and met.
Independent reviews at planned intervals, or when significant changes occur.
Compliance with the organization's policies, rules and standards regularly reviewed.
Operating procedures for information processing facilities documented and made available to personnel who need them.
Weighted percentage of each CRA reference covered by the ISO controls you scored above.
See how your ISMS supports broader CRA readiness with the ENISA SME Maturity Assessment.
Run ENISA maturity assessment