ISO/IEC 27001:2022

ISO/IEC 27001:2022 ISMS Health Check

Evaluate the health of your Information Security Management System across leadership governance, employee vigilance and Annex A technical guardrails.

FrameworkISO 27001:2022 RBI PA (S-633)RBI IT Governance RBI IT Outsourcing

Why it matters

Enterprise RFP eligibility, customer trust and reduced breach liability.

What you learn

Readiness %, high-risk Annex A blind spots and pre-certification gaps.

Effort

~8 minutes · 12 questions · no documents required

Important notice & scope disclaimer

Directional dipstick only

These Self-Assessment Questionnaires are a high-level dipstick check to establish your current state. They are not a replacement for a formal audit, CERT-In system audit or comprehensive gap assessment.

Operational health questionnaire

Pick the option that best reflects day-to-day reality, not policy on paper.

1Governance, Roles & Risk

Is it clearly defined who owns security decisions, and do teams know where company security policies apply?

Clauses 4.1–4.4, 5.1–5.3

Do you have a documented way of identifying, evaluating and prioritising risks before rolling out key business initiatives?

Clause 6.1 · Risk Assessment

Do department leads review security incidents, audit findings and risk priorities at least once or twice a year?

Clause 9.3 · Management Review

2People & Everyday Hygiene

Are team members briefed on security during onboarding and kept alert against common scams (e.g. phishing simulations)?

Clause 7.2 · Control A.6.3

When someone joins, changes roles or leaves, is access granted or revoked promptly following a standard checklist?

Control A.6.5 · Offboarding

Are work environments (office or remote) safeguarded against physical compromise — screen locks, clean desk, badges?

Controls A.7.7, A.6.7

3Core Technical & Data Controls

Is MFA required across critical platforms, and is privileged access strictly restricted to those who need it?

Controls A.8.2, A.8.5

Are company endpoints centrally managed, encrypted, running EDR and receiving timely OS / software updates?

Controls A.8.1, A.8.8

Do teams know what data is confidential, and are basic safeguards (encryption, restricted sharing) applied when handling it?

Controls A.5.12, A.8.12

4Operations, Vendors & Resilience

Before adopting a new SaaS tool or vendor, is there a standard review of their security posture and contract terms?

Controls A.5.19, A.5.23

Are critical systems backed up automatically, and has restoration actually been tested within the last 12 months?

Control A.8.13 · Backup

If a breach, ransomware attack or leak happened right now, does your team know exactly who to notify within 30 minutes?

Control A.5.24 · Incident Response

Bridging the gap to full assurance

From self-assessment to audit-ready compliance

The SAQ shows where you stand directionally. Formal regulatory comfort or certification needs hands-on gap closure, evidence and independent assurance — that is where Open Security Alliance steps in.

01 / Diagnostic

Full Regulatory & ISO Gap Assessment

Evidence-backed evaluation across every clause and control, with a Statement of Applicability and remediation roadmap.

02 / Audit Defense

Pre-Audit Readiness & CERT-In Audits

Mock inspections, VAPT, configuration reviews and annual cyber security audits for licensed entities.

03 / Governance

Board Advisory, CISO Reporting & Policies

Board-approved IT & cyber policies, ITSC agendas, CISO dashboards and escrow operating SOPs.

04 / Contracts

Vendor Contract Remediation

Clause-by-clause MSA review to add right-to-audit, sub-contracting and data-localisation safeguards.

Confidential discovery session

Unsure how regulators will read your gaps?

Book a 30-minute session with a principal consultant to review your SAQ results under a mutual NDA.