Free resource
The ISAREADY Readiness Checklist
34 items across 9 themes. Each one pairs an activity with the record that would normally demonstrate it happened — which is the column most checklists leave out, and the one that decides how the final month of preparation feels.
Organised by theme, so you can hand each section to its owner
Every activity paired with its expected evidence
Original ISAREADY content — no reproduction of official questionnaires
Printable PDF with checkboxes
What is inside
Scope and governance
4 itemsEstablish what is covered and who is accountable, before anything else.
Example evidence: Approved scope statement with a version and approval date.
Policy baseline
3 itemsMake expectations explicit, current and reachable by the people they apply to.
Example evidence: Policy documents with owner, version, approval and next review date.
Risk management
4 itemsMake risk decisions repeatable, owned and revisited.
Example evidence: Risk methodology document.
Assets and access
5 itemsKnow what you hold and control who can reach it.
Example evidence: Inventory export with an "as at" date.
People and awareness
2 itemsMake sure the expectations reach the people who have to meet them.
Example evidence: Training material plus participation records by individual.
Operations and incidents
4 itemsRun the controls, and handle it properly when something goes wrong.
Example evidence: Communicated procedure plus evidence it was communicated.
Supplier and third-party security
4 itemsExtend the same expectations to anyone who handles information in scope.
Example evidence: Third-party register with criticality tiering.
Evidence readiness
4 itemsThe theme that decides how the whole preparation feels in its final month.
Example evidence: Evidence map linking activity → record → owner → location.
Internal verification and improvement
4 itemsCheck yourself against your own rules before anyone external does.
Example evidence: Audit programme, checklists and audit reports.
How to use it
Do not work through it alone. The checklist is most useful as a distribution device: split it by theme, give each theme to the person who actually owns that activity, and ask them two questions — does this happen, and could you produce the record.
The second question is the one that generates real findings. It is common for the first answer to be yes and the second to be “probably, give me a few days”. That gap is the work.
ISAREADY recommendation The checklist is ISAREADY guidance on what typically demonstrates each activity. It is not a list of official requirements, and it does not replace the official framework documentation.
If you would rather have this scored, the free self-assessment covers the same themes and returns a readiness indicator with prioritised next steps.
Frequently asked questions
Is this the official ISA questionnaire?
Do I have to give my email address?
Why does every item have an "evidence" line?
See where you actually stand
The checklist tells you what to look for. The free self-assessment tells you how you score against it, which themes to prioritise, and what to do next.