ISO/IEC 27001 readiness checklist

Auditors expect a list of stakeholders (customers, regulators, suppliers, staff) and which of their requirements, including legal and contractual ones, the ISMS addresses.

Amendment 1 of February 2024 adds to clause 4.1 that the organization shall determine whether climate change is a relevant issue, and a note to 4.2 that relevant interested parties can have requirements related to climate change. Auditors check that the decision is made and recorded, even when the answer is no.

The scope statement names the locations, business units, systems and services covered and justifies exclusions. It appears on the certificate, so it must be precise.

The policy must include or frame security objectives and a commitment to continual improvement, and be communicated internally. Auditors interview top management directly.

Someone must be responsible for ISMS conformity and for reporting its performance to top management. Typically shown in a RACI or role descriptions.

Repeated assessments must produce consistent, valid and comparable results. Keep the assessment results as documented information.

For each risk choose treatment options and the controls needed, then compare them against Annex A to make sure nothing necessary was overlooked.

For each control state whether it is included, the justification for inclusion or exclusion, and whether it is implemented. Auditors use the SoA to plan their sampling.

Objectives must be consistent with the policy, monitored and updated. Examples: patch latency targets or training completion rates.

Staff must know the policy, their contribution and the consequences of non-conformity. Auditors may ask random employees about this.

Documents must be identifiable, reviewed and protected, and external documents relevant to the ISMS must be identified and controlled too.

Auditors look for evidence that planned changes and externally provided processes are controlled and that risk records are current, not a one-off exercise.

Metrics should feed the evaluation of ISMS performance and effectiveness, not just exist on a dashboard.

Keep the audit programme, reports and findings. Auditors must not audit their own work.

Inputs include audit results, nonconformities, risk status, objectives, interested party changes and improvement opportunities. Outputs are decisions and actions.

A corrective action log with evidence of closure shows continual improvement in practice.

New in 2022 (A.5.7 Threat intelligence). Evidence can be subscribed feeds, CERT advisories and records of resulting actions.

Auditors check least privilege, joiner/mover/leaver handling and periodic access reviews (see also A.5.16 to A.5.18).

Covers shared responsibility, provider security requirements and exit strategy for each cloud service in scope.

Auditors want a documented procedure, defined roles and records of real or exercised incidents. A.6.8 covers event reporting by staff.

Recovery objectives should come from a business impact analysis, and failover or restore tests must be recorded.

Keep completion records and adapt content to roles. Screening (A.6.1) and terms of employment (A.6.2) complete the onboarding evidence.

Typically alarms, CCTV or guards with retained logs. For fully remote or cloud-hosted setups, document how this applies to offices and providers.

Auditors sample scan reports and compare remediation dates against your own policy timeframes.

New in 2022. Hardening baselines, infrastructure as code and drift detection are common evidence.

New in 2022. Does not require a DLP product: classification, egress controls and email or USB restrictions can be sufficient if risk-based.

Auditors ask for backup scope, retention, protection of copies and dated restore test records.

New in 2022. Show alerting rules, who responds and examples of triaged alerts, building on logging (A.8.15).

New in 2022. Evidence includes coding guidelines, review records and static analysis in the pipeline (see also A.8.25 to A.8.29).