ISO 27001 internal audit checklist

Has the organisation identified the internal and external issues relevant to its purpose that affect its ability to achieve the intended outcomes of the ISMS?

Evidence: Context analysis with review date, covering threat landscape, regulation, technology and business model

Has the organisation decided whether climate change is a relevant issue for its ISMS (for example physical risks to data centres or service continuity), and recorded the reasoning?

Evidence: Context analysis naming climate change and the conclusion; link to risk assessment where relevant

Are interested parties relevant to the ISMS identified with their requirements, including climate-related ones, and is it decided which of these requirements the ISMS will address?

Evidence: Interested parties register: customers, regulators, data subjects, suppliers, owners; requirements mapped to the ISMS

Is the ISMS scope documented, considering the issues, requirements, and the interfaces and dependencies between the organisation's activities and those performed by others?

Evidence: Scope statement with locations, assets, processes, and interfaces such as cloud providers; certificate scope

Is the ISMS established with the processes needed and their interactions, and does it run in practice as described?

Evidence: ISMS manual or process map; sample of records from each process

Can top management show that the information security policy and objectives fit the strategic direction, that ISMS requirements are integrated into business processes, that resources are available, and that they direct and support people to contribute?

Evidence: Interview with top management; security steering committee minutes; security budget

Is there a policy appropriate to the organisation's purpose that gives a framework for objectives and commits to meeting applicable requirements and to continual improvement, documented, communicated and available to interested parties as appropriate?

Evidence: Approved, dated policy; communication records; publication to staff

Are responsibilities and authorities for roles relevant to information security assigned and communicated, including who makes sure the ISMS conforms and who reports on its performance to top management?

Evidence: Organisation chart; CISO or ISMS manager appointment; RACI

When planning the ISMS, has the organisation considered its context and interested parties and determined the risks and opportunities to address, with actions planned and evaluated?

Evidence: ISMS risk and opportunity register; action plans

Is there a defined risk assessment process with risk acceptance criteria and criteria for performing assessments, producing consistent, valid and comparable results, identifying risks to confidentiality, integrity and availability with named risk owners?

Evidence: Risk assessment methodology; acceptance criteria; risk register with owners, likelihood and impact

Are the potential consequences and realistic likelihood of each risk assessed, risk levels determined, and risks compared with the criteria and prioritised for treatment?

Evidence: Completed risk assessment with ratings and prioritisation; date of last full assessment

Have treatment options been chosen, the necessary controls determined and compared with Annex A to make sure none has been overlooked, and is there a risk treatment plan approved by risk owners, who also accept the residual risks?

Evidence: Risk treatment plan; risk owner approval and acceptance of residual risk

Is there a Statement of Applicability listing the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A control?

Evidence: Current, approved Statement of Applicability matching the risk treatment plan

Are information security objectives set at relevant functions and levels, consistent with the policy, measurable where practicable, monitored, communicated and updated, with plans stating what, who, when, resources and how results are evaluated?

Evidence: Objectives register with targets and current results; action plans

When changes to the ISMS are needed, are they carried out in a planned manner?

Evidence: ISMS change records; plans for scope or structure changes

Are the resources needed for the ISMS determined and provided?

Evidence: Security budget; staffing; tooling

Are competence needs defined for people whose work affects information security performance, are they competent, and is the effectiveness of training or other actions evaluated?

Evidence: Competence matrix; certifications; training records

Are people aware of the policy, their contribution to the ISMS and the implications of not conforming?

Evidence: Staff interviews; awareness campaign records; phishing simulation results

Has the organisation decided what to communicate about information security, when, with whom and how?

Evidence: Communication plan; security bulletins; customer and regulator communications

Does the ISMS include the documented information the standard requires and what the organisation needs, properly identified, reviewed and approved, available where needed, protected, and controlled for distribution, changes and retention?

Evidence: Document register; version control; access permissions on the document repository

Are processes needed to meet requirements and carry out the planned actions defined with criteria and controlled, are planned changes controlled and unintended changes reviewed, and are externally provided processes, products and services relevant to the ISMS controlled?

Evidence: Operating procedures; change records; supplier controls

Are information security risk assessments carried out at planned intervals and when significant changes are proposed or occur, with results retained?

Evidence: Dated risk assessments; assessments triggered by changes such as a cloud migration

Is the risk treatment plan being implemented, with results of risk treatment retained?

Evidence: Treatment plan progress; evidence that planned controls are in place

Has the organisation decided what to monitor and measure, including security processes and controls, with methods that give comparable and reproducible results, who does it, when, and who analyses the results?

Evidence: Security metrics; dashboards; monitoring schedule

Are internal audits carried out at planned intervals under a programme that considers process importance and previous results, with defined criteria and scope, objective and impartial auditors, and results reported to management?

Evidence: Audit programme covering clauses and Annex A controls over the cycle; audit reports; auditor independence

Does top management review the ISMS at planned intervals, considering previous actions, changes in issues and interested-party needs, nonconformities, monitoring and audit results, achievement of objectives, interested-party feedback, risk assessment results, the treatment plan status and improvement opportunities?

Evidence: Management review minutes checked against each required input

Do the outputs include decisions on continual improvement opportunities and any need for changes to the ISMS, with the results retained?

Evidence: Minutes with decisions, owners and dates

Does the organisation continually improve the suitability, adequacy and effectiveness of the ISMS?

Evidence: Improvement trends; management review decisions implemented

When a nonconformity occurs, does the organisation react, find the root cause, check for similar cases, take action, review its effectiveness and change the ISMS where needed, with records retained?

Evidence: Corrective action log with root cause and effectiveness review

Is there an approved information security policy supported by topic-specific policies, communicated to staff and relevant parties, and reviewed at planned intervals and after significant changes?

Evidence: Policy set with approval and review dates; acknowledgement records

Are information security roles and responsibilities defined and allocated according to the organisation's needs?

Evidence: Role descriptions; asset and risk owner assignments

Are conflicting duties and areas of responsibility separated, for example requesting, approving and implementing access or payments?

Evidence: Segregation matrix; sample of access requests showing different requester and approver

Does management require all personnel to apply information security in line with the policies and procedures?

Evidence: Manager briefings; performance objectives including security; enforcement records

Is contact with relevant authorities (regulators, law enforcement, data protection authority, cyber security agency) established and maintained?

Evidence: Contact list with named authorities; records of notifications

Does the organisation maintain contact with security forums, professional associations or information sharing groups?

Evidence: Memberships; advisories received and acted on

Is information about threats collected and analysed to produce threat intelligence that feeds risk assessment and controls?

Evidence: Threat feeds; threat intelligence reports; resulting actions

Is information security built into project management, with security requirements and risks addressed from the start of each project?

Evidence: Project methodology with security gates; sample project risk assessments

Is there an accurate, up-to-date inventory of information and other associated assets, with an owner for each?

Evidence: Asset register with owners; reconciliation with discovery tools

Are rules for the acceptable use and handling of information and assets identified, documented and implemented?

Evidence: Acceptable use policy; signed acknowledgements

Do personnel and other parties return the organisation's assets when their employment, contract or agreement changes or ends?

Evidence: Leaver checklists; asset return records for a sample of leavers

Is information classified according to confidentiality, integrity, availability and interested-party requirements?

Evidence: Classification scheme; classified sample documents and systems

Are procedures in place for labelling information in line with the classification scheme, and are they followed?

Evidence: Labelling procedure; document headers and email labels in practice

Are rules, procedures or agreements in place for all types of information transfer, internal and external, by electronic, physical and verbal means?

Evidence: Transfer policy; secure file transfer tools; data sharing agreements

Are rules for physical and logical access to information and assets set and implemented based on business and security requirements?

Evidence: Access control policy; role-based access model

Is the full life cycle of identities managed, with unique identities and shared accounts only where justified and approved?

Evidence: Joiner, mover, leaver process; identity records; justification for shared accounts

Is the allocation and management of authentication information (passwords, tokens, keys) controlled, including advice to users on handling it?

Evidence: Password policy; secure issuance process; secrets vault

Are access rights provided, reviewed at regular intervals, modified and removed in line with the access control policy?

Evidence: Access reviews with sign-off; removal of leaver access within a defined time

Are processes in place to manage the security risks of using suppliers' products and services?

Evidence: Supplier security policy; supplier risk assessments

Are relevant security requirements agreed with each supplier according to the type of relationship?

Evidence: Contracts with security, confidentiality, audit and breach notification clauses

Are security risks in the ICT products and services supply chain managed?

Evidence: Requirements flowed down to sub-suppliers; software provenance checks

Does the organisation monitor, review, evaluate and manage changes in suppliers' security practices and service delivery?

Evidence: Supplier reviews; SOC 2 or ISO 27001 reports from suppliers; service reports

Are the processes for acquiring, using, managing and exiting cloud services set according to the organisation's security requirements?

Evidence: Cloud policy; shared responsibility mapping; exit plans

Is incident management planned, with processes, roles and responsibilities defined and communicated?

Evidence: Incident response plan; on-call roster; contact lists

Are security events assessed and a decision made on whether to categorise them as incidents?

Evidence: Triage criteria; event log with classification decisions

Are incidents responded to in line with the documented procedures?

Evidence: Incident records showing containment, eradication and recovery steps followed

Is knowledge gained from incidents used to strengthen and improve controls?

Evidence: Post-incident reviews; resulting control changes

Are procedures in place for identifying, collecting, acquiring and preserving evidence related to security events?

Evidence: Forensic procedure; chain of custody forms

Has the organisation planned how to maintain information security at an appropriate level during disruption?

Evidence: Continuity plans that address security controls in degraded or alternate operation

Is ICT readiness planned, implemented, maintained and tested against business continuity objectives and requirements?

Evidence: Business impact analysis; recovery time and point objectives; disaster recovery test results

Are legal, statutory, regulatory and contractual requirements relevant to information security identified, documented, kept up to date, and is the approach to meeting them defined?

Evidence: Legal and regulatory register (data protection, sector rules, cryptography export rules)

Are procedures in place to protect intellectual property rights, including software licensing?

Evidence: Licence register; software asset management reports

Are records protected from loss, destruction, falsification, unauthorised access and unauthorised release?

Evidence: Records retention schedule; access controls and backups for records

Does the organisation identify and meet requirements for preserving privacy and protecting personally identifiable information under applicable laws, regulations and contracts?

Evidence: Privacy policy; records of processing; data protection impact assessments

Is the organisation's approach to managing information security reviewed independently at planned intervals or when significant changes occur?

Evidence: Independent review or external audit reports; follow-up actions

Is compliance with the security policy, topic-specific policies, rules and standards regularly reviewed?

Evidence: Compliance checks; configuration compliance scans; management reviews of compliance

Are operating procedures for information processing facilities documented and available to the personnel who need them?

Evidence: Runbooks; standard operating procedures with version control

Are background verification checks carried out on candidates before joining and on an ongoing basis, proportionate to legal requirements, business needs, the classification of information accessed and the risks?

Evidence: Screening policy; screening records for a sample of recent joiners

Do employment contracts state the personnel's and the organisation's responsibilities for information security?

Evidence: Contract templates with security clauses; signed contracts

Do personnel and relevant interested parties receive appropriate security awareness, education and training, with regular updates relevant to their job?

Evidence: Training plan; completion rates; role-based training for administrators and developers

Is there a formal, communicated disciplinary process for personnel who breach the information security policy?

Evidence: Disciplinary procedure referencing security breaches; records of use

Are security responsibilities that remain valid after termination or change of employment defined, enforced and communicated?

Evidence: Exit interview forms; continuing confidentiality reminders

Are confidentiality or non-disclosure agreements that reflect the organisation's needs identified, documented, regularly reviewed and signed by personnel and other relevant parties?

Evidence: NDA templates with review date; signed NDAs for staff and contractors

Are security measures in place for personnel working remotely to protect information accessed, processed or stored outside the organisation's premises?

Evidence: Remote working policy; VPN or zero trust access; device controls

Is there a mechanism for personnel to report observed or suspected security events promptly through appropriate channels?

Evidence: Reporting channel; staff interviews; volume of reports received

Are security perimeters defined and used to protect areas containing information and other associated assets?

Evidence: Site plans showing zones; perimeter walls, doors and barriers on inspection

Are secure areas protected by entry controls and access points?

Evidence: Badge access logs; visitor records; access reviews for secure areas

Is physical security for offices, rooms and facilities designed and implemented?

Evidence: Site inspection; locked server and communications rooms

Are premises continuously monitored for unauthorised physical access?

Evidence: CCTV coverage and retention; intrusion alarms; guard patrol logs

Is protection against physical and environmental threats, such as natural disasters, fire, flooding and other intentional or unintentional threats, designed and implemented?

Evidence: Fire suppression; water detection; site risk assessment

Are security measures for working in secure areas designed and implemented?

Evidence: Secure area rules; escort procedures; no photography signage

Are clear desk rules for papers and removable media and clear screen rules for processing facilities defined and enforced?

Evidence: Policy; walk-round checks after hours; screen lock settings

Is equipment sited securely and protected?

Evidence: Inspection of equipment placement; screens not visible to the public

Are off-site assets protected?

Evidence: Off-site asset register; laptop encryption; rules for equipment taken home

Is storage media managed through its life cycle of acquisition, use, transport and disposal in line with the classification scheme and handling rules?

Evidence: Media handling procedure; USB controls; media disposal records

Are processing facilities protected from power failures and other disruptions caused by failures in supporting utilities?

Evidence: UPS and generator test records; cooling redundancy

Are cables carrying power, data or supporting services protected from interception, interference or damage?

Evidence: Cable routing inspection; locked patch panels

Is equipment maintained correctly to ensure the availability, integrity and confidentiality of information?

Evidence: Maintenance schedules and records; supervised third-party maintenance

Are items of equipment containing storage media checked so that sensitive data and licensed software are removed or securely overwritten before disposal or re-use?

Evidence: Disposal records; data wiping or destruction certificates

Is information stored on, processed by or accessible through user endpoint devices protected?

Evidence: Endpoint policy; device management console; encryption and patch status

Is the allocation and use of privileged access rights restricted and managed?

Evidence: Privileged account list; approvals; privileged access management tool logs

Is access to information and other associated assets restricted in line with the access control policy?

Evidence: Access permissions on sample systems and shares

Is read and write access to source code, development tools and software libraries appropriately managed?

Evidence: Repository permissions; branch protection; access reviews

Are secure authentication technologies and procedures in place according to access restrictions and the access control policy, for example multi-factor authentication?

Evidence: MFA coverage reports; authentication configuration

Is the use of resources monitored and adjusted in line with current and expected capacity requirements?

Evidence: Capacity reports; alert thresholds; capacity plans

Is protection against malware implemented and supported by appropriate user awareness?

Evidence: Anti-malware or EDR coverage; detection logs; awareness content

Is information about technical vulnerabilities obtained, the organisation's exposure evaluated and appropriate measures taken?

Evidence: Vulnerability scans; patch timelines against policy; penetration test results

Are configurations, including security configurations, of hardware, software, services and networks established, documented, implemented, monitored and reviewed?

Evidence: Hardening baselines; configuration management database; drift reports

Is information stored in systems and devices deleted when no longer required?

Evidence: Retention and deletion rules; deletion logs

Is data masking used in line with the access control policy, business requirements and legal requirements?

Evidence: Masking rules; masked data in test and reporting environments

Are data leakage prevention measures applied to systems, networks and devices that process, store or transmit sensitive information?

Evidence: DLP policies and alerts; email and endpoint controls

Are backup copies of information, software and systems maintained and regularly tested in line with an agreed backup policy?

Evidence: Backup policy; job reports; restore test records

Are information processing facilities implemented with enough redundancy to meet availability requirements?

Evidence: Architecture diagrams; failover tests

Are logs that record activities, exceptions, faults and other relevant events produced, stored, protected and analysed?

Evidence: Logging standard; SIEM sources; log retention and integrity protection

Are networks, systems and applications monitored for anomalous behaviour, with action taken to evaluate potential incidents?

Evidence: Monitoring use cases; alert handling records; security operations reports

Are the clocks of information processing systems synchronised to approved time sources?

Evidence: NTP configuration; time source settings on sample systems

Is the use of utility programs that can override system and application controls restricted and tightly controlled?

Evidence: List of permitted utilities; restrictions and usage logs

Are procedures and measures in place to securely manage software installation on operational systems?

Evidence: Application allow-listing; installation rights; change records

Are networks and network devices secured, managed and controlled to protect information in systems and applications?

Evidence: Network diagrams; firewall rule reviews; device hardening

Are security mechanisms, service levels and service requirements of network services identified, implemented and monitored?

Evidence: Network service agreements; monitoring of provider performance

Are groups of information services, users and systems segregated in the organisation's networks?

Evidence: VLAN or segmentation design; guest network separation; test of segmentation

Is access to external websites managed to reduce exposure to malicious content?

Evidence: Web filtering policy and categories blocked; logs

Are rules for the effective use of cryptography, including cryptographic key management, defined and implemented?

Evidence: Cryptography policy; encryption at rest and in transit; key management records

Are rules for the secure development of software and systems established and applied?

Evidence: Secure development policy; SDLC with security activities at each stage

Are information security requirements identified, specified and approved when developing or acquiring applications?

Evidence: Requirements documents with security requirements; approval records

Are principles for engineering secure systems established, documented, maintained and applied to development activities?

Evidence: Architecture principles; design reviews; threat models

Are secure coding principles applied to software development?

Evidence: Coding standards; static analysis results; peer review records

Are security testing processes defined and carried out in the development life cycle and at acceptance?

Evidence: Security test plans; DAST or penetration test results before release

Does the organisation direct, monitor and review activities related to outsourced system development?

Evidence: Development contracts with security requirements; code review of supplier deliveries

Are development, testing and production environments separated and secured?

Evidence: Environment architecture; access rights per environment

Are changes to information processing facilities and systems subject to change management procedures?

Evidence: Change records with risk assessment, approval, testing and rollback plans

Is test information appropriately selected, protected and managed?

Evidence: Rules on use of production data in testing; approvals; masked test data

Are audit tests and other assurance activities involving operational systems planned and agreed between the tester and appropriate management?

Evidence: Agreed scope and timing for audits and penetration tests; read-only access for auditors