21RISK - ISO 27001

1 Introduction

Welcome to the audit process for ISO 27001 compliance, the international standard for Information Security Management Systems (ISMS). Your role as the auditor is crucial in assessing organizations' adherence to ISO 27001 requirements, ensuring the protection of information assets.

ISO 27001 provides a systematic approach to managing sensitive information and mitigating information security risks. This audit checklist is designed to evaluate an organization's ISMS effectiveness, covering policies, risk management, staff awareness, access control, incident response, and monitoring.

Your expertise as the auditor will help identify vulnerabilities, provide recommendations, and enhance information security practices. Stay objective, impartial, and maintain confidentiality throughout the process.

Thank you for your commitment to promoting information security and ensuring ISO 27001 compliance. Together, we can strengthen organizations' ability to protect valuable information assets and establish resilient security frameworks.

5 Management direction for information security

5.1

5.1.1 Policies for information security

5.1.1.1

These include policies like the high-level Information Security policy, Third Party Risk management policy, Network Security policy, Secure Software Lifecycle Development policy, and any other policy mentioned throughout the clauses and also that form part of the Annex A list of controls.

Does the organization have Information Security policies?

5.1.1.2

These include formal approval which should reflect in the document version control and revision section.

Have all Information Security policies been approved by management and are reflected in the policy documents?

5.1.1.3

These include posting policies on the company portal (if available) or sending out mailer communications.

Have the Information Security policies been properly communicated to employees?

5.1.2 Review of the policies for information security

5.1.2.1

These include formal approval which should reflect in the document version control and revision section.

Are Information Security policies policies subject to review?

5.1.2.2

This can be a periodic interval determined by the organization but at a minimum, yearly is required.

Are the reviews of the Information Security policies conducted at regular intervals?

5.1.2.3

An example of a major change could be the migration of on-premises servers to a public cloud. An example of a minor change could be the introduction of a new configuration management system that changes the existing workflow.

Are reviews of the Information Security policies conducted when significant changes occur?

6 Organisation of information security

6.1 Internal Organisation

6.1.1 Information security roles and responsibilities

6.1.1.1

Some examples of roles and responsibilities include Chief Information Security Officer (CISO), Security Analyst, Security Engineer, and their daily tasks.

Are responsibilities for the protection of company assets, and for carrying out specific security responsibilities clearly identified, defined and communicated to all relevant stakeholders?

6.1.2 Segregation of duties

6.1.2.1

This is a very important Security concept that aims at ensuring that no single person has power enough to cause havoc. For example, A Firewall Administrator should not be allowed to create his/her own account, assign permissions and also approve them. More information can be found in this article.

Is Segregation of Duties enforced, maintained and monitored, in order to reduce opportunities for unauthorized modification or misuse of information, or services?

6.1.3 Contact with authorities

6.1.3.1

There should be a process in place to report incidents when needed to local authorities including law enforcement. Sometimes these may be required by local laws and regulations. The processes should be documented.

Is there a procedure documenting under what circumstances, and by whom, contact with relevant authorities (law enforcement, special interest groups, etc.) will be made?

6.1.3.2

There should be a process in place to report incidents when needed to local authorities including law enforcement. Sometimes these may be required by local laws and regulations. The processes should be documented.

Is there a process for regular contact and threat intelligence sharing with relevant authorities?

6.1.4 Contact with special interest groups

6.1.4.1

Security Professionals can do so by registering at the local ISC2 or ISACA chapters for example.

Do relevant individuals within the organization maintain active membership in relevant special interest groups?

6.1.5 Information security in project management

6.1.5.1

Think of this as an Information Security Risk Assessment for any new projects. For example, imagine a business team is planning to develop an in-house tool to accomplish a specific business objective, so it becomes important to understand the security risks from a Secure Software Development Lifecycle (SSDLC) perspective and the organization could have standard checklists for these assessments.

Do all projects go through some form of information security risk assessment identifying areas of vulnerabilities and identifying mitigation actions?

6.2 Mobile devices and teleworking

6.2.1 Mobile device policy

6.2.1.1

This is typically applicable to companies issuing handheld devices to employees or allowing employees to bring their own devices and connect to the company network. Device Security becomes an important component then and some solutions that can help with that are Mobile Device Management solutions.

Does the company have a mobile device policy?

6.2.1.2

These include formal approval which should reflect in the document version control and revision section.

Is the mobile device policy approved by management and is reflected in the policy documents?

6.2.2 Teleworking

6.2.2.1

Teleworking refers to working from anywhere which is very prevalent today in the hybrid way of working.

Is there a policy for teleworking/remote working?

6.2.2.2

These include formal approval which should reflect in the document version control and revision section.

Is the teleworking/remote working policy approved by management and reflected in the policy documents?

6.2.2.3

This typically is part of a procedural document as part of the organization's Identity and Access Management (IAM) strategy and should detail how employees are granted access from outside of the organization's network to inside to access corporate or production applications. E.g. Procedures regarding how employees have to log in to a VPN solution in order to access the organization's internal network.

Is there a defined process for teleworkers to get access to company resources?

6.2.2.4

This should form part of a Security Awareness training.

Are teleworkers given sufficient training, tools and techniques to protect their assets?

7 Human resources security

7.1 Prior to employment

7.1.1 Screening

7.1.1.1

Background verification checks include criminal background checks, educational background checks, etc.

Are employee background screening or verification checks carried out on all new candidates prior to employment?

7.1.1.2

Typically this sits within the HR function but organizations are free to appoint appropriate management authority. The 27001 standard gives that flexibility to organizations.

Are these employee background screening or verification checks approved by appropriate management authority, and is reflected as part of a background screening policy?

7.1.1.3

This is more for the Legal department to check the compliance of the background checks. For example, in certain countries, conducting a criminal background check against somebody might not be allowed by local laws.

Are the checks employee background screening or verification checks compliant with relevant laws, regulations and ethics?

7.1.1.4

This can be tied to the business risk of not complying with 27001 which may result in loss of customers, loss of reputation, etc.

Is the level of checks commensurate with what is actually required for mitigating the organization's risks that may originate from the lack of a screening process?

7.1.2 Terms and conditions of employment

7.1.2.1

Are all employees, contractors and third-party users asked to sign confidentiality and non-disclosure agreements detailing all important clauses about protecting company information, maintaining confidentiality, etc.?

7.1.2.2

Do employment/service contracts specifically cover the need to maintain the confidentiality, integrity and availability of the organization's information?

7.2 During employment

7.2.1 Management responsibilities

7.2.1.1

Security is everyone's responsibility. Some organizations make this part of Manager's job responsibilities to drive security-related conversations in everyday work.

Are managers (not limited to Information Security Managers) involved in raising awareness and propagating a security culture within the business?

7.2.1.2

Do senior management behavior and policy motivate and drive all employees, contractors and any other users to follow and apply the Information Security principles and practices in accordance with established policies and procedures?

7.2.2 Information security awareness, education and training

7.2.2.1

Do all employees, contractors and any other users undergo periodic security awareness training appropriate to their roles and functions within the organization?

7.2.3 Disciplinary process

7.2.3.1

Has the organization established a formal disciplinary process that allows the organization to take action against employees who have violated an information security policy (which may or may not result in a breach)?

7.2.3.2

Is this disciplinary process communicated to all employees?

7.3 Termination and change of employment

7.3.1 Termination or change of employment responsibilities

7.3.1.1

This typically is a combination of HR-related processes and Identity and Access Management (IAM) procedures. For e.g.

1) Are User IDs immediately disabled upon termination

2) Are rights and permissions for the existing role removed (if no longer required) if the employee switches roles etc?

Does the organization have a documented process for terminating employees, contractors or any other user and a documented process for change of employment duties (e.g. changing roles within departments)?

7.3.1.2

This can be part of a Non-Disclosure Agreement Clause or an electronic acknowledgment of having read the Information Security Policy.

Are those policies and processes communicated to the employee or contractor?

7.3.1.3

Some examples include automated Identity and Access Management solutions to enforce the principle of least privilege giving employees only the rights they need to perform their jobs.

Does the organization have processes in place to enforce compliance with those policies and processes?

8 Asset management

8.1 Responsibility for assets

8.1.1 Inventory of assets

8.1.1.1

This could be an automated inventory like Service Now or a spreadsheet (which might not work for bigger organizations with lots of assets). Also, assets here refer to all software and hardware assets.

Does the organization have an inventory of all assets used for information processing including hardware, software and any other assets?

8.1.1.2

This could be an automated inventory like Service Now or a spreadsheet (which might not work for bigger organizations with lots of assets). Also, assets here refer to all software and hardware assets.

Are there either manual or automated processes and procedures to keep the asset inventory accurate and up to date?

8.1.2 Ownership of assets

8.1.2.1

Also referred to as an Asset Owner, all Software and Hardware Assets must have ownership. This is important to be able to mitigate any Information Security risks.

Do all information assets have clearly defined ownership and responsibilities?

8.1.3 Acceptable use of assets

8.1.3.1

An Acceptable Use Policy (AUP) typically describes the policies around how an organization's assets should be handled and the DOs and DONTs. Just like any other policies, these could be posted on the company intranet or through internal mailer campaigns.

Does the organization have an Acceptable Use Policy (AUP) that defines how the information assets should be used and handled?

8.1.3.2

An Acceptable Use Policy (AUP) typically describes the policies around how an organization's assets should be handled and the DOs and DONTs. Just like any other policies, these could be posted on the company intranet or through internal mailer campaigns.

Are users made aware of the AUP prior to using the organization's assets?

8.1.4 Return of assets

8.1.4.1

Is there a process in place to ensure all employees and external users return the organization's assets on termination of their employment, contract or agreement?

8.2 Information classification

8.2.1 Classification of information

8.2.1.1

Information Classification is necessary to understand the criticality of data to the organization as data, after human resources, is the most valuable asset for an organization. Appropriate Security controls can be applied only if the classification of data is known. Data classified as "public" might not require the same level of controls as data classified as "confidential".

Does the organization have an Information Classification policy that details how information should be classified based on the sensitivity of that information?

8.2.1.2

This should be a documented policy detailing what are the different types of data processed by the organization and what are their clarification criteria. For example, a Credit Card might be classified as confidential whereas the company careers page might have to be classified as "public".

Does the organization have either automated or manual processes by which all information can be appropriately classified as defined by the policy?

8.2.2 Labelling of information

8.2.2.1

This could be an automated process where software could be utilized to automatically assign labels to files and documents or it can be a manual process where employees assign classification labels based on the company's classification criteria.

Does the organization have processes and procedures for ensuring information classification is appropriately marked on each asset type?

8.2.3 Handling of assets

8.2.3.1

There should be procedures for handling data belonging to different classification types. For example, "confidential data" may mandatorily need encryption controls but data classified as "public" may not.