ISO 27001 is the international standard for information security management. This checklist will help you get started with your ISO 27001 compliance journey.

1 Introduction

Welcome to the audit process for ISO 27001 compliance, the international standard for Information Security Management Systems (ISMS). Your role as the auditor is crucial in assessing organizations' adherence to ISO 27001 requirements, ensuring the protection of information assets.

ISO 27001 provides a systematic approach to managing sensitive information and mitigating information security risks. This audit checklist is designed to evaluate an organization's ISMS effectiveness, covering policies, risk management, staff awareness, access control, incident response, and monitoring.

Your expertise as the auditor will help identify vulnerabilities, provide recommendations, and enhance information security practices. Stay objective, impartial, and maintain confidentiality throughout the process.

Thank you for your commitment to promoting information security and ensuring ISO 27001 compliance. Together, we can strengthen organizations' ability to protect valuable information assets and establish resilient security frameworks.

5 Management direction for information security
5.1
5.1.1 Policies for information security

These include policies like the high-level Information Security policy, Third Party Risk management policy, Network Security policy, Secure Software Lifecycle Development policy, and any other policy mentioned throughout the clauses and also that form part of the Annex A list of controls.


These include formal approval which should reflect in the document version control and revision section.


These include posting policies on the company portal (if available) or sending out mailer communications.


5.1.2 Review of the policies for information security

These include formal approval which should reflect in the document version control and revision section.


This can be a periodic interval determined by the organization but at a minimum, yearly is required.


An example of a major change could be the migration of on-premises servers to a public cloud. An example of a minor change could be the introduction of a new configuration management system that changes the existing workflow.


6 Organisation of information security


6.1 Internal Organisation


6.1.1 Information security roles and responsibilities


Some examples of roles and responsibilities include Chief Information Security Officer (CISO), Security Analyst, Security Engineer, and their daily tasks.


6.1.2 Segregation of duties


This is a very important Security concept that aims at ensuring that no single person has power enough to cause havoc. For example, A Firewall Administrator should not be allowed to create his/her own account, assign permissions and also approve them. More information can be found in this article.


6.1.3 Contact with authorities


There should be a process in place to report incidents when needed to local authorities including law enforcement. Sometimes these may be required by local laws and regulations. The processes should be documented.


There should be a process in place to report incidents when needed to local authorities including law enforcement. Sometimes these may be required by local laws and regulations. The processes should be documented.


6.1.4 Contact with special interest groups


Security Professionals can do so by registering at the local ISC2 or ISACA chapters for example.


6.1.5 Information security in project management


Think of this as an Information Security Risk Assessment for any new projects. For example, imagine a business team is planning to develop an in-house tool to accomplish a specific business objective, so it becomes important to understand the security risks from a Secure Software Development Lifecycle (SSDLC) perspective and the organization could have standard checklists for these assessments.


6.2 Mobile devices and teleworking


6.2.1 Mobile device policy


This is typically applicable to companies issuing handheld devices to employees or allowing employees to bring their own devices and connect to the company network. Device Security becomes an important component then and some solutions that can help with that are Mobile Device Management solutions.


These include formal approval which should reflect in the document version control and revision section.


6.2.2 Teleworking


Teleworking refers to working from anywhere which is very prevalent today in the hybrid way of working.


These include formal approval which should reflect in the document version control and revision section.


This typically is part of a procedural document as part of the organization's Identity and Access Management (IAM) strategy and should detail how employees are granted access from outside of the organization's network to inside to access corporate or production applications. E.g. Procedures regarding how employees have to log in to a VPN solution in order to access the organization's internal network.


This should form part of a Security Awareness training.


7 Human resources security


7.1 Prior to employment


7.1.1 Screening


Background verification checks include criminal background checks, educational background checks, etc.


Typically this sits within the HR function but organizations are free to appoint appropriate management authority. The 27001 standard gives that flexibility to organizations.


This is more for the Legal department to check the compliance of the background checks. For example, in certain countries, conducting a criminal background check against somebody might not be allowed by local laws.


This can be tied to the business risk of not complying with 27001 which may result in loss of customers, loss of reputation, etc.


7.1.2 Terms and conditions of employment




7.2 During employment


7.2.1 Management responsibilities


Security is everyone's responsibility. Some organizations make this part of Manager's job responsibilities to drive security-related conversations in everyday work.



7.2.2 Information security awareness, education and training



7.2.3 Disciplinary process




7.3 Termination and change of employment


7.3.1 Termination or change of employment responsibilities


This typically is a combination of HR-related processes and Identity and Access Management (IAM) procedures. For e.g.

1) Are User IDs immediately disabled upon termination

2) Are rights and permissions for the existing role removed (if no longer required) if the employee switches roles etc?


This can be part of a Non-Disclosure Agreement Clause or an electronic acknowledgment of having read the Information Security Policy.


Some examples include automated Identity and Access Management solutions to enforce the principle of least privilege giving employees only the rights they need to perform their jobs.


8 Asset management


8.1 Responsibility for assets


8.1.1 Inventory of assets


This could be an automated inventory like Service Now or a spreadsheet (which might not work for bigger organizations with lots of assets). Also, assets here refer to all software and hardware assets.


This could be an automated inventory like Service Now or a spreadsheet (which might not work for bigger organizations with lots of assets). Also, assets here refer to all software and hardware assets.


8.1.2 Ownership of assets


Also referred to as an Asset Owner, all Software and Hardware Assets must have ownership. This is important to be able to mitigate any Information Security risks.


8.1.3 Acceptable use of assets


An Acceptable Use Policy (AUP) typically describes the policies around how an organization's assets should be handled and the DOs and DONTs. Just like any other policies, these could be posted on the company intranet or through internal mailer campaigns.


An Acceptable Use Policy (AUP) typically describes the policies around how an organization's assets should be handled and the DOs and DONTs. Just like any other policies, these could be posted on the company intranet or through internal mailer campaigns.


8.1.4 Return of assets



8.2 Information classification


8.2.1 Classification of information


Information Classification is necessary to understand the criticality of data to the organization as data, after human resources, is the most valuable asset for an organization. Appropriate Security controls can be applied only if the classification of data is known. Data classified as "public" might not require the same level of controls as data classified as "confidential".


8.2.1.2

This should be a documented policy detailing what are the different types of data processed by the organization and what are their clarification criteria. For example, a Credit Card might be classified as confidential whereas the company careers page might have to be classified as "public".


8.2.2 Labelling of information


This could be an automated process where software could be utilized to automatically assign labels to files and documents or it can be a manual process where employees assign classification labels based on the company's classification criteria.


8.2.3 Handling of assets


There should be procedures for handling data belonging to different classification types. For example, "confidential data" may mandatorily need encryption controls but data classified as "public" may not.