{"id":1306,"date":"2018-11-16T11:42:41","date_gmt":"2018-11-16T11:42:41","guid":{"rendered":"https:\/\/iso27001.solutions\/?p=1306"},"modified":"2019-03-11T17:28:12","modified_gmt":"2019-03-11T17:28:12","slug":"iso-27001-audit-checklist","status":"publish","type":"post","link":"https:\/\/ismsalliance.com\/trends\/iso-27001-certification-audit\/iso-27001-audit-checklist\/","title":{"rendered":"ISO 27001 Audit Checklist"},"content":{"rendered":"

Ensure Commitment<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

The process of creating and implementing your information security management system (ISMS) and then going forward for assessment will be made easier if there is full commitment from the top to the bottom of the organisation.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/span><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>

Assign a Project Manager<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

Although sole responsibility shouldn\u2019t fall on one person\u2019s shoulders, it is advised to assign a project manager as a spearhead. This needs to be someone who\u2019s orderly minded, has the authority to make decisions and has direct access to senior management team.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

Preparing for the Audit<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

It\u2019s well worth taking stock of your current situation. The best way to do this is by monitoring and measuring your current procedures and identifying any legal requirements of your ISMS.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

Scope of the Audit<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

Define the scope of your ISMS, this will help prevent you from doing unnecessary work. The scope outlines how much of the organisation the ISMS will cover. For example, an organisation may choose to implement a ISMS for just one of their sites. Section 4.3 of the ISO 27001 standard details the requirements for determining the scope.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

Awareness<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

Communication is key, there will be changes that will affect all employees, stakeholders and possibly some members of the supply chain. Everyone should be aware of the new processes and procedures contained in the ISMS. Regular updates, and in some cases training, are recommended.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

During the Audit<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

Your ISMS will introduce various procedures including:<\/p>\n

\u2022 Information security policy
\n\u2022 Risk assessment
\n\u2022 Risk treatment plan
\n\u2022 Internal audit
\n\u2022 Security roles
\n\u2022 Monitoring and measuring
\n\u2022 Corrective actions<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

Paperwork<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

You will need to compile documentation to demonstrate how your ISMS works. Our clients say that our online templates and toolkits really help them with this.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>

Reap the Rewards<\/h3>\n<\/div>
<\/div>
<\/div><\/div>
<\/div>

Once your ISMS is fully in place and compliant to the ISO 27001 standard, your business can then start seeing the benefits. These include, mitigation to the risk of a cyber breach, boosted client confidence and the opportunity to tender for more work.<\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div><\/div>
<\/div>

These Posts may also interest you :<\/p>\n<\/div>