ISO 27001:2022 ISMS Audit Checklist

1. ISO/IEC 27001:2022 ISMS CONTROLS AUDIT CHECKLIST INFORMATION SECURITY MANAGEMENT ISO 27001:2022 AUDIT CHECKLIST E-mail id: - sales@globalmanagergroup.com Website: - www.globalmanagergroup.com

2. Information Security Management System ISO/IEC 27001:2022 ISMS Controls Audit Checklist Ref.: 1. ISO/IEC 27001:2022 Annexure A 2. ISO/IEC 27002: 2022, Information security, cybersecurity and privacy protection — Information security controls To verify effectiveness of ISMS Control Implementation Information Security Management ISO 27001:2022 Audit Checklist Auditor Name: _____________________ Audit Date: ________________ Information Security Management System: ISO 27001:2022 Controls Audit Checklist Audit area/ objective/ questions Results ISO/IEC Reference Control no. Control title 5-Organization control 27002:2022 Control Audit Question Findings Compliance Have you prepared Information security policy and topic-specific policies? Are they approved by management? Are they communicated to and acknowledged by relevant personnel and relevant interested parties? Are they reviewed at planned intervals and if significant changes occur? Have Information security roles and responsibilities been defined and allocated according organization needs? Are conflicting duties and conflicting areas of responsibility segregated? Does the management require all personnel to follow information security policy, topic-specific policies and procedures? Policies for information security 5.1 Information roles responsibilities security and 5.2 to the 5.3 Segregation of duties Management responsibilities 5.4

3. Has your organization established and maintained contact with relevant authorities? Has your organization established and maintained contact with special interest groups or other specialist security forums and professional associations? Have you collected Information relating to information security threats and analyzed the information to get details about the threat Have you integrated Information security into project management? Have you developed and maintained an inventory of information and other associated assets, information of their owners? Have you identified, documented and implemented the rules for the acceptable use and procedures for handling information associated assets? Do the personnel interested parties return all the organization’s assets possession upon termination of their employment, contract or agreement? Have you classified Information according to the information security needs of your organization? What is the basis of classification? Is this classification based on confidentiality, integrity, availability and relevant interested requirements? Have you developed implemented procedures information labelling in accordance with the information classification scheme of your organization? Have you established information transfer rules/ agreements for all types of transfer facilities within the organization and between the organization and other parties? 5.5 Contact with authorities Contact with special interest groups 5.6 5.7 Threat intelligence Information security in project management 5.8 Inventory of information and other associated assets 5.9 including Acceptable information and other associated assets use of 5.10 and other and other in their or 5.11 Return of assets change Classification information of 5.12 party and for 5.13 Labelling of information procedures/ 5.14 Information transfer

4. Have implemented physical and logical access to information and other associated assets? Are these rules based on business and information requirements? How do you manage identity of individuals and systems accessing the organization’s information and other associated assets? Have you managed the full life cycle of identities? Is there any formal user registration and de-registration procedure for granting access to all information systems and services? Do you have a process to control allocation and management authentication information? Are personnel advised on appropriate handling of information? Have you provided access rights to information and other associated assets in accordance with the organization’s policy on and rules for access control? Are access rights reviewed, modified and removed in accordance with these policy and rules? Have you defined and implemented Processes and manage the information security risks associated with the use of supplier’s products or services? Have you established information security requirements based on the type of supplier relationship? Are these requirements agreed with each supplier? Have you defined and implemented Processes and manage the information security risks associated with the ICT products and services supply chain? you established Rules and to control 5.15 Access control security 5.16 Identity management of Authentication information 5.17 authentication 5.18 Access rights procedures to Information security in supplier relationships 5.19 relevant Addressing information security within supplier agreements 5.20 procedures to Managing information security in the ICT supply chain 5.21

5. Are information security practices and service delivery monitored, reviewed, evaluated and managed on regular basis? Have you established processes for acquisition, use, management and exit from cloud services? Are these processes established in accordance with the organization’s information security requirements? Has your organization planned and prepared for managing information security incidents? Has it defined, established and communicated information security incident management processes, roles and responsibilities to all relevant personnel? Does your organization information security events? Is any decision taken to categorize such events as information security incidents? How do you respond to Information security incidents? responded to in accordance with the documented procedures? Have you used the knowledge gained from information security incidents to strengthen and information security controls? Have you established implemented procedures for the identification, collection, acquisition and preservation of evidence related to information security events? Have you planned how to maintain information security disruption? Does the organization have ICT continuity plans, including response and recovery procedures detailing how the organization is planning to manage an ICT service disruption? Are these plans maintained and tested based on business continuity objectives and ICT continuity requirements? any changes in supplier Monitoring, review and change management of supplier services 5.22 Information security for use of cloud services 5.23 Information incident management planning preparation security 5.24 and assess Assessment decision on information security events and 5.25 Response information incidents to Are they 5.26 security Learning information incidents from 5.27 security improve the and 5.28 Collection of evidence Information during disruption security 5.29 during ICT business continuity readiness for 5.30 implemented,

6. Are these plans regularly evaluated through exercises and tests? Have you identified and documented Legal, statutory, regulatory and contractual requirements relevant to information security? Are these requirements updated periodically or in case of changes? Have you identified and documented the organization’s approach to meet these requirements? Has the organization implemented appropriate procedures to protect intellectual property rights? Does the organization protection of records from loss, destruction, unauthorized unauthorized release? Has the organization identified and fulfilled the requirements regarding the preservation of privacy and protection of PII applicable laws and regulations and contractual requirements? Is the organization’s approach to managing information security and its implementation including processes and reviewed independently? Who conducts the review? What is the frequency of review? Is review of information security approach and its implementation conducted in case of any significant changes? Is information security implemented and operated in accordance with the organization’s information security policy, topic-specific policies, rules and standards? Is compliance with the organization’s information security policy, topic- specific policies, rules and standards reviewed regularly? Has the organization documented the Legal, regulatory contractual requirements statutory, and 5.31 Intellectual rights property 5.32 ensure 5.33 Protection of records falsification, access and Privacy and protection of PII 5.34 according to people, technologies Independent review of information security 5.35 Compliance policies, standards information security with and for rules 5.36 Documented operating procedures properly Operating 5.37

7. procedures processing facilities? Are these procedures available to personnel who need them? for information 6. People controls Does Background verification checks of all employees prior to joining? Are such checks of Background verification checks of all employees carried out on regular basis? Are these checks conducted in accordance with applicable laws, regulations and ethics? Are these checks proportional to the business requirements, classification of the information to be accessed and the perceived risks? Are the employees’ organization’s responsibilities information security mentioned in their job agreements/ contracts? Has the organization established an information security education and training program for employees and relevant interested parties? Are they provided with appropriate information security education and training considering the information to be protected and the information security controls that have been implemented? Do they receive regular updates of the organization's security policy, topic-specific policies and procedures, as relevant for their job function? Has the organization established and implemented a disciplinary process to take actions against employees and other relevant interested parties who have committed security policy violation? Is this process communicated to all employees and relevant interested parties? the organization conduct 6.1 Screening the and the for Terms and conditions of employment 6.2 clearly awareness, awareness, Information awareness, education and training security 6.3 information an information 6.4 Disciplinary process

8. Has the organization defined and enforced Information responsibilities and remain valid after termination or change of employment? Are these things communicated to relevant personnel interested parties? Has the organization identified and documented Confidentiality or non- disclosure agreements? Do these agreements reflect the organization’s needs for the information? Are these agreements regularly reviewed? Have employees and other relevant interested parties Confidentiality/ agreements? Has the organization implemented security measures in cases of remote working by personnel? Have policy, operational plan and procedures been developed and implemented for remote working activities? How teleworking activity is authorized and controlled by management? Does it ensure information accessed, processed or stored outside the organization’s premises? Is a mechanism employees to report observed or suspected information events through appropriate channels in a timely manner? Does this mechanism support timely, consistent and effective reporting of information security events? Are employees procedure for reporting information security events and the point of contact to which the events should be reported? security that duties Responsibilities termination or change of employment after 6.5 and other protection of Confidentiality or non- disclosure agreements 6.6 signed Non-disclosure 6.7 Remote working protection of available for security Information event reporting security 6.8 aware of the

9. 7. Physical controls Has the organization defined security perimeters to prevent unauthorized physical access, interference to the organization’s information and other associated assets? Is the siting and strength of each of the perimeters defined in accordance with the information requirements related to the assets within the perimeter? Are entry controls and access points established for protecting secure areas? Is it ensured that only authorized persons have organization’s information and other associated assets? Has the organization designed and implemented physical security for offices, rooms and facilities? Are these security sufficient to prevent unauthorized physical access, interference to the organization’s information and other associated assets kept there? Is the premises monitored for unauthorized physical access? Does the organization have effective surveillance systems, guards, intruder alarms, CCTV and physical security management software managed internally or by a monitoring service provider? Has the organization physical and environmental threats and appropriate controls based on risk assessment results? Does the organization adequate protection against such as fire, flood, earthquake, explosion, civil unrest, toxic waste, environmental emissions and other forms of natural damage and Physical perimeters security 7.1 security 7.2 Physical entry access to the Securing offices, rooms and facilities measures 7.3 damage and continuously Physical monitoring security 7.4 including information either identified Protecting physical environmental threats against and 7.5 provide

10. disaster or disaster caused by human beings? Has the organization designed and implemented security measures for working in secure areas? Has the organization defined and enforced clear desk rules for papers and removable storage media and clear screen rules for information processing facilities? Are equipment of the organization sited securely and protected to reduce the risks from physical and environmental threats, and from unauthorized access and damage? Working areas in secure 7.6 Clear desk and clear screen 7.7 Equipment sitting and protection 7.8 Download Free Demo and Purchase Total Documentation Kit On ISO/IEC 27001:2022 Download Download Demo Demo Quick Buy Now Quick Buy Now Sample Sample Document File Document File

11. About Global Manager Group Global Manager Group is only organization, which provides complete list of ISO Documents with mapping of related ISO Standard's clause wise requirements with document matrix. Global Manager Group is well known brand for its Ready-to-use ISO Documentation Kits and ISO Auditor Training as well as Management Training Kits. For More Detail and Purchase of ISO Document Kit, visit our ISO E-shop at: https://www.globalmanagergroup.com/Eshop Contact us at: sales@globalmanagergroup.com