Information Security Audit with notes

• Audit Title

• Document No.

• Client / Site

• Conducted on

  Date

• Prepared by

• Location
  Address

• Personnel

• Ready?

  Off

  On

Risk Assessment

• Has a security risk assessment been executed

  Yes

  No

  N/A

• Have secure area's been defined

  Yes

  No

  N/A

• Is the risk assessment up-to-date

  Yes

  No

  N/A

• ICT security risk assessments<br>

  Yes

  No

  N/A

• ICT continuity

  Yes

  No

  N/A

Security policies & plans

• Has a security plan been defined (in line with risk assessment)?

  Yes

  No

  N/A

• Has a security policy been defined

  Yes

  No

  N/A

• Has a document classification policy been defined

  Yes

  No

  N/A

• Has clear desk policy been defined

  Yes

  No

  N/A

• Are security rounds and clear desk checks planned

  Yes

  No

  N/A

• Is a key management policy in place

  Yes

  No

  N/A

• Contingency/Disaster recovery plan

  Yes

  No

  N/A

Controls

• Access control systems in place (keys or card readers) in line with secure areas defined?<br>

  Yes

  No

  N/A

• How is authorization, registration and review of authorization of keys and badges organized?

• Safe storage of keys and badges

  Safe

  At Risk

  N/A

• Access control systems in place (IT systems)?<br>

  Yes

  No

  N/A

• How is authorization and review of authorization of IT systems organized?

• Is the password of admin user stored safely?

  Yes

  No

  N/A

• Are backups made ?

  Yes

  No

  N/A

• Safe storage of backup media

  Safe

  At Risk

  N/A

• Results of clear desk rounds documented?

  Yes

  No

  N/A

• Follow up on clear desk rounds?

Generics

• Notes

• Open issues

• Possitives

• Findings