ISO 27001:2022 Internal Audit

• Department

• Conducted on

  Date

• Prepared by

• Location
  Address

• Auditor(s)

• Auditees

• Establish the Audit Plan Include timings, interested parties, and context

• Determine the Scope of the Audit

Objectives

• Determine the objectives of the audit

Process /Function

• Determine what part of the Standard is being audited.

Method and records required

• undefined

• Summarise the findings of the audit

• Review of historical internal and 3rd party reports

• Section 4 - Understanding the Context of the Organisation

• Section 4 - Review needs and expectations

• Section 4 - Determine the scope of the ISMS

• Section 5 - Leadership - Top management shall demonstrate leadership and commitment with respect to the information security management system by: ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organisation communicating the importance of effective information security management and of conforming to the information security management system requirements;

• Review IMS Policy Top management shall establish an information security policy that: a) is appropriate to the purpose of the organisation; b) includes information security objectives or provides the framework for setting information security objectives; IS available and communicated

• Section 6 - Planning a) ensure the information security management system can achieve its intended outcome(s); b) prevent, or reduce, undesired effect and achieve continual improvement

• Section 6 - Information Risk and assessment a) establishes and maintains information security risk criteria that include: 1) the risk acceptance criteria; and 2) criteria for performing information security risk assessments; Reviews information risks

• Section 6 - information security risk treatment a) select appropriate information security risk treatment options, taking account of the risk assessment results;b) determine all controls that are necessary to implement the information security risk treatment option(s) chosen; c) compare the controls determined in 6.1.3 b) above with those in Annex A and verify that no necessary controls have been omitted;

• Section 6 - Information Security objectives and planning to achieve them. The organisation shall establish information security objectives at relevant functions and levels. The information security objectives shall: a) be consistent with the information security policy. Be measurable and reviewed

• Section 6 - When the organization determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.

• section 7 - SUPPORT - The organisation shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the information security management system. a) determine the necessary competence of person(s) doing work under its control that affects its information security performance

• Section 7 - Awareness - Persons doing work under the organisation’s control shall be aware of: a) the information security policy; b) their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and

• Section7 Communication - The organisation shall determine the need for internal and external communications relevant to the information security management system including: a) on what to communicate; b) when to communicate; c) with whom to communicate; d) how to communicate

• Section 7 Documented information The organisation’s information security management system shall include: a) documented information required by this document; and b) documented information determined by the organisation as being necessary for the effectiveness of the information security management system.

• Section 7 Control of documented information

• Section 8 - The organisation shall plan, implement and control the processes needed to meet requirements, and to implement the actions determined in Clause 6.2, by: - establishing criteria for the processes; - implementing control of the processes in accordance with the criteria. The organisation shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.

• Section 8 - RISK ASSESSMENT The organisation shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established in 6.1.2 a).

• Section 8 RISK TREATMENT The organisation shall implement the information security risk treatment plan. The organisation shall retain documented information of the results of the information security risk treatment.- RISK TR

• Section 9 - Performance Evaluation(KEY METRICS) - The organisation shall determine: a) what needs to be monitored and measured, including information security processes and controls; b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. The methods selected should produce comparable and reproducible results to be considered valid;(

• Management Review: Top management shall review the organization's information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. REVIEW THE LAST MEETING

• Section 10 - Improvement The organisation shall continually improve the suitability, adequacy and effectiveness of the information security management system.

• ANNEX A - Sample Annex A requirements for Compliance

• Non Conformance/OFI/Positive feedback report

• Determine follow up actions and timings

• Action Register

  Yes

  No

  N/A

• Audit Program

  Yes

  No

  N/A

• Risk register

  Yes

  No

  N/A

• Audit register

  Yes

  No

  N/A

• Process Register

  Yes

  No

  N/A

• Auditor(s)

• Auditees