NASATKA Information Security Audit with notes (Rev 0)

• Audit Title

• Document No.

• Client / Site

• Conducted on

  Date

• Prepared by

• Location
  Address

• Personnel

Risk Assessment

• Has a security risk assessment been executed?

  Yes

  No

  N/A

• Have secure area's been defined?

  Yes

  No

  N/A

• Is the risk assessment up-to-date?

  Yes

  No

  N/A

• NASATKA security risk assessments.<br>

  Yes

  No

  N/A

Security policies & plans

• Has a security plan been defined (in line with risk assessment)?

  Yes

  No

  N/A

• Has a security policy been defined?

  Yes

  No

  N/A

• Has a document classification policy been defined?

  Yes

  No

  N/A

• Has clear desk policy been defined?

  Yes

  No

  N/A

• Are security rounds and clear desk checks planned?

  Yes

  No

  N/A

• Is a key management policy in place?

  Yes

  No

  N/A

• Contingency/Disaster recovery plan?

  Yes

  No

  N/A

Controls

• Access control systems in place (keys or card readers) in line with secure areas defined?<br>

  Yes

  No

  N/A

• How is authorization, registration, and review of authorization of keys and badges organized?

• Safe storage of keys and badges?

  Safe

  At Risk

  N/A

• Access control systems in place (IT systems)?<br>

  Yes

  No

  N/A

• How is authorization and review of authorization of IT systems organized?

• Is the password of admin user stored safely?

  Yes

  No

  N/A

• Are backups made ?

  Yes

  No

  N/A

• Safe storage of backup media?

  Safe

  At Risk

  N/A

• Results of clear desk rounds documented?

  Yes

  No

  N/A

• Follow up on clear desk rounds?

Generics

• Notes

• Open issues

• Possitives

• Findings