iso27001-audit-checklist

name	iso27001-audit-checklist
enabled	true
description	Use when performing iso27001 audit checklist — provides a comprehensive audit checklist aligned with ISO 27001:2022 Annex A controls for information security management systems. Covers all 93 controls across organizational, people, physical, and technological domains with evidence collection guidance and gap remediation planning.
required_connections	[{"prefix":"grc-tool","label":"GRC Platform"}]
config_fields	[{"key":"organization_name","label":"Organization Name","required":true,"placeholder":"e.g., Acme Corp"},{"key":"scope","label":"ISMS Scope","required":true,"placeholder":"e.g., Cloud infrastructure and SaaS platform"},{"key":"audit_type","label":"Audit Type","required":false,"placeholder":"e.g., internal, surveillance, recertification"}]
features	["COMPLIANCE","ISO27001","AUDIT"]

ISO 27001:2022 Audit Checklist

Phase 1: ISMS Documentation Review

1. Review ISMS documentation
   • Information security policy and objectives
   • Scope of the ISMS
   • Risk assessment methodology
   • Risk treatment plan
   • Statement of Applicability (SoA)
   • Roles and responsibilities documented
   • Management review meeting minutes
2. Verify document control and version management
3. Check mandatory documented information per clause requirements

Phase 2: Organizational Controls (A.5)

• A.5.1 - Policies for information security
• A.5.2 - Information security roles and responsibilities
• A.5.3 - Segregation of duties
• A.5.4 - Management responsibilities
• A.5.5 - Contact with authorities
• A.5.6 - Contact with special interest groups
• A.5.7 - Threat intelligence
• A.5.8 - Information security in project management
• A.5.9 - Inventory of information and associated assets
• A.5.10 - Acceptable use of information and associated assets
• A.5.11 - Return of assets
• A.5.12 - Classification of information
• A.5.13 - Labelling of information
• A.5.14 - Information transfer
• A.5.15 - Access control
• A.5.16 - Identity management
• A.5.17 - Authentication information
• A.5.18 - Access rights
• A.5.19-A.5.22 - Supplier management
• A.5.23 - Information security for cloud services
• A.5.24-A.5.28 - Incident management
• A.5.29-A.5.30 - Business continuity
• A.5.31-A.5.36 - Compliance and reviews
• A.5.37 - Documented operating procedures

Phase 3: People Controls (A.6)

• A.6.1 - Screening
• A.6.2 - Terms and conditions of employment
• A.6.3 - Information security awareness, education, training
• A.6.4 - Disciplinary process
• A.6.5 - Responsibilities after termination
• A.6.6 - Confidentiality or non-disclosure agreements
• A.6.7 - Remote working
• A.6.8 - Information security event reporting

Phase 4: Physical Controls (A.7)

• A.7.1 - Physical security perimeters
• A.7.2 - Physical entry
• A.7.3 - Securing offices, rooms, and facilities
• A.7.4 - Physical security monitoring
• A.7.5 - Protecting against physical and environmental threats
• A.7.6-A.7.8 - Working in secure areas, clear desk/screen
• A.7.9-A.7.14 - Equipment security

Phase 5: Technological Controls (A.8)

• A.8.1 - User endpoint devices
• A.8.2 - Privileged access rights
• A.8.3 - Information access restriction
• A.8.4 - Access to source code
• A.8.5 - Secure authentication
• A.8.6 - Capacity management
• A.8.7 - Protection against malware
• A.8.8 - Management of technical vulnerabilities
• A.8.9 - Configuration management
• A.8.10 - Information deletion
• A.8.11 - Data masking
• A.8.12 - Data leakage prevention
• A.8.13 - Information backup
• A.8.14 - Redundancy of information processing facilities
• A.8.15 - Logging
• A.8.16 - Monitoring activities
• A.8.17 - Clock synchronization
• A.8.18-A.8.25 - Software and network security
• A.8.26-A.8.28 - Application security and testing
• A.8.29-A.8.34 - Operations security

Gap Assessment Summary

Domain	Controls Assessed	Conforming	Minor Gaps	Major Gaps	Not Applicable
Organizational (A.5)	37
People (A.6)	8
Physical (A.7)	14
Technological (A.8)	34
Total	93

Phase 6: Remediation Planning

1. Prioritize gaps by risk severity
2. Assign remediation owners and deadlines
3. Define evidence requirements for each gap
4. Schedule follow-up assessments
5. Update risk treatment plan

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

• Audit Report: Control-by-control assessment with findings
• Gap Analysis: Summary of non-conformities with severity ratings
• Evidence Matrix: Required evidence per control with collection status
• Remediation Plan: Prioritized actions with owners and deadlines
• Statement of Applicability Update: Revised SoA reflecting current state

Action Items

• Complete documentation review for all ISMS documents
• Assess all 93 Annex A controls
• Document evidence collected per control
• Classify and prioritize all gaps found
• Assign remediation actions with deadlines
• Schedule management review of audit findings