ISO 27001 Checklist

The ISO 27001 Audit Checklist helps you follow information security management systems policies through checks of networking assets, human resources, and more.

Download as free PDF

Library
ISO Standards
ISO 27001 Checklist

ISO 27001 Checklist

Compliance With Legal And Contractual Requirements

Independent Review Of Information Security

Management Direction For Information Security

Information Security Roles And Responsibilities

Mobile Devices And Teleworking

Prior To Employment

During Employment

Termination And Change Of Employment

Responsibilities For Assets

Information Classification

Media Handling

Responsibilities For Assets

User Responsibilities

System And Application Access Control

Cryptographic Controls

Secure Areas

Equipment

Operational Procedures And Responsibilities

Protection From Malware

System Backup

Logging And Monitoring

Control Of Operational Software

Technical Vulnerability Management

Information Systems Audit Considerations

Network Security Management

Information Transfer

Security Requirements Of Information Systems

Security In Development And Support Processes

Suppliers Relationships

Information Security Management

Information Security Continuity

Redundancies

Is this sample what you are looking for?
Sign up to use & customise this template, or create your own custom checklist:

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

ISO 27001 Checklist

The ISO 27001 Audit Checklist helps you follow information security management systems policies through checks of networking assets, human resources, and more.

1. Identification of Applicable Legislation and Contractual Requirement: Is there a defined policy for the identification of applicable legislation and contractual requirements?

2. Intellectual Property Rights: Is there a defined policy for intellectual property rights?

3. Protection of Records: Is there a defined policy for the protection of records?

4. Privacy and Protection of Personally Identifiable Information: Is there a defined policy for the privacy and protection of personally identifiable information?

5. Regulation of Cryptographic Control: Is there a defined policy for the regulation of cryptographic control?

1. Compliance with Security Policies and Standards: Is there a defined policy for compliance with security policies and standards?

2. Technical Compliance Review: Is there a defined policy for technical compliance review?

1. Do security policies exist?

2. Are all policies approved by management?

3. Is there evidence of compliance?

1. Security roles and responsibilities: Are roles and responsibilities defined?

2. Segregation of duties: Is segregation of duties defined?

3. Contact with authorities: Is the verification body/authority contacted for compliance verification?

4. Contact with special interest groups: Has contact been established with special interest groups regarding compliance?

5. Information security in project management: Is there evidence of information security in project management?

1. Mobile device policy: Is there a defined policy for mobile devices?

2. Teleworking: Is there a defined policy for working remotely?

1. Screening: Is there a defined policy for screening employees prior to employment?

2. Terms and conditions of employment: Is there a defined policy for HR terms and conditions of employment?

1. Management responsibilities: Is there a defined policy for management responsibilities?

2. Information security awareness, education, and training: Is there a defined policy for information security awareness, education, and training?

3. Disciplinary process: Is there a defined policy for disciplinary processes regarding information security?

1. Termination or change of employment responsibilities: Is there a defined policy for HR termination or change-of-employment policy regarding information security?

1. Inventory of assets: Is there a complete inventory list of assets?

2. Ownership of assets: Is there a complete ownership list of assets?

3. Acceptable use of assets: Is there a defined "acceptable use" of assets policy?

4. Return of assets: Is there a defined return of assets policy?

1. Classification of Information: Is there a defined policy for classification information?

2. Labeling of Information: Is there a defined policy for labeling information?

3. Handling of Assets: Is there a defined policy for handling of assets?

1. Management of removable media: Is there a defined policy for the management of removable media?

2. Disposal of media: Is there a defined policy for the disposal of media?

3. Physical media transfer: Is there a defined policy for physical media transfer?

1. Access policy control: Is there a defined policy for access control policy?

2. Access to networks and network services: Is there a defined policy for access to networks and network services?

3. User Registration and Deregistration: Is there a defined policy for user asset registration and de-registration?

4. User Access Provisioning: Is there a defined policy for user access provisioning?

5. Management of Privileged Access Rights: Is there a defined policy for the management of privileged access rights?

6. Management of Secret Authentication Information of Users: Is there a defined policy for the management of secret authentication information of users?

7. Review of User Access Rights: Is there a defined policy for the review of user access rights?

8. Removal or Adjustment of Access Rights: Is there a defined policy for the removal or adjustment of access rights?

1. Use of Secret Authentication Information: Is there a defined policy for the use of secret authentication information?

1. Information Access Restrictions: Is there a defined policy for information access restrictions?

2. Secure Log-On Procedures: Is there a defined policy for secure log-in procedures?

3. Password Management System: Is there a defined policy for password management systems?

4. Use of Privileged Utility Programs: Is there a defined policy for the use of privileged utility programs?

5. Access Control to Program Source Code: Is there a defined policy for access control to program source code?

1. Policy on the use of cryptographic controls: Is there a defined policy for the use of cryptographic controls?

2. Key management: Is there a defined policy for key management?

1. Physical Security Perimeter: Is there a defined policy for physical security perimeter?

2. Physical Entry Controls: Is there a defined policy for physical entry controls?

3. Securing Offices, Rooms, and Facilities: Is there a defined policy for securing offices, rooms, and facilities?

4. Protection against External and Environmental Threats: Is there a defined policy for protection against external and environmental threats?

5. Working in Secure Areas: Is there a defined policy for working in secure areas?

6. Delivery and Loading Areas: Is there a defined policy for delivery and loading areas?

1. Equipment siting and protection: Is there a defined policy for equipment siting and protection?

2. Supporting utilities: Is there a defined policy for supporting utilities?

3. Cabling security: Is there a defined policy for cabling security?

4. Equipment maintenance: Is there a defined policy for equipment maintenance?

5. Removal of assets: Is there a defined policy for the removal of assets?

6. Security of equipment and assets off-premises: Is there a defined policy for the security of equipment and assets off-premises?

7. Secure disposal or reuse of equipment: Was there secure disposal or reuse of equipment?

8. Unattended user equipment: Is there a defined policy for unattended user equipment?

9. Clear desk and clear screen policy: Is there a defined policy for clear desk and clear screen policy?

1. Documented operating procedures: Is there a defined policy for documented operating procedures?

2. Change management: Is there a defined policy for change management?

3. Capacity management: Is there a defined policy for capacity management?

4. Separation of development, testing, and operational environments: Is there a defined policy for the separation of development, testing, and operational environments?

1. Controls against malware: Is there a defined policy for controls against malware?

1. Backup: Is there a defined policy for backing up systems?

2. Information Backup: Is there a defined policy for information backup?

1. Event logging: Is there a defined policy for event logging?

2. Protection of log information: Is there a defined policy for the protection of log information?

3. Clock synchronization: Is there a defined policy for clock synchronization?

4. Administrator and operator log: Is there a defined policy for administrator and operator logs?

1. Installation of software on operational systems: Is there a defined policy for the installation of software on operational systems?

1. Restriction on Software Installation: Is there a defined policy for restrictions on software installation?

2. Management of Technical Vulnerabilities: Is there a defined policy for the management of technical vulnerabilities?