cloudthinker-ai ISO 27001:2022 Audit Checklist
Phase 1: ISMS Documentation Review
- Review ISMS documentation
- Information security policy and objectives
- Scope of the ISMS
- Risk assessment methodology
- Risk treatment plan
- Statement of Applicability (SoA)
- Roles and responsibilities documented
- Management review meeting minutes
- Verify document control and version management
- Check mandatory documented information per clause requirements
Phase 2: Organizational Controls (A.5)
- A.5.1 - Policies for information security
- A.5.2 - Information security roles and responsibilities
- A.5.3 - Segregation of duties
- A.5.4 - Management responsibilities
- A.5.5 - Contact with authorities
- A.5.6 - Contact with special interest groups
- A.5.7 - Threat intelligence
- A.5.8 - Information security in project management
- A.5.9 - Inventory of information and associated assets
- A.5.10 - Acceptable use of information and associated assets
- A.5.11 - Return of assets
- A.5.12 - Classification of information
- A.5.13 - Labelling of information
- A.5.14 - Information transfer
- A.5.15 - Access control
- A.5.16 - Identity management
- A.5.17 - Authentication information
- A.5.18 - Access rights
- A.5.19-A.5.22 - Supplier management
- A.5.23 - Information security for cloud services
- A.5.24-A.5.28 - Incident management
- A.5.29-A.5.30 - Business continuity
- A.5.31-A.5.36 - Compliance and reviews
- A.5.37 - Documented operating procedures
Phase 3: People Controls (A.6)
- A.6.1 - Screening
- A.6.2 - Terms and conditions of employment
- A.6.3 - Information security awareness, education, training
- A.6.4 - Disciplinary process
- A.6.5 - Responsibilities after termination
- A.6.6 - Confidentiality or non-disclosure agreements
- A.6.7 - Remote working
- A.6.8 - Information security event reporting
Phase 4: Physical Controls (A.7)
- A.7.1 - Physical security perimeters
- A.7.2 - Physical entry
- A.7.3 - Securing offices, rooms, and facilities
- A.7.4 - Physical security monitoring
- A.7.5 - Protecting against physical and environmental threats
- A.7.6-A.7.8 - Working in secure areas, clear desk/screen
- A.7.9-A.7.14 - Equipment security
Phase 5: Technological Controls (A.8)
- A.8.1 - User endpoint devices
- A.8.2 - Privileged access rights
- A.8.3 - Information access restriction
- A.8.4 - Access to source code
- A.8.5 - Secure authentication
- A.8.6 - Capacity management
- A.8.7 - Protection against malware
- A.8.8 - Management of technical vulnerabilities
- A.8.9 - Configuration management
- A.8.10 - Information deletion
- A.8.11 - Data masking
- A.8.12 - Data leakage prevention
- A.8.13 - Information backup
- A.8.14 - Redundancy of information processing facilities
- A.8.15 - Logging
- A.8.16 - Monitoring activities
- A.8.17 - Clock synchronization
- A.8.18-A.8.25 - Software and network security
- A.8.26-A.8.28 - Application security and testing
- A.8.29-A.8.34 - Operations security
Gap Assessment Summary
| Domain | Controls Assessed | Conforming | Minor Gaps | Major Gaps | Not Applicable |
|---|---|---|---|---|---|
| Organizational (A.5) | 37 | ||||
| People (A.6) | 8 | ||||
| Physical (A.7) | 14 | ||||
| Technological (A.8) | 34 | ||||
| Total | 93 |
Phase 6: Remediation Planning
- Prioritize gaps by risk severity
- Assign remediation owners and deadlines
- Define evidence requirements for each gap
- Schedule follow-up assessments
- Update risk treatment plan
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
- Audit Report: Control-by-control assessment with findings
- Gap Analysis: Summary of non-conformities with severity ratings
- Evidence Matrix: Required evidence per control with collection status
- Remediation Plan: Prioritized actions with owners and deadlines
- Statement of Applicability Update: Revised SoA reflecting current state
Action Items
- Complete documentation review for all ISMS documents
- Assess all 93 Annex A controls
- Document evidence collected per control
- Classify and prioritize all gaps found
- Assign remediation actions with deadlines
- Schedule management review of audit findings