Isms Audit Expert

ISMS Audit Expert

Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.

Table of Contents

• Audit Program Management
• Audit Execution
• Control Assessment
• Finding Management
• Certification Support
• Tools
• References

---

Audit Program Management

Risk-Based Audit Schedule

Annual Audit Planning Workflow

1. Review previous audit findings and risk assessment results 2. Identify high-risk controls and recent security incidents 3. Determine audit scope based on ISMS boundaries 4. Assign auditors ensuring independence from audited areas 5. Create audit schedule with resource allocation 6. Obtain management approval for audit plan 7. Validation: Audit plan covers all Annex A controls within certification cycle

Auditor Competency Requirements

• ISO 27001 Lead Auditor certification (preferred)
• No operational responsibility for audited processes
• Understanding of technical security controls
• Knowledge of applicable regulations (GDPR, HIPAA)

---

Audit Execution

Pre-Audit Preparation

1. Review ISMS documentation (policies, SoA, risk assessment) 2. Analyze previous audit reports and open findings 3. Prepare audit plan with interview schedule 4. Notify auditees of audit scope and timing 5. Prepare checklists for controls in scope 6. Validation: All documentation received and reviewed before opening meeting

Audit Conduct Steps

1. Opening Meeting

• Confirm audit scope and objectives
• Introduce audit team and methodology
• Agree on communication channels and logistics

2. Evidence Collection

• Interview control owners and operators
• Review documentation and records
• Observe processes in operation
• Inspect technical configurations

3. Control Verification

• Test control design (does it address the risk?)
• Test control operation (is it working as intended?)
• Sample transactions and records
• Document all evidence collected

4. Closing Meeting

• Present preliminary findings
• Clarify any factual inaccuracies
• Agree on finding classification
• Confirm corrective action timelines

5. Validation: All controls in scope assessed with documented evidence

---

Control Assessment

Control Testing Approach

1. Identify control objective from ISO 27002 2. Determine testing method (inquiry, observation, inspection, re-performance) 3. Define sample size based on population and risk 4. Execute test and document results 5. Evaluate control effectiveness 6. Validation: Evidence supports conclusion about control status

For detailed technical verification procedures by Annex A control, see security-control-testing.md.

---

Finding Management

Finding Classification

Finding Documentation Template

Finding ID: ISMS-[YEAR]-[NUMBER]
Control Reference: A.X.X - [Control Name]
Severity: [Major/Minor/Observation]

Evidence:
- [Specific evidence observed]
- [Records reviewed]
- [Interview statements]

Risk Impact:
- [Potential consequences if not addressed]

Root Cause:
- [Why the nonconformity occurred]

Recommendation:
- [Specific corrective action steps]

Corrective Action Workflow

1. Auditee acknowledges finding and severity 2. Root cause analysis completed within 10 days 3. Corrective action plan submitted with target dates 4. Actions implemented by responsible parties 5. Auditor verifies effectiveness of corrections 6. Finding closed with evidence of resolution 7. Validation: Root cause addressed, recurrence prevented

---

Certification Support

Stage 1 Audit Preparation

Ensure documentation is complete:

• [ ] ISMS scope statement
• [ ] Information security policy (management signed)
• [ ] Statement of Applicability
• [ ] Risk assessment methodology and results
• [ ] Risk treatment plan
• [ ] Internal audit results (past 12 months)
• [ ] Management review minutes

Stage 2 Audit Preparation

Verify operational readiness:

• [ ] All Stage 1 findings addressed
• [ ] ISMS operational for minimum 3 months
• [ ] Evidence of control implementation
• [ ] Security awareness training records
• [ ] Incident response evidence (if applicable)
• [ ] Access review documentation

Surveillance Audit Cycle

Validation: No major nonconformities at surveillance audits.

---

Tools

scripts/

Audit Planning Example

# Generate annual audit plan
python scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json

# With custom control risk ratings
python scripts/isms_audit_scheduler.py --controls controls.csv --format markdown

---

References

---

Audit Performance Metrics

Cloud Security Audit Guide

Assessment framework for cloud service security verification.

---

Table of Contents

• Shared Responsibility Model
• Cloud Provider Assessment
• Configuration Security
• Data Protection
• Identity and Access Management

---

Shared Responsibility Model

Responsibility Matrix

Audit Focus by Model

IaaS (AWS EC2, Azure VMs):

• Virtual network configuration
• OS hardening and patching
• Application deployment security
• Data encryption implementation

PaaS (Azure App Service, AWS Lambda):

• Application code security
• Data handling and encryption
• Identity integration
• Logging configuration

SaaS (Microsoft 365, Salesforce):

• User access management
• Data classification and handling
• Security configuration settings
• Integration security

---

Cloud Provider Assessment

Certification Verification

Check for current certifications:

• [ ] ISO 27001 (Information Security)
• [ ] ISO 27017 (Cloud Security)
• [ ] ISO 27018 (Cloud Privacy)
• [ ] SOC 2 Type II
• [ ] CSA STAR certification

Verification Steps: 1. Request current certificates from provider 2. Verify certificate scope includes services used 3. Check certification expiration dates 4. Review SOC 2 report for relevant controls 5. Document any scope exclusions

Data Residency Compliance

Provider Security Documentation

Request and review:

• Shared responsibility documentation
• Security whitepapers
• Incident notification procedures
• SLA for security incidents
• Vulnerability disclosure policy

---

Configuration Security

AWS Security Assessment

Identity and Access (IAM):

• [ ] Root account has MFA enabled
• [ ] No access keys for root account
• [ ] IAM policies follow least privilege
• [ ] No wildcard (*) permissions on sensitive resources
• [ ] Password policy meets requirements

Network Configuration (VPC):

• [ ] Default VPCs removed or secured
• [ ] Security groups follow least privilege
• [ ] No 0.0.0.0/0 ingress on management ports
• [ ] VPC flow logs enabled
• [ ] Network ACLs configured appropriately

Storage (S3):

• [ ] No public buckets (unless intended)
• [ ] Bucket policies restrict access
• [ ] Encryption at rest enabled
• [ ] Versioning enabled for critical data
• [ ] Access logging enabled

Logging (CloudTrail):

• [ ] CloudTrail enabled in all regions
• [ ] Log file validation enabled
• [ ] Logs encrypted with KMS
• [ ] S3 bucket for logs is secured
• [ ] CloudWatch alarms configured

Azure Security Assessment

Identity (Azure AD):

• [ ] MFA enabled for all users
• [ ] Privileged Identity Management (PIM) configured
• [ ] Conditional Access policies defined
• [ ] Guest access restricted
• [ ] Password protection enabled

Network (Virtual Networks):

• [ ] NSG rules follow least privilege
• [ ] No open management ports to internet
• [ ] Network Watcher enabled
• [ ] DDoS protection configured
• [ ] Private endpoints for PaaS services

Storage:

• [ ] No anonymous access to blob storage
• [ ] Encryption at rest enabled
• [ ] Shared access signatures time-limited
• [ ] Storage analytics logging enabled
• [ ] Soft delete enabled

Monitoring:

• [ ] Azure Monitor enabled
• [ ] Activity log exported to SIEM
• [ ] Alerts configured for security events
• [ ] Azure Security Center enabled
• [ ] Diagnostic settings configured

---

Data Protection

Encryption Verification

At Rest:

In Transit:

Key Management Assessment

• [ ] Customer-managed keys used for sensitive data
• [ ] Key rotation policy defined and implemented
• [ ] Key access restricted to authorized services
• [ ] Key usage logged and monitored
• [ ] Disaster recovery for keys documented

Data Classification in Cloud

---

Identity and Access Management

Privileged Access Review

1. Identify all administrative roles 2. Verify role assignment justification 3. Check for standing vs. just-in-time access 4. Review privileged activity logs 5. Confirm MFA required for elevation

Service Account Assessment

Federation and SSO

• [ ] SSO configured for cloud console access
• [ ] Conditional Access/MFA policies applied
• [ ] Session timeout configured
• [ ] Failed login monitoring enabled
• [ ] Emergency access accounts documented

API Security

• [ ] API keys not embedded in code
• [ ] Secrets management service used
• [ ] API access logged
• [ ] Rate limiting configured
• [ ] API permissions follow least privilege

ISO/IEC 27001:2022 Internal Audit Playbook

This reference answers exactly one decision: how do we prepare for and conduct an ISO 27001 internal audit (Clause 9.2) that produces actionable findings without burning the auditee team?

Pair with scripts/isms_audit_scheduler.py (this skill) for cadence + auditor independence and with compliance-os/scripts/audit_simulator.py for mock-audit preparation.

When to Use This Playbook

• Annual Clause 9.2 internal audit programme
• Pre-stage-1 certification readiness check
• Surveillance audit preparation (year 2 / year 3 of cert cycle)
• Post-incident audit (e.g., breach triggers ad-hoc ISMS audit)
• Onboarding a new business unit into existing ISMS scope

The 7-Phase Audit Workflow

[ Plan ] -> [ Prepare ] -> [ Open ] -> [ Field ] -> [ Close ] -> [ Report ] -> [ Track ]

Phase 1 — Plan (1-2 weeks pre-audit)

• Confirm scope: which Annex A controls, which business units, which clauses
• Confirm auditor independence (no self-audit; rotate across teams)
• Pull prior-year findings + open nonconformities for follow-up
• Define sampling approach (stratified by risk; not random)
• Communicate dates to auditees ≥ 2 weeks in advance

Outputs: audit plan (1 page), auditor assignments, document-request list

Phase 2 — Prepare (1 week pre-audit)

• Auditee assembles document evidence in advance
• Auditor reviews documents BEFORE fieldwork (do not waste interview time reading docs)
• Pre-fieldwork checklist: are documents under version control? Are records signed? Are dates within retention?
• Auditor runs audit_simulator.py to mentally rehearse finding scenarios

Outputs: prepared document folder, auditor mental model of likely findings

Phase 3 — Open (30 min, day 1)

• Opening meeting with auditee leadership + key contributors
• State scope, criteria (which Annex A controls), timeline, communication plan
• Set expectations: this is a check on the system, not on individuals
• Confirm safe-to-fail discipline — finding ≠ punishment

Outputs: opening minutes; auditee buy-in

Phase 4 — Field (2-5 days for medium scope)

The core. For each scoped control:

1. Interview the control owner — open question, sample drill-down, walk-through 2. Inspect the record(s) — pull samples from logs / tickets / records, not curated demos 3. Cross-reference — does the record match the procedure? Does management oversight exist? 4. Document the finding on the spot — control + observation + evidence + severity

Interview pattern (per ISO 19011 Clause 6):

• "Walk me through how this control is implemented day-to-day."
• "Show me a specific example from the last 30 days."
• "What happens if [edge case]?"
• "Where is this documented?"

Outputs: finding worksheets (one per control); severity ratings

Phase 5 — Close (1-2 hours, last day)

• Closing meeting with auditee team
• Walk through preliminary findings (no surprises in the written report)
• Allow auditee to provide additional evidence for borderline findings
• Confirm corrective action ownership before the report is written
• Agree on draft-report timeline (typically 1-2 weeks)

Outputs: closing minutes; preliminary finding agreement

Phase 6 — Report (1-2 weeks post-fieldwork)

Per ISO 19011 Clause 6.5, the audit report must include:

• Audit objectives, scope, criteria, dates
• Audit team and auditees
• Summary of findings by severity
• Per-finding: control + observation + evidence + severity + corrective action recommendation
• Conclusion: ISMS adequacy + effectiveness verdict
• Distribution list

Severity grades (Clause 9.2 compatible):

Healthy distribution: ≥ 40% observation, ≤ 15% critical.

Outputs: signed audit report; corrective action assignments

Phase 7 — Track (ongoing)

• Open findings tracked through existing CAPA system (Clause 10.2)
• Verify closure of each finding via evidence + re-test (do not accept self-attestation)
• Update risk register for residual risks identified
• Feed unresolved findings into next audit cycle + management review (Clause 9.3)

Outputs: closed findings + verification evidence; updates to risk register and management review inputs

Annex A Scope Prioritization (for fieldwork)

ISO 27001:2022 Annex A has 93 controls grouped into 4 themes (A.5 organizational, A.6 people, A.7 physical, A.8 technological). Audit fieldwork should NOT attempt all 93 in one audit — use the 3-year rolling cycle.

High-priority controls (audit annually):

Lower-priority controls (audit on rolling 3-year cycle):

A.5.2 / A.5.3 / A.5.4 / A.5.6 / A.5.7 / A.5.8 / A.5.11 / A.5.13 / A.5.14 / A.5.16 / A.5.17 / A.5.18 / A.5.22 / A.5.23 / A.5.28 / A.5.29 / A.5.30 / A.5.31 / A.5.32 / A.5.33 / A.5.35 / A.5.36 / A.5.37 / A.6.1 / A.6.2 / A.6.4 / A.6.5 / A.6.6 / A.7 (all physical) / A.8.1 / A.8.4 / A.8.5 / A.8.6 / A.8.8 / A.8.9 / A.8.10 / A.8.11 / A.8.12 / A.8.13 / A.8.14 / A.8.17 / A.8.18 / A.8.19 / A.8.20 / A.8.21 / A.8.22 / A.8.23 / A.8.24 / A.8.25-31 (SDLC controls)

Common Stage 1 / Stage 2 Findings (the patterns)

Based on practitioner reports of common ISO 27001:2022 findings:

1. Risk register exists but treatment plans are generic. "Apply A.7.3" without specific implementation. 2. Asset inventory missing cloud / SaaS / AI tools. Engineers stopped registering as they multiplied. 3. Privileged access reviewed annually instead of quarterly. Find orphaned accounts. 4. Supplier reviews unsigned or undated. Procurement collected them; nobody reviewed. 5. Incident records lack documented post-incident review within 30 days. 6. Change advisory board exists but rubber-stamps. No rejected changes in last 6 months. 7. Internal audit programme doesn't cover all clauses + applicable controls over 3-year cycle. 8. Management review missing required Article 9.3 inputs (KPI trends, audit findings, risk changes). 9. Vulnerability management without defined SLAs by severity. 10. BCP/DRP exists but never tested.

Cross-Framework Reuse

This ISO 27001 audit pattern is the foundation for:

• SOC 2 — ~75% control overlap; same evidence with TSC-specific formatting (soc2_audit_playbook.md)
• ISO 42001 — Clauses 4-10 reuse ~60%; Annex A overlap on data + supplier; AI-specific Annex A.5/A.6/A.9 net-new
• GDPR — Article 32 organizational measures reuse heavily (gdpr_audit_playbook.md)
• NIST CSF profiles — common control vocabulary

Pair with compliance-os/references/multi_framework_audit_playbook.md for orchestrating audits across multiple frameworks.

When This Reference Doesn't Help

• Specific Annex A control text. See ISO 27001:2022 + ISO 27002:2022 (implementation guidance).
• Sectoral overlays. Financial (NYDFS), healthcare (HIPAA), critical infra (NIS2) — sector-specific.
• External certification audit detail. This is the internal audit playbook; external (stage 1 / stage 2) audits are conducted by accredited bodies and follow ISO 17021.

---

Source authorities (non-exhaustive):

• ISO/IEC 27001:2022 — the standard (Clause 9.2 internal audit + Annex A 93 controls)
• ISO/IEC 27002:2022 — Information security controls (implementation guidance for Annex A)
• ISO/IEC 19011:2018 — Guidelines for auditing management systems
• ISO/IEC 17021-1:2015 — Conformity assessment requirements for bodies providing audit and certification (the external-audit standard; informs internal-audit expectations)
• IIA International Professional Practices Framework — Standards 1000-2600 (internal audit attribute + performance)
• NIST SP 800-53A Rev 5 — Assessing Security and Privacy Controls (assessment procedures per control)
• ISACA CISA Review Manual (27th ed., 2024) — IS audit methodology
• ASQ Certified Quality Auditor (CQA) Body of Knowledge — quality audit methodology
• Industry retrospectives — common findings from accredited certification bodies (BSI, DNV, Bureau Veritas published case studies)
• The Open Group — Open FAIR for risk-based audit prioritization

ISO 27001 ISMS Audit Methodology

Complete audit framework and procedures for Information Security Management System assessments.

---

Table of Contents

• Audit Program Structure
• Pre-Audit Phase
• Audit Execution
• Finding Classification
• Certification Audit Support

---

Audit Program Structure

Annual Audit Schedule

Risk-Based Scheduling

Prioritize audit frequency based on:

• Asset criticality and data classification
• Previous finding history
• Regulatory requirements
• Recent security incidents
• Organizational changes

High Risk Areas (Quarterly):

• Access management systems
• Cryptographic key management
• Incident response processes
• Third-party access controls

Medium Risk Areas (Semi-Annual):

• Change management
• Backup and recovery
• Physical security
• Security awareness training

Lower Risk Areas (Annual):

• Documentation management
• Asset inventory
• Business continuity planning

---

Pre-Audit Phase

Documentation Review Checklist

• [ ] ISMS scope statement and boundaries
• [ ] Information security policy (signed, current)
• [ ] Statement of Applicability (SoA)
• [ ] Risk assessment methodology and results
• [ ] Risk treatment plan
• [ ] Security objectives and metrics
• [ ] Previous audit reports and corrective actions

Audit Plan Template

ISMS Audit Plan

Audit ID: ISMS-[YEAR]-[NUMBER]
Scope: [ISMS scope or specific controls]
Date: [Start] to [End]
Lead Auditor: [Name]
Audit Team: [Names]

Day 1:
  09:00 - Opening meeting
  10:00 - Document review (policies, SoA)
  14:00 - Interview: Information Security Manager

Day 2:
  09:00 - Technical control verification
  14:00 - Process observation

Day 3:
  09:00 - Remaining interviews
  14:00 - Finding consolidation
  16:00 - Closing meeting

Auditor Independence

Verify before audit assignment:

• No operational responsibility for audited area
• No recent (12 months) involvement in audited processes
• No conflict of interest with auditees
• Required competencies documented

---

Audit Execution

Evidence Collection Methods

Interview Protocol

1. Introduce audit purpose and confidentiality 2. Explain interview will be documented 3. Ask open-ended questions about processes 4. Request evidence to support statements 5. Clarify any inconsistencies 6. Summarize key points before closing

Sample Interview Questions

For Security Managers:

• Describe the risk assessment process
• How are security incidents reported and managed?
• What metrics track ISMS effectiveness?

For System Administrators:

• How is privileged access managed?
• Walk through the change management process
• Show backup verification records

For End Users:

• What security training have you received?
• How do you report suspicious activity?
• Describe the password policy requirements

Control Testing Procedures

Access Control (A.9): 1. Request user access list for critical system 2. Verify access rights match job roles 3. Check for terminated user accounts 4. Test password policy enforcement 5. Verify MFA configuration

Logging (A.12.4): 1. Confirm logging enabled on systems in scope 2. Verify log retention meets policy 3. Check log protection from tampering 4. Review sample security event alerts

---

Finding Classification

Severity Levels

Finding Documentation

Finding ID: ISMS-2025-001
Control Reference: A.9.2.3 - Management of privileged access
Severity: Major Nonconformity

Evidence:
- 15 shared admin accounts identified
- No approval records for privileged access
- Last access review: 18 months ago

Risk Impact:
- Unauthorized access to critical systems
- No accountability for admin actions
- Regulatory non-compliance

Root Cause:
- No defined process for privileged access management
- Insufficient tooling for access tracking

Recommendation:
- Implement PAM solution within 30 days
- Document and enforce privileged access process
- Conduct immediate access review

Corrective Action Tracking

---

Certification Audit Support

Stage 1 Audit Preparation

Ensure availability of:

• [ ] ISMS documentation (scope, policy, SoA)
• [ ] Risk assessment records
• [ ] Internal audit results from past 12 months
• [ ] Management review minutes
• [ ] Corrective action evidence

Stage 2 Audit Preparation

• [ ] All Stage 1 findings addressed
• [ ] ISMS operational for minimum 3 months
• [ ] Evidence of control effectiveness
• [ ] Training and awareness records
• [ ] Incident response records (if any)

Surveillance Audit Cycle

Audit Findings Response Template

Subject: Response to Finding ISMS-2025-001

Finding: Major Nonconformity - Privileged Access Management

Root Cause Analysis:
[5 Whys or fishbone analysis results]

Corrective Action Plan:
1. [Action] - [Owner] - [Date]
2. [Action] - [Owner] - [Date]

Evidence of Correction:
- [Document/screenshot reference]

Preventive Measures:
- [Steps to prevent recurrence]

Verification Request: [Date auditor can verify]

Security Control Testing Guide

Technical verification procedures for ISO 27002 control assessment.

---

Table of Contents

• Control Testing Approach
• Organizational Controls (A.5)
• People Controls (A.6)
• Physical Controls (A.7)
• Technological Controls (A.8)

---

Control Testing Approach

Testing Methods

Sampling Guidelines

---

Organizational Controls (A.5)

A.5.1 - Policies for Information Security

Test Procedure: 1. Obtain current information security policy 2. Verify management signature and approval date 3. Check policy is accessible to all employees 4. Confirm review within past 12 months 5. Sample 5 employees: verify awareness of policy location

Evidence Required:

• Signed policy document
• Intranet/portal screenshot showing policy access
• Policy review meeting minutes
• Employee acknowledgment records

A.5.15 - Access Control

Test Procedure: 1. Obtain access control policy 2. Select sample of 10 user accounts 3. Verify access rights match job descriptions 4. Check for segregation of duties violations 5. Verify access provisioning follows documented process

Evidence Required:

• Access control policy
• User access matrix
• Access request forms with approvals
• Role definitions

A.5.24 - Information Security Incident Management

Test Procedure: 1. Review incident management procedure 2. Select 3 recent incidents from log 3. Verify incidents followed documented process 4. Check escalation thresholds were respected 5. Confirm lessons learned were documented

Evidence Required:

• Incident response procedure
• Incident tickets with timeline
• Escalation records
• Post-incident review reports

---

People Controls (A.6)

A.6.1 - Screening

Test Procedure: 1. Review background check policy 2. Select 10 recent hires 3. Verify background checks completed before start 4. Check checks match role sensitivity level 5. Confirm records are securely stored

Evidence Required:

• Screening policy
• Background check completion records
• Role risk classification matrix

A.6.3 - Information Security Awareness

Test Procedure: 1. Obtain training program documentation 2. Select sample of 15 employees 3. Verify training completion records 4. Review training content for currency 5. Check phishing simulation results

Evidence Required:

• Training materials and schedule
• LMS completion reports
• Phishing test results
• Training effectiveness metrics

A.6.7 - Remote Working

Test Procedure: 1. Review remote working policy 2. Verify VPN is required for remote access 3. Sample 5 remote worker devices for compliance 4. Check endpoint protection is active 5. Verify secure data handling requirements

Evidence Required:

• Remote working policy
• VPN connection logs
• Endpoint compliance reports
• Remote access agreement signatures

---

Physical Controls (A.7)

A.7.1 - Physical Security Perimeters

Test Procedure: 1. Walk perimeter of secure areas 2. Verify access controls at all entry points 3. Check visitor management process 4. Review after-hours access logs 5. Confirm emergency exits are secure

Evidence Required:

• Site security plan
• Access control system configuration
• Visitor logs
• Guard tour records

A.7.4 - Physical Security Monitoring

Test Procedure: 1. Verify CCTV coverage of critical areas 2. Check recording retention period 3. Review sample of recent alert responses 4. Confirm monitoring is 24/7 or as required 5. Verify footage protection and access controls

Evidence Required:

• CCTV coverage map
• Retention policy and settings
• Alert response records
• Access logs for footage viewing

---

Technological Controls (A.8)

A.8.2 - Privileged Access Rights

Test Procedure: 1. Obtain list of privileged accounts 2. Verify each has documented justification 3. Check separation of admin and user accounts 4. Confirm MFA is required for privileged access 5. Review privileged activity logs

Evidence Required:

• Privileged account inventory
• Access justification records
• PAM solution configuration
• Activity audit logs

A.8.5 - Secure Authentication

Test Procedure: 1. Review password policy configuration 2. Verify MFA enrollment rates 3. Test account lockout after failed attempts 4. Check authentication logging 5. Verify secure authentication protocols (no plaintext)

Evidence Required:

• Password policy settings screenshot
• MFA enrollment report
• Account lockout configuration
• Authentication audit logs

A.8.7 - Protection Against Malware

Test Procedure: 1. Verify endpoint protection coverage 2. Check definition update frequency 3. Review quarantine/detection logs 4. Confirm central management console 5. Test sample detection (EICAR)

Evidence Required:

• Endpoint protection deployment report
• Update status dashboard
• Detection/quarantine logs
• EICAR test results

A.8.8 - Management of Technical Vulnerabilities

Test Procedure: 1. Obtain vulnerability scanning schedule 2. Review recent scan results 3. Verify critical vulnerabilities patched within SLA 4. Check vulnerability tracking system 5. Sample 5 critical findings for remediation evidence

Evidence Required:

• Scanning schedule and scope
• Scan reports with severity breakdown
• Patch deployment records
• Remediation tracking tickets

A.8.13 - Information Backup

Test Procedure: 1. Review backup policy and schedule 2. Verify backup completion logs 3. Check encryption of backup data 4. Request recent restoration test results 5. Verify offsite/cloud backup location

Evidence Required:

• Backup policy
• Backup job completion logs
• Encryption configuration
• Restoration test records

A.8.15 - Logging

Test Procedure: 1. Identify systems requiring logging 2. Verify logging is enabled and configured 3. Check log retention meets requirements 4. Confirm log integrity protection 5. Verify SIEM integration and alerting

Evidence Required:

• Logging requirements matrix
• Log configuration screenshots
• Retention settings
• SIEM alert rules

A.8.24 - Use of Cryptography

Test Procedure: 1. Review cryptography policy 2. Verify encryption at rest configuration 3. Check TLS configuration (version, ciphers) 4. Review key management procedures 5. Verify certificate inventory and expiration tracking

Evidence Required:

• Cryptography policy
• Encryption configuration settings
• SSL/TLS scan results
• Key management procedures
• Certificate inventory