Isms Audit Expert

Name: Isms Audit Expert
Author: borghei

borghei/claude-skills

126 installs
451 repo stars
Updated July 21, 2026
borghei/claude-skills

Prepare ISO 27001 ISMS controls, gap analyses, risk treatments, evidence packs, and audit responses for information security certification and enterprise compliance reviews.

About

Guides ISO 27001 ISMS audits with control mapping, gap analyses, risk treatment plans, policy reviews, and evidence preparation so teams pass information security certification and enterprise compliance checks.

ISO 27001 control mapping
ISMS gap analysis and remediation
Risk treatment planning
Audit evidence preparation
Security policy and procedure review

Isms Audit Expert by the numbers

126 all-time installs (skills.sh)
Ranked #935 of 2,203 Security skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

npx skills add https://github.com/borghei/claude-skills --skill isms-audit-expert

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/borghei/claude-skills/isms-audit-expert.svg)](https://skillselion.com/skills/borghei/claude-skills/isms-audit-expert)

Installs	126
repo stars	★ 451
Last updated	July 21, 2026
Repository	borghei/claude-skills ↗

What it does

Prepare ISO 27001 ISMS controls, gap analyses, risk treatments, evidence packs, and audit responses for information security certification and enterprise compliance reviews.

Files

SKILL.mdMarkdownGitHub ↗

ISMS Audit Expert

Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.

---

Audit Program Management

Risk-Based Audit Schedule

Risk Level	Audit Frequency	Examples
Critical	Quarterly	Privileged access, vulnerability management, logging
High	Semi-annual	Access control, incident response, encryption
Medium	Annual	Policies, awareness training, physical security
Low	Annual	Documentation, asset inventory

Workflow: Annual Audit Planning

1. Review prior audit results -- analyze previous findings, open items, and risk assessment outputs from the most recent cycle. 2. Identify high-risk controls -- flag controls involved in recent security incidents or with outstanding nonconformities. 3. Determine audit scope -- define ISMS boundaries, confirm Statement of Applicability (SoA) coverage for the certification cycle. 4. Assign auditors -- ensure independence from audited areas; verify auditor competency (ISO 27001 Lead Auditor certification preferred). 5. Create audit schedule -- allocate resources, assign dates, and distribute across the year by risk priority. 6. Obtain management approval for the finalized audit plan. 7. Validation checkpoint: Audit plan covers all 93 Annex A controls within the certification cycle; schedule approved by management; auditor independence confirmed.

Example: Annual Audit Plan Output

ISMS AUDIT PLAN 2026

Prepared by: Information Security Manager
Approved by: CISO
Date: 2026-01-15

Q1 2026 (January-March)
  Scope: Privileged access (A.8.2, A.8.18), Logging (A.8.15, A.8.16)
  Auditor: External consultant (independence required)
  Risk level: Critical

Q2 2026 (April-June)
  Scope: Access control (A.8.3-A.8.5), Incident response (A.5.24-A.5.28)
  Auditor: Internal audit team
  Risk level: High

Q3 2026 (July-September)
  Scope: Physical security (A.7.1-A.7.14), HR security (A.6.1-A.6.8)
  Auditor: Internal audit team
  Risk level: Medium

Q4 2026 (October-December)
  Scope: Policies (A.5.1-A.5.8), Asset management (A.5.9-A.5.14)
  Auditor: Internal audit team
  Risk level: Medium-Low

Coverage: 93/93 Annex A controls scheduled across 4 quarters

---

Audit Execution

Workflow: Pre-Audit Preparation

1. Review ISMS documentation -- policies, Statement of Applicability, risk assessment, and risk treatment plan. 2. Analyze previous audit reports -- note open findings and areas requiring follow-up. 3. Prepare audit plan -- define interview schedule, control sample, and evidence requirements. 4. Notify auditees -- communicate scope, timing, and documentation needed at least 2 weeks in advance. 5. Prepare control-specific checklists for all controls in scope. 6. Validation checkpoint: All documentation received and reviewed before the opening meeting.

Workflow: Audit Conduct

1. Opening Meeting -- confirm scope, introduce audit team, agree on communication channels and logistics. 2. Evidence Collection -- interview control owners, review documentation and records, observe processes in operation, inspect technical configurations. 3. Control Verification -- test control design (does it address the risk?), test control operation (is it working as intended?), sample transactions and records, document all evidence. 4. Closing Meeting -- present preliminary findings, clarify factual inaccuracies, agree on finding classification, confirm corrective action timelines. 5. Validation checkpoint: All controls in scope assessed with documented evidence; findings classified and communicated.

Evidence Collection Methods

Method	Use Case	Example
Inquiry	Process understanding	Interview Security Manager about incident response
Observation	Operational verification	Watch visitor sign-in process at reception
Inspection	Documentation review	Check access approval records for last quarter
Re-performance	Control testing	Attempt login with weak password to verify policy enforcement

---

Control Assessment

ISO 27002 Control Categories

Organizational Controls (A.5): Information security policies, roles and responsibilities, segregation of duties, contact with authorities, threat intelligence, information security in projects.

People Controls (A.6): Screening and background checks, employment terms, security awareness and training, disciplinary process, remote working security.

Physical Controls (A.7): Physical security perimeters, entry controls, securing offices and facilities, physical security monitoring, equipment protection.

Technological Controls (A.8): User endpoint devices, privileged access rights, access restriction, secure authentication, malware protection, vulnerability management, backup and recovery, logging and monitoring, network security, cryptography.

Workflow: Control Testing

1. Identify control objective from the relevant ISO 27002 clause. 2. Determine testing method -- inquiry, observation, inspection, or re-performance based on control type. 3. Define sample size -- base on population size and risk level (e.g., 25 samples for quarterly access reviews, 5 for annual policy reviews). 4. Execute test and document results with specific evidence references. 5. Evaluate control effectiveness -- effective, partially effective, or ineffective. 6. Validation checkpoint: Evidence supports conclusion; finding documented if control is not fully effective.

Example: Control Test Working Paper

CONTROL TEST WORKING PAPER

Control: A.8.2 - Privileged access rights
Objective: Privileged access is restricted and managed
Test date: 2026-03-10
Auditor: J. Smith

Test procedure:
  1. Obtained list of privileged accounts from IAM system (42 accounts)
  2. Selected sample of 10 accounts (25% sample rate)
  3. For each account, verified:
     - Documented business justification exists
     - Manager approval on file
     - Quarterly access review completed
     - No dormant accounts (last login within 90 days)

Results:
  - 8/10 accounts: All criteria met (PASS)
  - 1/10: Missing quarterly review for Q4 2025 (MINOR NC)
  - 1/10: No documented business justification (MINOR NC)

Conclusion: Control partially effective - minor nonconformity raised
Finding reference: ISMS-2026-007

---

Finding Management

Finding Classification

Severity	Definition	Response Time
Major Nonconformity	Control failure creating significant risk	30 days
Minor Nonconformity	Isolated deviation with limited impact	90 days
Observation	Improvement opportunity	Next audit cycle

Finding Documentation Template

Finding ID: ISMS-2026-007
Control Reference: A.8.2 - Privileged access rights
Severity: Minor Nonconformity

Evidence:
- 1 of 10 sampled privileged accounts missing Q4 2025 review
- 1 of 10 sampled accounts lacks documented business justification
- Screenshots of IAM records and review log exported 2026-03-10

Risk Impact:
- Unreviewed privileged access increases insider threat exposure
- Non-justified accounts may represent unnecessary attack surface

Root Cause:
- Access review process relies on manual tracking; no automated reminder

Recommendation:
- Implement automated quarterly review reminders via IAM platform
- Require business justification field as mandatory in provisioning workflow
- Backfill missing reviews within 14 days

Workflow: Corrective Action

1. Auditee acknowledges finding and severity classification. 2. Root cause analysis completed within 10 business days. 3. Corrective action plan submitted with target dates and responsible owners. 4. Actions implemented by responsible parties per the plan. 5. Auditor verifies effectiveness -- re-tests control with fresh evidence. 6. Finding closed with documented evidence of resolution. 7. Validation checkpoint: Root cause addressed; recurrence prevented; evidence of effective correction on file.

---

Certification Support

Stage 1 Audit Preparation Checklist

[ ] ISMS scope statement finalized
[ ] Information security policy (management signed)
[ ] Statement of Applicability (SoA) complete
[ ] Risk assessment methodology and results documented
[ ] Risk treatment plan current
[ ] Internal audit results available (past 12 months)
[ ] Management review minutes on file

Stage 2 Audit Preparation Checklist

[ ] All Stage 1 findings addressed and closed
[ ] ISMS operational for minimum 3 months
[ ] Evidence of control implementation across all SoA controls
[ ] Security awareness training records for all personnel
[ ] Incident response evidence (if incidents occurred)
[ ] Access review documentation for the audit period

Surveillance Audit Cycle

Period	Focus
Year 1, Q2	High-risk controls, Stage 2 findings follow-up
Year 1, Q4	Continual improvement, control sample
Year 2, Q2	Full surveillance
Year 2, Q4	Re-certification preparation

---

Tools

Script	Purpose	Usage
`isms_audit_scheduler.py`	Generate risk-based audit plans	`python scripts/isms_audit_scheduler.py --year 2026 --format markdown`

# Generate annual audit plan
python scripts/isms_audit_scheduler.py --year 2026 --output audit_plan.json

# With custom control risk ratings
python scripts/isms_audit_scheduler.py --controls controls.csv --format markdown

# Generate plan for specific quarters only
python scripts/isms_audit_scheduler.py --year 2026 --quarters Q1 Q2 --format json

---

References

File	Content
iso27001-audit-methodology.md	Audit program structure, pre-audit phase, certification support
security-control-testing.md	Technical verification procedures for ISO 27002 controls
cloud-security-audit.md	Cloud provider assessment, configuration security, IAM review

---

Audit Performance Metrics

KPI	Target	Measurement
Audit plan completion	100%	Audits completed vs. planned
Finding closure rate	>90% within SLA	Closed on time vs. total
Major nonconformities	0 at certification	Count per certification cycle
Audit effectiveness	Incidents prevented	Security improvements implemented

---

Compliance Framework Integration

Framework	ISMS Audit Relevance
GDPR	A.5.34 Privacy, A.8.10 Information deletion
HIPAA	Access controls, audit logging, encryption
PCI DSS	Network security, access control, monitoring
SOC 2	Trust Services Criteria mapped to ISO 27002

---

Troubleshooting

Problem	Possible Cause	Resolution
Audit plan does not cover all 93 Annex A controls within the certification cycle	Controls not inventoried against the 2022 four-theme structure or risk-based scheduling gaps	Use `isms_audit_scheduler.py` with a complete controls CSV covering all 93 controls; ensure the 3-year cycle allocates quarterly audits for critical controls and annual coverage for all others
Major nonconformity found during certification audit	Systemic control failure or complete absence of a required ISMS element	Conduct immediate root cause analysis; develop corrective action plan with 30-day target; re-test the control with fresh evidence; schedule verification audit with certification body
Auditor independence challenged by certification body	Internal auditors assigned to areas they manage or operate	Establish clear auditor independence policy; never assign auditors to areas they are responsible for; consider external consultants for high-risk control areas; document independence verification for each audit
Evidence collection incomplete for technological controls (A.8)	Technical configurations not captured, logs not retained, or screenshots not timestamped	Prepare control-specific evidence checklists before audit; request system administrators to export configurations; ensure log retention covers the audit period; timestamp all evidence artifacts
Finding closure rate below 90% target	Corrective actions not prioritized, unclear ownership, or insufficient follow-up	Assign specific owners with due dates for every finding; implement automated tracking with escalation at 50% and 75% of SLA; conduct monthly corrective action reviews
Surveillance audit identifies regression in previously passed controls	Controls degraded after initial certification due to staff changes, system updates, or process drift	Implement continuous compliance monitoring (not just annual checks); schedule monthly control spot-checks for high-risk areas; include control effectiveness in management review
Sample-based testing misses systemic issues	Sample size too small or selection biased toward known-good records	Calculate sample size based on population and risk level (minimum 25 for quarterly reviews); use random selection methods; increase sample for areas with prior findings

---

Success Criteria

Audit plan completion rate of 100% -- all scheduled audits executed within the planned quarter, with no deferrals or cancellations without management approval
Zero major nonconformities at certification/surveillance audits -- all systemic control failures identified and corrected during internal audits before external assessment
Finding closure rate above 90% within SLA -- major nonconformities closed within 30 days, minor within 90 days, observations addressed by next audit cycle
All 93 Annex A controls audited within the 3-year certification cycle -- with critical controls (A.8.2, A.8.5, A.8.8, A.8.15) audited quarterly and high-risk controls semi-annually
Audit evidence documented with specific references -- every finding includes control reference, evidence type (inquiry/observation/inspection/re-performance), sample details, and conclusion
Auditor competency verified -- all assigned auditors have ISO 27001 Lead Auditor certification or equivalent, with independence confirmed for each audit engagement

---

Scope & Limitations

In Scope:

Risk-based annual audit planning and scheduling across all 93 ISO 27001:2022 Annex A controls
Audit execution workflows including pre-audit preparation, evidence collection, control testing, and closing meetings
Finding management with severity classification (Major NC, Minor NC, Observation) and corrective action tracking
Certification support for Stage 1 (documentation review) and Stage 2 (implementation effectiveness) audits
Surveillance audit preparation and recertification planning
Control-specific testing procedures for organizational, people, physical, and technological control themes
Audit performance metrics and KPI tracking

Out of Scope:

Actual certification body selection, engagement, or fee negotiation
Technical penetration testing or vulnerability scanning -- use infrastructure-compliance-auditor for technical checks
ISO 27001 ISMS implementation -- use information-security-manager-iso27001 for implementation guidance
SOC 2 or other framework-specific audit execution beyond ISO 27001 cross-reference
Legal or contractual advice on audit findings or regulatory reporting obligations

Important Notes:

ISO 27001:2013 certifications expired after October 2025; all audits must now conform to the 2022 edition with 93 controls across 4 themes
81% of organizations are pursuing ISO 27001 certification as of 2025 (up from 67% in 2024), reflecting heightened market demand for certified security programs
Best practice is to embed ISMS audit findings into continuous improvement rather than treating audits as periodic compliance events

---

Integration Points

Skill	Integration	When to Use
`information-security-manager-iso27001`	ISMS implementation provides the controls and documentation that audits assess	When audit findings require control improvements or ISMS enhancements
`infrastructure-compliance-auditor`	Technical infrastructure checks provide audit evidence for Annex A technological controls	When audit requires evidence of A.8 technological control implementation
`soc2-compliance-expert`	SOC 2 audit evidence and Trust Services Criteria overlap with ISO 27001 controls	When organization maintains both ISO 27001 and SOC 2 compliance programs
`capa-officer`	Audit findings requiring formal corrective action feed into CAPA process	When major nonconformities require structured root cause analysis and corrective action

---

Tool Reference

isms_audit_scheduler.py

Generates risk-based annual audit plans with quarterly scheduling based on control risk ratings.

Flag	Required	Description
`--year <year>`	No	Target year for audit plan (default: current year)
`--controls <file>`	No	CSV file with custom control risk ratings (columns: `control_id`, `name`, `risk`); defaults to built-in risk ratings for 18 key controls
`--quarters <list>`	No	Generate plan for specific quarters only (e.g., `--quarters Q1 Q2`)
`--format <fmt>`	No	Output format: `json` (default) or `markdown`
`--output <file>`	No	Export audit plan to specified file path

Audit Frequency by Risk Level:

critical: Quarterly (4x per year) -- e.g., A.8.2 Privileged access, A.8.5 Authentication, A.8.8 Vulnerabilities, A.8.15 Logging
high: Semi-annual (2x per year) -- e.g., A.5.15 Access control, A.5.24 Incident management, A.8.7 Malware protection
medium: Annual (1x per year) -- e.g., A.5.1 Policies, A.6.3 Awareness training, A.7.1 Physical perimeters
low: Annual (1x per year) -- e.g., Documentation, asset inventory

Output: Quarterly audit schedule with control assignments, auditor allocation guidance, risk-based prioritization, and coverage tracking ensuring all controls are scheduled within the certification cycle.

Cloud Security Audit Guide

Assessment framework for cloud service security verification.

---

Shared Responsibility Model
Cloud Provider Assessment
Configuration Security
Data Protection
Identity and Access Management

---

Shared Responsibility Model

Responsibility Matrix

Layer	IaaS	PaaS	SaaS
Data classification	Customer	Customer	Customer
Identity management	Customer	Customer	Shared
Application security	Customer	Shared	Provider
Network controls	Shared	Provider	Provider
Host infrastructure	Provider	Provider	Provider
Physical security	Provider	Provider	Provider

Audit Focus by Model

IaaS (AWS EC2, Azure VMs):

Virtual network configuration
OS hardening and patching
Application deployment security
Data encryption implementation

PaaS (Azure App Service, AWS Lambda):

Application code security
Data handling and encryption
Identity integration
Logging configuration

SaaS (Microsoft 365, Salesforce):

User access management
Data classification and handling
Security configuration settings
Integration security

---

Cloud Provider Assessment

Certification Verification

Check for current certifications:

[ ] ISO 27001 (Information Security)
[ ] ISO 27017 (Cloud Security)
[ ] ISO 27018 (Cloud Privacy)
[ ] SOC 2 Type II
[ ] CSA STAR certification

Verification Steps: 1. Request current certificates from provider 2. Verify certificate scope includes services used 3. Check certification expiration dates 4. Review SOC 2 report for relevant controls 5. Document any scope exclusions

Data Residency Compliance

Requirement	Verification
GDPR (EU data)	Confirm EU region availability
Data sovereignty	Verify no cross-border transfer
Backup location	Confirm backup region
Disaster recovery	Document DR site location

Provider Security Documentation

Request and review:

Shared responsibility documentation
Security whitepapers
Incident notification procedures
SLA for security incidents
Vulnerability disclosure policy

---

Configuration Security

AWS Security Assessment

Identity and Access (IAM):

[ ] Root account has MFA enabled
[ ] No access keys for root account
[ ] IAM policies follow least privilege
[ ] No wildcard (*) permissions on sensitive resources
[ ] Password policy meets requirements

Network Configuration (VPC):

[ ] Default VPCs removed or secured
[ ] Security groups follow least privilege
[ ] No 0.0.0.0/0 ingress on management ports
[ ] VPC flow logs enabled
[ ] Network ACLs configured appropriately

Storage (S3):

[ ] No public buckets (unless intended)
[ ] Bucket policies restrict access
[ ] Encryption at rest enabled
[ ] Versioning enabled for critical data
[ ] Access logging enabled

Logging (CloudTrail):

[ ] CloudTrail enabled in all regions
[ ] Log file validation enabled
[ ] Logs encrypted with KMS
[ ] S3 bucket for logs is secured
[ ] CloudWatch alarms configured

Azure Security Assessment

Identity (Azure AD):

[ ] MFA enabled for all users
[ ] Privileged Identity Management (PIM) configured
[ ] Conditional Access policies defined
[ ] Guest access restricted
[ ] Password protection enabled

Network (Virtual Networks):

[ ] NSG rules follow least privilege
[ ] No open management ports to internet
[ ] Network Watcher enabled
[ ] DDoS protection configured
[ ] Private endpoints for PaaS services

Storage:

[ ] No anonymous access to blob storage
[ ] Encryption at rest enabled
[ ] Shared access signatures time-limited
[ ] Storage analytics logging enabled
[ ] Soft delete enabled

Monitoring:

[ ] Azure Monitor enabled
[ ] Activity log exported to SIEM
[ ] Alerts configured for security events
[ ] Azure Security Center enabled
[ ] Diagnostic settings configured

---

Data Protection

Encryption Verification

At Rest:

Service	Encryption Check
Block storage	Verify CMK or provider-managed key
Object storage	Check default encryption settings
Databases	Confirm TDE or column encryption
Backups	Verify backup encryption

In Transit:

Connection	Requirement
User to application	TLS 1.2+ required
Service to service	Internal TLS or VPN
API communications	HTTPS only, no HTTP
Database connections	TLS required

Key Management Assessment

[ ] Customer-managed keys used for sensitive data
[ ] Key rotation policy defined and implemented
[ ] Key access restricted to authorized services
[ ] Key usage logged and monitored
[ ] Disaster recovery for keys documented

Data Classification in Cloud

Classification	Cloud Requirements
Confidential	CMK encryption, access logging, no public access
Internal	Encryption enabled, network restrictions
Public	Integrity protection, CDN appropriate

---

Identity and Access Management

Privileged Access Review

1. Identify all administrative roles 2. Verify role assignment justification 3. Check for standing vs. just-in-time access 4. Review privileged activity logs 5. Confirm MFA required for elevation

Service Account Assessment

Check	Verification
Inventory	All service accounts documented
Permissions	Least privilege applied
Credentials	Keys rotated per policy
Monitoring	Activity logged and reviewed
Ownership	Clear owner assigned

Federation and SSO

[ ] SSO configured for cloud console access
[ ] Conditional Access/MFA policies applied
[ ] Session timeout configured
[ ] Failed login monitoring enabled
[ ] Emergency access accounts documented

API Security

[ ] API keys not embedded in code
[ ] Secrets management service used
[ ] API access logged
[ ] Rate limiting configured
[ ] API permissions follow least privilege

ISO 27001 ISMS Audit Methodology

Complete audit framework and procedures for Information Security Management System assessments.

---

Audit Program Structure
Pre-Audit Phase
Audit Execution
Finding Classification
Certification Audit Support

---

Audit Program Structure

Annual Audit Schedule

Quarter	Focus Area	Audit Type
Q1	Access Control, Cryptography	Internal
Q2	Operations Security, Communications	Internal
Q3	System Acquisition, Supplier Relations	Internal
Q4	Full ISMS Review	Pre-certification

Risk-Based Scheduling

Prioritize audit frequency based on:

Asset criticality and data classification
Previous finding history
Regulatory requirements
Recent security incidents
Organizational changes

High Risk Areas (Quarterly):

Access management systems
Cryptographic key management
Incident response processes
Third-party access controls

Medium Risk Areas (Semi-Annual):

Change management
Backup and recovery
Physical security
Security awareness training

Lower Risk Areas (Annual):

Documentation management
Asset inventory
Business continuity planning

---

Pre-Audit Phase

Documentation Review Checklist

[ ] ISMS scope statement and boundaries
[ ] Information security policy (signed, current)
[ ] Statement of Applicability (SoA)
[ ] Risk assessment methodology and results
[ ] Risk treatment plan
[ ] Security objectives and metrics
[ ] Previous audit reports and corrective actions

Audit Plan Template

ISMS Audit Plan

Audit ID: ISMS-[YEAR]-[NUMBER]
Scope: [ISMS scope or specific controls]
Date: [Start] to [End]
Lead Auditor: [Name]
Audit Team: [Names]

Day 1:
  09:00 - Opening meeting
  10:00 - Document review (policies, SoA)
  14:00 - Interview: Information Security Manager

Day 2:
  09:00 - Technical control verification
  14:00 - Process observation

Day 3:
  09:00 - Remaining interviews
  14:00 - Finding consolidation
  16:00 - Closing meeting

Auditor Independence

Verify before audit assignment:

No operational responsibility for audited area
No recent (12 months) involvement in audited processes
No conflict of interest with auditees
Required competencies documented

---

Audit Execution

Evidence Collection Methods

Method	Use Case	Evidence Type
Document review	Policy verification	Screenshots, copies
Interviews	Process understanding	Notes, recordings
Observation	Operational checks	Photos, timestamps
Technical testing	Control effectiveness	System logs, reports

Interview Protocol

1. Introduce audit purpose and confidentiality 2. Explain interview will be documented 3. Ask open-ended questions about processes 4. Request evidence to support statements 5. Clarify any inconsistencies 6. Summarize key points before closing

Sample Interview Questions

For Security Managers:

Describe the risk assessment process
How are security incidents reported and managed?
What metrics track ISMS effectiveness?

For System Administrators:

How is privileged access managed?
Walk through the change management process
Show backup verification records

For End Users:

What security training have you received?
How do you report suspicious activity?
Describe the password policy requirements

Control Testing Procedures

Access Control (A.9): 1. Request user access list for critical system 2. Verify access rights match job roles 3. Check for terminated user accounts 4. Test password policy enforcement 5. Verify MFA configuration

Logging (A.12.4): 1. Confirm logging enabled on systems in scope 2. Verify log retention meets policy 3. Check log protection from tampering 4. Review sample security event alerts

---

Finding Classification

Severity Levels

Level	Definition	Response Time
Major Nonconformity	Failure of control, significant risk	30 days corrective action
Minor Nonconformity	Isolated deviation, limited impact	90 days corrective action
Observation	Improvement opportunity	Next audit cycle
Good Practice	Exceeds requirements	Document and share

Finding Documentation

Finding ID: ISMS-2025-001
Control Reference: A.9.2.3 - Management of privileged access
Severity: Major Nonconformity

Evidence:
- 15 shared admin accounts identified
- No approval records for privileged access
- Last access review: 18 months ago

Risk Impact:
- Unauthorized access to critical systems
- No accountability for admin actions
- Regulatory non-compliance

Root Cause:
- No defined process for privileged access management
- Insufficient tooling for access tracking

Recommendation:
- Implement PAM solution within 30 days
- Document and enforce privileged access process
- Conduct immediate access review

Corrective Action Tracking

Field	Content
Finding ID	Link to original finding
Root Cause	Why the nonconformity occurred
Corrective Action	Specific steps to address
Responsible Person	Named accountable party
Target Date	Completion deadline
Verification Method	How closure will be confirmed
Status	Open / In Progress / Closed

---

Certification Audit Support

Stage 1 Audit Preparation

Ensure availability of:

[ ] ISMS documentation (scope, policy, SoA)
[ ] Risk assessment records
[ ] Internal audit results from past 12 months
[ ] Management review minutes
[ ] Corrective action evidence

Stage 2 Audit Preparation

[ ] All Stage 1 findings addressed
[ ] ISMS operational for minimum 3 months
[ ] Evidence of control effectiveness
[ ] Training and awareness records
[ ] Incident response records (if any)

Surveillance Audit Cycle

Year	Quarter	Focus
Year 1	Q2	High-risk controls, Stage 2 findings
Year 1	Q4	Remaining controls sample
Year 2	Q2	Full surveillance
Year 2	Q4	Continual improvement evidence
Year 3	Q2	Re-certification preparation

Audit Findings Response Template

Subject: Response to Finding ISMS-2025-001

Finding: Major Nonconformity - Privileged Access Management

Root Cause Analysis:
[5 Whys or fishbone analysis results]

Corrective Action Plan:
1. [Action] - [Owner] - [Date]
2. [Action] - [Owner] - [Date]

Evidence of Correction:
- [Document/screenshot reference]

Preventive Measures:
- [Steps to prevent recurrence]

Verification Request: [Date auditor can verify]

Security Control Testing Guide

Technical verification procedures for ISO 27002 control assessment.

---

Control Testing Approach
Organizational Controls (A.5)
People Controls (A.6)
Physical Controls (A.7)
Technological Controls (A.8)

---

Control Testing Approach

Testing Methods

Method	Description	When to Use
Inquiry	Interview control owners	All controls
Observation	Watch process execution	Operational controls
Inspection	Review documentation/config	Policy controls
Re-performance	Execute control procedure	Critical controls

Sampling Guidelines

Population Size	Sample Size
1-10	All items
11-50	10 items
51-250	15 items
251+	25 items

---

Organizational Controls (A.5)

A.5.1 - Policies for Information Security

Test Procedure: 1. Obtain current information security policy 2. Verify management signature and approval date 3. Check policy is accessible to all employees 4. Confirm review within past 12 months 5. Sample 5 employees: verify awareness of policy location

Evidence Required:

Signed policy document
Intranet/portal screenshot showing policy access
Policy review meeting minutes
Employee acknowledgment records

A.5.15 - Access Control

Test Procedure: 1. Obtain access control policy 2. Select sample of 10 user accounts 3. Verify access rights match job descriptions 4. Check for segregation of duties violations 5. Verify access provisioning follows documented process

Evidence Required:

Access control policy
User access matrix
Access request forms with approvals
Role definitions

A.5.24 - Information Security Incident Management

Test Procedure: 1. Review incident management procedure 2. Select 3 recent incidents from log 3. Verify incidents followed documented process 4. Check escalation thresholds were respected 5. Confirm lessons learned were documented

Evidence Required:

Incident response procedure
Incident tickets with timeline
Escalation records
Post-incident review reports

---

People Controls (A.6)

A.6.1 - Screening

Test Procedure: 1. Review background check policy 2. Select 10 recent hires 3. Verify background checks completed before start 4. Check checks match role sensitivity level 5. Confirm records are securely stored

Evidence Required:

Screening policy
Background check completion records
Role risk classification matrix

A.6.3 - Information Security Awareness

Test Procedure: 1. Obtain training program documentation 2. Select sample of 15 employees 3. Verify training completion records 4. Review training content for currency 5. Check phishing simulation results

Evidence Required:

Training materials and schedule
LMS completion reports
Phishing test results
Training effectiveness metrics

A.6.7 - Remote Working

Test Procedure: 1. Review remote working policy 2. Verify VPN is required for remote access 3. Sample 5 remote worker devices for compliance 4. Check endpoint protection is active 5. Verify secure data handling requirements

Evidence Required:

Remote working policy
VPN connection logs
Endpoint compliance reports
Remote access agreement signatures

---

Physical Controls (A.7)

A.7.1 - Physical Security Perimeters

Test Procedure: 1. Walk perimeter of secure areas 2. Verify access controls at all entry points 3. Check visitor management process 4. Review after-hours access logs 5. Confirm emergency exits are secure

Evidence Required:

Site security plan
Access control system configuration
Visitor logs
Guard tour records

A.7.4 - Physical Security Monitoring

Test Procedure: 1. Verify CCTV coverage of critical areas 2. Check recording retention period 3. Review sample of recent alert responses 4. Confirm monitoring is 24/7 or as required 5. Verify footage protection and access controls

Evidence Required:

CCTV coverage map
Retention policy and settings
Alert response records
Access logs for footage viewing

---

Technological Controls (A.8)

A.8.2 - Privileged Access Rights

Test Procedure: 1. Obtain list of privileged accounts 2. Verify each has documented justification 3. Check separation of admin and user accounts 4. Confirm MFA is required for privileged access 5. Review privileged activity logs

Evidence Required:

Privileged account inventory
Access justification records
PAM solution configuration
Activity audit logs

A.8.5 - Secure Authentication

Test Procedure: 1. Review password policy configuration 2. Verify MFA enrollment rates 3. Test account lockout after failed attempts 4. Check authentication logging 5. Verify secure authentication protocols (no plaintext)

Evidence Required:

Password policy settings screenshot
MFA enrollment report
Account lockout configuration
Authentication audit logs

A.8.7 - Protection Against Malware

Test Procedure: 1. Verify endpoint protection coverage 2. Check definition update frequency 3. Review quarantine/detection logs 4. Confirm central management console 5. Test sample detection (EICAR)

Evidence Required:

Endpoint protection deployment report
Update status dashboard
Detection/quarantine logs
EICAR test results

A.8.8 - Management of Technical Vulnerabilities

Test Procedure: 1. Obtain vulnerability scanning schedule 2. Review recent scan results 3. Verify critical vulnerabilities patched within SLA 4. Check vulnerability tracking system 5. Sample 5 critical findings for remediation evidence

Evidence Required:

Scanning schedule and scope
Scan reports with severity breakdown
Patch deployment records
Remediation tracking tickets

A.8.13 - Information Backup

Test Procedure: 1. Review backup policy and schedule 2. Verify backup completion logs 3. Check encryption of backup data 4. Request recent restoration test results 5. Verify offsite/cloud backup location

Evidence Required:

Backup policy
Backup job completion logs
Encryption configuration
Restoration test records

A.8.15 - Logging

Test Procedure: 1. Identify systems requiring logging 2. Verify logging is enabled and configured 3. Check log retention meets requirements 4. Confirm log integrity protection 5. Verify SIEM integration and alerting

Evidence Required:

Logging requirements matrix
Log configuration screenshots
Retention settings
SIEM alert rules

A.8.24 - Use of Cryptography

Test Procedure: 1. Review cryptography policy 2. Verify encryption at rest configuration 3. Check TLS configuration (version, ciphers) 4. Review key management procedures 5. Verify certificate inventory and expiration tracking

Evidence Required:

Cryptography policy
Encryption configuration settings
SSL/TLS scan results
Key management procedures
Certificate inventory

#!/usr/bin/env python3
"""
ISMS Audit Scheduler

Risk-based audit planning and scheduling for ISO 27001 compliance.
Generates annual audit plans based on control risk ratings.

Usage:
    python isms_audit_scheduler.py --year 2025 --output audit_plan.json
    python isms_audit_scheduler.py --controls controls.csv --format markdown
"""

import argparse
import csv
import json
import sys
from datetime import datetime, timedelta
from typing import Dict, List, Any, Optional


# ISO 27001:2022 Annex A control domains
CONTROL_DOMAINS = {
    "A.5": {"name": "Organizational Controls", "count": 37},
    "A.6": {"name": "People Controls", "count": 8},
    "A.7": {"name": "Physical Controls", "count": 14},
    "A.8": {"name": "Technological Controls", "count": 34},
}

# Default risk ratings for control areas
DEFAULT_RISK_RATINGS = {
    "A.5.1": {"name": "Policies for information security", "risk": "medium"},
    "A.5.2": {"name": "Information security roles", "risk": "medium"},
    "A.5.15": {"name": "Access control", "risk": "high"},
    "A.5.24": {"name": "Incident management planning", "risk": "high"},
    "A.5.25": {"name": "Assessment of security events", "risk": "high"},
    "A.6.1": {"name": "Screening", "risk": "medium"},
    "A.6.3": {"name": "Information security awareness", "risk": "medium"},
    "A.6.7": {"name": "Remote working", "risk": "high"},
    "A.7.1": {"name": "Physical security perimeters", "risk": "medium"},
    "A.7.4": {"name": "Physical security monitoring", "risk": "medium"},
    "A.8.2": {"name": "Privileged access rights", "risk": "critical"},
    "A.8.5": {"name": "Secure authentication", "risk": "critical"},
    "A.8.7": {"name": "Protection against malware", "risk": "high"},
    "A.8.8": {"name": "Management of vulnerabilities", "risk": "critical"},
    "A.8.13": {"name": "Information backup", "risk": "high"},
    "A.8.15": {"name": "Logging", "risk": "critical"},
    "A.8.20": {"name": "Networks security", "risk": "high"},
    "A.8.24": {"name": "Use of cryptography", "risk": "high"},
}

# Audit frequency based on risk level
AUDIT_FREQUENCY = {
    "critical": 4,  # Quarterly
    "high": 2,      # Semi-annual
    "medium": 1,    # Annual
    "low": 1,       # Annual
}


def load_controls_from_csv(filepath: str) -> Dict[str, Dict]:
    """Load control risk ratings from CSV file."""
    controls = {}
    try:
        with open(filepath, "r", encoding="utf-8") as f:
            reader = csv.DictReader(f)
            for row in reader:
                control_id = row.get("control_id", row.get("id", ""))
                if control_id:
                    controls[control_id] = {
                        "name": row.get("name", "Unknown"),
                        "risk": row.get("risk", "medium").lower(),
                    }
    except FileNotFoundError:
        print(f"Error: File not found: {filepath}", file=sys.stderr)
        sys.exit(1)
    return controls


def calculate_audit_dates(
    year: int,
    frequency: int
) -> List[str]:
    """Calculate audit dates based on frequency."""
    dates = []
    interval = 12 // frequency
    for i in range(frequency):
        month = (i * interval) + 2  # Start in February
        if month > 12:
            month = month - 12
        date = datetime(year, month, 15)
        dates.append(date.strftime("%Y-%m-%d"))
    return dates


def generate_audit_plan(
    year: int,
    controls: Optional[Dict[str, Dict]] = None
) -> Dict[str, Any]:
    """Generate risk-based annual audit plan."""
    if controls is None:
        controls = DEFAULT_RISK_RATINGS

    plan = {
        "metadata": {
            "year": year,
            "generated": datetime.now().isoformat(),
            "methodology": "ISO 27001 Risk-Based Internal Auditing",
            "total_controls": len(controls),
        },
        "schedule": {
            "Q1": {"month": "February-March", "audits": []},
            "Q2": {"month": "May-June", "audits": []},
            "Q3": {"month": "August-September", "audits": []},
            "Q4": {"month": "November", "audits": []},
        },
        "controls": {},
    }

    # Assign controls to quarters based on risk
    for control_id, control_data in controls.items():
        risk = control_data.get("risk", "medium")
        frequency = AUDIT_FREQUENCY.get(risk, 1)
        audit_dates = calculate_audit_dates(year, frequency)

        plan["controls"][control_id] = {
            "name": control_data.get("name", "Unknown"),
            "risk": risk,
            "frequency": frequency,
            "scheduled_audits": audit_dates,
        }

        # Add to quarterly schedule
        for i, date in enumerate(audit_dates):
            month = int(date.split("-")[1])
            if month <= 3:
                quarter = "Q1"
            elif month <= 6:
                quarter = "Q2"
            elif month <= 9:
                quarter = "Q3"
            else:
                quarter = "Q4"

            plan["schedule"][quarter]["audits"].append({
                "control_id": control_id,
                "control_name": control_data.get("name", "Unknown"),
                "risk_level": risk,
                "target_date": date,
            })

    # Sort audits within each quarter
    for quarter in plan["schedule"]:
        plan["schedule"][quarter]["audits"].sort(
            key=lambda x: (
                {"critical": 0, "high": 1, "medium": 2, "low": 3}.get(x["risk_level"], 4),
                x["target_date"]
            )
        )

    # Calculate summary statistics
    risk_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
    total_audits = 0
    for control_data in plan["controls"].values():
        risk_counts[control_data["risk"]] += 1
        total_audits += control_data["frequency"]

    plan["summary"] = {
        "total_controls_in_scope": len(controls),
        "total_audits_planned": total_audits,
        "risk_distribution": risk_counts,
        "audits_per_quarter": {
            q: len(plan["schedule"][q]["audits"])
            for q in plan["schedule"]
        },
    }

    return plan


def format_markdown(plan: Dict[str, Any]) -> str:
    """Format audit plan as markdown."""
    lines = [
        f"# ISMS Audit Plan {plan['metadata']['year']}",
        f"",
        f"**Generated:** {plan['metadata']['generated'][:10]}",
        f"**Methodology:** {plan['metadata']['methodology']}",
        f"",
        f"## Summary",
        f"",
        f"| Metric | Value |",
        f"|--------|-------|",
        f"| Controls in Scope | {plan['summary']['total_controls_in_scope']} |",
        f"| Total Audits Planned | {plan['summary']['total_audits_planned']} |",
        f"| Critical Risk Controls | {plan['summary']['risk_distribution']['critical']} |",
        f"| High Risk Controls | {plan['summary']['risk_distribution']['high']} |",
        f"| Medium Risk Controls | {plan['summary']['risk_distribution']['medium']} |",
        f"",
    ]

    for quarter, data in plan["schedule"].items():
        lines.extend([
            f"## {quarter}: {data['month']}",
            f"",
            f"| Control | Name | Risk | Target Date |",
            f"|---------|------|------|-------------|",
        ])
        for audit in data["audits"]:
            lines.append(
                f"| {audit['control_id']} | {audit['control_name']} | "
                f"{audit['risk_level'].capitalize()} | {audit['target_date']} |"
            )
        lines.append("")

    lines.extend([
        f"## Risk-Based Audit Frequency",
        f"",
        f"| Risk Level | Audit Frequency |",
        f"|------------|-----------------|",
        f"| Critical | Quarterly (4x/year) |",
        f"| High | Semi-Annual (2x/year) |",
        f"| Medium | Annual (1x/year) |",
        f"| Low | Annual (1x/year) |",
    ])

    return "\n".join(lines)


def main():
    parser = argparse.ArgumentParser(
        description="ISMS Audit Scheduler - Risk-based audit planning"
    )
    parser.add_argument(
        "--year", "-y",
        type=int,
        default=datetime.now().year,
        help="Audit plan year (default: current year)"
    )
    parser.add_argument(
        "--controls", "-c",
        help="CSV file with control risk ratings"
    )
    parser.add_argument(
        "--output", "-o",
        help="Output file path"
    )
    parser.add_argument(
        "--format", "-f",
        choices=["json", "markdown"],
        default="json",
        help="Output format (default: json)"
    )

    args = parser.parse_args()

    # Load controls
    controls = None
    if args.controls:
        controls = load_controls_from_csv(args.controls)

    # Generate plan
    plan = generate_audit_plan(args.year, controls)

    # Format output
    if args.format == "markdown":
        output = format_markdown(plan)
    else:
        output = json.dumps(plan, indent=2)

    # Write output
    if args.output:
        with open(args.output, "w", encoding="utf-8") as f:
            f.write(output)
        print(f"Audit plan saved to: {args.output}", file=sys.stderr)
    else:
        print(output)


if __name__ == "__main__":
    main()

Related skills

Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3k

Azure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k

Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72

Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206

Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397

Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85

Securityauditcomplianceappsec

About

Isms Audit Expert by the numbers

Add your badge

What it does

Files

ISMS Audit Expert

Audit Program Management

Risk-Based Audit Schedule

Workflow: Annual Audit Planning

Example: Annual Audit Plan Output

Audit Execution

Workflow: Pre-Audit Preparation

Workflow: Audit Conduct

Evidence Collection Methods

Control Assessment

ISO 27002 Control Categories

Workflow: Control Testing

Example: Control Test Working Paper

Finding Management

Finding Classification

Finding Documentation Template

Workflow: Corrective Action

Certification Support

Stage 1 Audit Preparation Checklist

Stage 2 Audit Preparation Checklist

Surveillance Audit Cycle

Tools

References

Audit Performance Metrics

Compliance Framework Integration

Troubleshooting

Success Criteria

Scope & Limitations

Integration Points

Tool Reference

isms_audit_scheduler.py

Cloud Security Audit Guide

Table of Contents

Shared Responsibility Model

Responsibility Matrix

Audit Focus by Model

Cloud Provider Assessment

Certification Verification

Data Residency Compliance

Provider Security Documentation

Configuration Security

AWS Security Assessment

Azure Security Assessment

Data Protection

Encryption Verification

Key Management Assessment

Data Classification in Cloud

Identity and Access Management

Privileged Access Review

Service Account Assessment

Federation and SSO

API Security

ISO 27001 ISMS Audit Methodology

Table of Contents

Audit Program Structure

Annual Audit Schedule

Risk-Based Scheduling

Pre-Audit Phase

Documentation Review Checklist

Audit Plan Template

Auditor Independence

Audit Execution

Evidence Collection Methods

Interview Protocol

Sample Interview Questions

Control Testing Procedures

Finding Classification

Severity Levels

Finding Documentation

Corrective Action Tracking

Certification Audit Support

Stage 1 Audit Preparation

Stage 2 Audit Preparation

Surveillance Audit Cycle

Audit Findings Response Template