Complade ISO 27001 Training & Resources

Implementation approaches, audit questions, records and sample responses below are examples, not prescribed solutions. Select controls and evidence appropriate to your risks, scope and applicable requirements. An example frequency, tool or document format is not automatically an ISO requirement.

Introduction to Standards

Overview of frameworks such as ISO, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF (Cybersecurity Framework)), and System and Organization Controls 2 (SOC 2)

ISO 27001 Clause 4

Clause 4.1

Understanding the Organization & Its Context

Implementation examples

Consider external issues such as legal requirements, technology, threats and markets, and internal issues such as systems, culture and resources. PESTLE (political, economic, social, technological, legal and environmental factors) and SWOT (strengths, weaknesses, opportunities and threats) are examples of tools that can support this analysis.

Document internal information flows and dependencies.

Review context at planned intervals and when relevant changes occur.

Example audit questions

"How did you identify internal/external issues (and parties) impacting your ISMS (information security management system) outcomes?"

"How do tech trends or regulatory changes feed into your risk management?"

Examples of audit evidence

Document: Context Matrix, PESTLE (political, economic, social, technological, legal and environmental factors) & SWOT (strengths, weaknesses, opportunities and threats) Reports.

Records: Management Review Minutes (Clause 9.3) reviewing context.

Diagrams: System Architecture & Data Flow Diagrams.

Illustrative response:

"We systematically review internal and external context using our Context Matrix (combining PESTLE (political, economic, social, technological, legal and environmental factors) & SWOT (strengths, weaknesses, opportunities and threats)). External drivers like privacy laws and cloud security trends are mapped against internal factors like tech stack and staffing. These inform our risk assessment.

Clause 4.2

Needs & Expectations of Interested Parties

Implementation examples

Map external stakeholders (Regulators, Clients, Suppliers) and internal stakeholders (Board, Staff, IT (information technology)).

List mandatory legal/regulatory requirements and voluntary contractual SLAs (service level agreements).

Account for adversary interests (e.g., threat actors trying to exploit weaknesses).

Example audit questions

"Who are your key interested parties and what security requirements do they have?"

"How do you ensure customer contractual security commitments are met?"

Examples of audit evidence

Document: Interested Parties Matrix / Stakeholder Register.

Contracts: Customer SLAs (service level agreements), NDAs (non-disclosure agreements), Supplier Security Agreements.

Compliance: Legal & Regulatory Requirements Register.

Illustrative response:

"We maintain an Interested Parties Matrix detailing internal and external stakeholders. Legal obligations are tracked in our Compliance Register, while customer expectations are pulled from MSAs (master services agreements) and SLAs (service level agreements), directly translating into controls in our Statement of Applicability."

Clause 4.3

Determining the Scope of the ISMS (information security management system)

Implementation examples

Define physical (offices, data centers), logical (cloud, networks), and organizational boundaries.

Include all supporting functions (HR, IT (information technology), Procurement) and account for outsourced dependencies.

Obtain formal top management sign-off on the scope document.

Example audit questions

"What are the precise physical and technical boundaries of your ISMS (information security management system)?"

"Are any business units or physical sites excluded, and why?"

Examples of audit evidence

Document: Approved ISMS (information security management system) Scope Document.

Controls: Statement of Applicability (SoA).

Diagrams: Network Topology & Physical Office Locations.

Illustrative response:

"Our ISMS (information security management system) Scope Document is approved by leadership and covers all SaaS (software as a service, software accessed online) production infrastructure, corporate offices, and core operational units. All interfaces, dependencies, and third-party interactions are mapped, and 100% of this scope is covered in our SoA (Statement of Applicability, the record of applicable security controls and their justification)."

ISO 27001 Clause 5

Clause 5.1

Leadership & Commitment

Implementation examples

Top management must demonstrate active ownership (not delegation without oversight).

Ensure security policy and objectives align with business strategic direction.

Integrate ISMS (information security management system) requirements directly into standard business processes.

Provide adequate resources (budget, staffing, tech) and direct/support personnel.

Example audit questions

"How does top management demonstrate active commitment to the ISMS (information security management system)?"

"How do you ensure information security is integrated into business operations?"

Auditor interview request directly with C-suite / executive management.

Examples of audit evidence

Executive Minutes: Board/Executive meeting minutes approving security budget & policy.

Reviews: Signed Management Review Minutes (Clause 9.3).

Resources: Approved annual security operational and capital budgets.

Illustrative response:

"Top management demonstrates commitment by establishing security objectives aligned with corporate goals, approving dedicated security budgets, leading scheduled Management Reviews, and actively communicating security importance across all departments."

Clause 5.2

Information Security Policy

Mandatory Policy

Implementation examples

Draft a high-level Information Security Policy appropriate to the organization's purpose.

Include explicit commitments to satisfy applicable requirements and continual improvement.

Provide a framework for establishing information security objectives.

Formally approve, publish, communicate to staff, and make available to interested parties.

Example audit questions

"Show me your overarching Information Security Policy and evidence of executive sign-off."

"How is the policy communicated to internal staff and external interested parties?"

Examples of audit evidence

Policy Document: Executive-approved Information Security Policy with version history.

Communication: Intranet/portal publication, email broadcast records, LMS (learning management system) onboarding sign-offs.

External Sharing: Public website policy summary or vendor trust center link.

Illustrative response:

"Our Information Security Policy is formally approved by our CEO (chief executive officer). It establishes our commitment to compliance and continual improvement while providing the framework for our security objectives. It is published on our intranet, required for employee onboarding, and accessible externally via our Trust Portal."

Clause 5.3

Organizational Roles, Responsibilities & Authorities

Governance Structure

Implementation examples

Assign and communicate responsibilities and authorities for all security-relevant roles.

Assign explicit responsibility for ensuring ISMS (information security management system) conforms to ISO 27001 requirements.

Assign explicit responsibility for reporting ISMS (information security management system) performance directly to top management (e.g., CISO (chief information security officer) / Security Lead).

Example audit questions

"Who is specifically responsible for ensuring ISMS (information security management system) compliance and reporting performance to leadership?"

"How are security responsibilities defined and communicated across different departments?"

Examples of audit evidence

Org Chart & RACI (responsible, accountable, consulted and informed): ISMS (information security management system) Organizational Chart, RACI (responsible, accountable, consulted and informed) Matrix.

Job Descriptions: Formal Job Descriptions with security responsibilities included.

Appointment Letters: Formal designation records for CISO (chief information security officer) / ISO / Security Steering Committee.

Illustrative response:

"Security roles and authorities are defined in our ISMS (information security management system) RACI (responsible, accountable, consulted and informed) Matrix and job descriptions. Our CISO (chief information security officer) holds explicit authority to maintain ISO 27001 compliance and reports performance directly to top management during quarterly steering committee meetings and annual Management Reviews."

ISO 27001 Clause 6

Clauses 6.1.1, 6.1.2, 6.1.3

Risk & Opportunity Management Framework

Implementation examples

6.1.1: Address context risks/opportunities to ensure ISMS (information security management system) delivers intended outcomes.

6.1.2: Define repeatable risk assessment criteria (impact, likelihood, CIA, risk owner assigned).

6.1.3: Select treatment options (Avoid, Modify, Share, Retain), build SoA (justifying inclusions/exclusions), and get risk owner sign-off.

Example audit questions

"Show me your risk assessment methodology and how risk levels are calculated."

"How do you justify excluded Annex A controls in your Statement of Applicability?"

Examples of audit evidence

Methodology: Risk Assessment & Treatment Policy.

Register: Risk Register with Risk Owner Sign-offs.

SoA (Statement of Applicability, the record of applicable security controls and their justification): Statement of Applicability with detailed inclusion/exclusion justifications.

Plan: Approved Risk Treatment Plan (RTP).

Illustrative response:

"We follow a 5x5 impact/likelihood risk methodology. Every identified risk has an assigned Risk Owner. Treatment actions feed our Risk Treatment Plan, and all controls (standard, sector-specific, or custom) are documented with clear rationale in our Statement of Applicability."

Clauses 6.2 & 6.3

Security Objectives & Planning ISMS (information security management system) Changes

Implementation examples

6.2: Set SMART (specific, measurable, achievable, relevant and time-bound), measurable security objectives aligned with Security Policy. Map What, Who, Resources, When, and Evaluation metrics.

6.3: Execute changes to the ISMS (information security management system) in a planned manner, evaluating potential security impacts and role re-assignments.

Example audit questions

"How do you measure progress against your security objectives?"

"Show me how a major organizational change was evaluated for security risks before execution."

Examples of audit evidence

Objectives: Documented Objectives Tracker & Action Plans.

Change Control: Change Management Procedure & Request Forms.

Reviews: Pre-change risk evaluations and post-implementation sign-offs.

Illustrative response:

"Our security objectives are SMART (specific, measurable, achievable, relevant and time-bound), assigned to specific owners with dedicated budgets, and tracked quarterly. Major ISMS (information security management system) modifications go through our formal Change Management process, assessing risk impacts before leadership sign-off."

ISO 27001 Clause 7

Clauses 7.1 & 7.2

Resources & Competence Management

Implementation examples

7.1: Determine & allocate budget, staffing, infrastructure, and tools needed for ISMS (information security management system).

7.2: Define role competency requirements, evaluate skills, conduct training/hiring, and evaluate training effectiveness.

Example audit questions

"How do you determine that personnel in security-affecting roles are competent?"

"Show me how you measure the effectiveness of security training programs."

Examples of audit evidence

Resources: Approved Security Budgets & Staffing Headcount Plans.

Competence: Job Descriptions, Resumes, Industry Certifications (CISSP, CISM (Certified Information Security Manager), ISO lead auditor).

Training: Training Plans, Attendance Logs, Quiz Results, Post-Training Evaluations.

🗣️ Illustrative response:

"We map role competencies in job descriptions. Qualifications are verified via certifications and CVs (curricula vitae, summaries of qualifications and experience) upon hire. Training needs are executed annually, and effectiveness is verified via post-training quizzes and manager performance sign-offs."

Clauses 7.3 & 7.4

Awareness & Communication Framework

Implementation examples

7.3: Train staff/contractors on Policy awareness, personal security contribution, and non-compliance consequences.

7.4: Build a Communication Matrix covering What, When, With Whom, How, and Who communicates.

Example audit questions

"Random staff sample: Are you aware of the security policy and where to find it?"

"Who is authorized to communicate externally during a security breach?"

Examples of audit evidence

Awareness: LMS (learning management system) Onboarding Logs, Phishing Simulation Results, Policy Sign-offs.

Communication: ISMS (information security management system) Communication Plan, Authorized Spokesperson Matrix.

Illustrative response:

"Awareness starts during onboarding and continues via monthly security tips and phishing tests. Our Communication Matrix specifies authorized channels and roles for routine updates as well as crisis/incident alerts."

Clauses 7.5.1, 7.5.2, 7.5.3

Control of Documented Information

Implementation examples

7.5.1: Maintain all mandatory ISO documents plus necessary operational SOPs (standard operating procedures).

7.5.2: Enforce standard document metadata (Title, Author, Date, Version, identifier (ID)) and approval workflows.

7.5.3: Protect document access (RBAC), legibility, retention schedules, and secure disposal.

Example audit questions

"How do you ensure only approved document versions are available to staff?"

"Show me your retention schedule and secure disposal logs for expired records."

Examples of audit evidence

Policy: Document Control & Retention Procedure.

Registry: Master Document Index with Version History.

Controls: System Access Control Lists (RBAC) & Disposal Certificates.

Illustrative response:

"Documents are controlled in a centralized library with strict RBAC (role-based access control) permissions. Templates enforce standardized headers, version logs, and management sign-offs. Outdated documents are archived per our retention schedule."

ISO 27001 Clause 8

Clause 8.1

Operational Planning, Change Control & Supplier Oversight

Implementation examples

Establish operational process criteria (SOPs, patch baselines, access workflows).

Govern planned operational changes and mitigate unintended changes.

Control outsourced processes (contracts, SLAs (service level agreements), right-to-audit, vendor reviews).

Example audit questions

"Show evidence that daily security procedures operate as specified."

"How do you monitor third-party suppliers to ensure they meet security requirements?"

Examples of audit evidence

Operations: System Logs, Ticket Sign-offs, Backup Verification Reports.

Changes: CAB (change advisory board) Meeting Minutes & Change Request Tickets.

Suppliers: Vendor Security Risk Assessments, SOC 2 (System and Organization Controls 2) Reports, Contracts with SLAs (service level agreements).

Illustrative response:

"Operational controls are driven by approved SOPs (standard operating procedures) and logged in ticketing systems. Changes undergo CAB (change advisory board) risk evaluation. Outsourced vendors are vetted annually, bound by contractual security terms, and monitored via SOC reports."

Clauses 8.2 & 8.3

Executing Risk Assessments & Risk Treatment Plans

Implementation examples

8.2: Conduct risk assessments at planned intervals (annually) or when major changes/incidents occur.

8.3: Execute treatment actions in the Risk Treatment Plan (RTP) and retain evidence of outcomes.

Example audit questions

"Show me the latest completed risk assessment report and execution schedule."

"What evidence shows that planned risk treatments were actually implemented?"

Examples of audit evidence

Assessment: Completed Risk Assessment Reports & Updated Risk Registers.

Treatment: Live Risk Treatment Plan (RTP) progress logs.

Sign-off: Formal Risk Owner Residual Risk Acceptance Sign-offs.

Illustrative response:

"We run scheduled annual risk assessments, as well as ad-hoc assessments triggered by system changes. Treatment tasks are tracked in our active RTP, and technical implementation evidence is verified by Risk Owners before sign-off."

ISO 27001 Clause 9

Clause 9.1

Monitoring, Measurement, Analysis & Evaluation

Implementation examples

Define "information needs" and track Performance Metrics (% tasks completed) & Effectiveness Metrics (impact on security goals).

Assign clear collector vs. evaluator roles to ensure valid, reproducible results.

Example audit questions

"How do you measure whether security controls are actually performing effectively?"

"Show me your security KPI (key performance indicator) dashboard and trend reports."

Examples of audit evidence

Dashboard: ISMS (information security management system) Monitoring & Measurement Framework / KPI (key performance indicator) Tracker.

Logs: Incident Trend Reports, SLA (service level agreement) Compliance Reports, Patch Metrics.

Illustrative response:

"We track performance metrics (e.g., SLA (service level agreement) achievement, patch rates) and effectiveness metrics (e.g., incident response times, phishing rates) in our KPI (key performance indicator) Dashboard. These results feed directly into our Management Reviews."

Clauses 9.2 & 9.3

Internal Audit Programme & Executive Management Review

Implementation examples

9.2: Conduct risk-based internal audits using independent, competent auditors. Track corrective action plans.

9.3: Hold executive management reviews at planned intervals covering all mandatory inputs (a-g) and recording decision outputs.

Example audit questions

"Show me your multi-year internal audit programme and latest audit report."

"Provide signed meeting minutes demonstrating top management participation in management reviews."

Examples of audit evidence

Audit: Internal Audit Schedule, Audit Plans, Audit Reports, Auditor Independence Certificates.

Management Review: Signed Minutes, Agendas, Action Item Trackers.

Illustrative response:

"Our multi-year internal audit programme uses independent auditors to evaluate ISO 27001 compliance. Findings are reported to top management during scheduled Management Reviews, where decisions on resources and improvements are formally recorded."

ISO 27001 Clause 10

Clauses 10.1 & 10.2

Continual Improvement, Nonconformity & Corrective Actions

Implementation examples

10.1: Continuously enhance ISMS (information security management system) suitability, adequacy, and effectiveness proactively.

10.2 (Immediate): Take swift short-term Correction (containment) when nonconformities occur.

10.2 (Long-term): Perform 5-Whys/Fishbone Root Cause Analysis (RCA), deploy Corrective Action Plans (CAP), and verify long-term effectiveness.

Example audit questions

"How do you differentiate between an immediate correction and long-term corrective action?"

"Show me evidence of an impartial review verifying a corrective action prevented recurrence."

Examples of audit evidence

Improvement: Continual Improvement Register / Opportunity Log.

Nonconformity: Nonconformity Log (NCR), Root Cause Analysis (RCA) Worksheets (5-Whys).

Verification: Corrective Action Plans (CAP) & Post-Remediation Effectiveness Verification Records.

Illustrative response:

"When a nonconformity is logged, we apply immediate containment first. We then perform a 5-Whys root-cause analysis to deploy a long-term Corrective Action Plan. After 60 to 90 days, we conduct an impartial effectiveness evaluation to confirm the root cause was eliminated."

Annex A implementation and audit guidance

ISO 27001:2022 Annex A Controls

Organizational Controls (Clause 5)

Control 5.1: Policies for Information Security

Implementation examples

Draft, approve, and publish overarching and topic-specific security policies.

Distribute policies to all staff, contractors, and relevant external parties.

Review policies at planned intervals or following major operational changes.

Example audit questions

"Are security policies formally approved by leadership, and how are they communicated?"

"What triggers a policy review, and how do you track version changes?"

Examples of audit evidence

Policy: Executive-approved Information Security Policy & topic-specific policies.

Approvals: Executive meeting minutes or signed sign-off records.

Communication: Intranet publication logs, LMS (learning management system) onboarding records, and signed acknowledgments.

Reviews: Document revision history and annual management review logs.

Illustrative response: "Our Information Security Policy is formally approved by leadership, published on our intranet, and acknowledged by employees during onboarding. We review policies annually or upon major system changes, retaining full version histories."

Control 5.2: Information Security Roles & Responsibilities

Implementation examples

Define and document all security duties within job descriptions and governance frameworks.

Assign specific responsibilities for asset management, risk acceptance, and incident response.

Communicate roles clearly across the organization and ensure management authorization.

Example audit questions

"How are security roles defined and communicated across departments?"

"Who holds formal authority to accept residual security risks?"

Examples of audit evidence

Org Structure: ISMS (information security management system) Organizational Chart and RACI (responsible, accountable, consulted and informed) Matrix.

Role Definitions: Job Descriptions containing explicit security responsibilities.

Designations: Formal CISO (chief information security officer)/ISO appointment letters and risk acceptance records.

Illustrative response: "Security responsibilities are embedded into formal job descriptions and mapped in our ISMS (information security management system) RACI (responsible, accountable, consulted and informed) Matrix. Executive leadership formally designates role owners, and residual risk acceptance authority rests strictly with appointed business owners."

Control 5.3: Segregation of Duties

Implementation examples

Separate conflicting duties to prevent unauthorized actions, errors, and fraud.

Segregate access requests vs. approvals, code development vs. production deployment, and security management vs. auditing.

Implement compensating controls (e.g., heightened logging, dual-authorization) where segregation is unfeasible.

Example audit questions

"How do you identify and enforce segregation of incompatible duties?"

"If segregation cannot be achieved due to team size, what compensating controls exist?"

Examples of audit evidence

Matrix: Segregation of Duties (SoD) Conflict Matrix.

Access Rules: RBAC (role-based access control) configurations preventing dual high-risk roles.

Logs: Change approval tickets separate from deployment execution logs.

Illustrative response: "We map incompatible roles in our SoD (segregation of duties) Matrix. Developers cannot deploy directly to production without peer review and independent Release Manager approval. In smaller teams, we enforce automated audit logging and secondary management oversight."

Control 5.4: Management Responsibilities

Implementation examples

Require management to mandate adherence to security policies across teams.

Ensure personnel receive job-specific security guidelines before access is granted.

Provide adequate budget, training, and resources to maintain security operational effectiveness.

Example audit questions

"How does management ensure employees understand and follow security requirements?"

"What evidence shows leadership enforces compliance in daily operations?"

Examples of audit evidence

Briefings: Onboarding security briefing records and signed policy acknowledgments.

Management Action: Team meeting minutes addressing security KPIs (key performance indicators) and compliance updates.

Resources: Approved departmental security training and operational budgets.

Illustrative response: "Management actively enforces security obligations by ensuring all new hires complete security briefings prior to access allocation. Managers review compliance metrics monthly and enforce policy adherence across daily departmental workflows."

Control 5.5: Contact with Authorities

Implementation examples

Maintain a documented directory of relevant legal, regulatory, and emergency contact points.

Define explicit reporting triggers, roles, and notification workflows for reporting breaches.

Engage with regulatory bodies routinely to remain updated on compliance mandates.

Example audit questions

"Who is authorized to contact legal or regulatory authorities during an incident?"

"What triggers mandate external reporting to law enforcement or privacy regulators?"

Examples of audit evidence

Directory: Designated Authority Contact List (including law enforcement, CERTs (computer emergency response teams), DPA (data protection authority) regulators).

Procedure: Incident Response Plan detailing external notification triggers and timelines.

Logs: Historical communication logs or incident escalation reports.

Illustrative response: "We maintain a structured Authority Contact List including law enforcement and privacy regulators. Our Incident Response Plan defines specific thresholds and executive roles responsible for executing regulatory notifications within mandatory timeframes."

Control 5.6: Contact with Special Interest Groups

Implementation examples

Maintain active memberships in industry cybersecurity forums, ISACs (information sharing and analysis centers), and professional networks.

Establish rules governing information sharing to protect confidential internal data.

Utilize group interactions to track emerging vulnerabilities, attack trends, and best practices.

Example audit questions

"Which professional security organizations or threat-sharing groups do you maintain contact with?"

"How do you ensure proprietary data isn't disclosed during external intelligence exchanges?"

Examples of audit evidence

Memberships: Active membership records (e.g., FIRST, InfraGard, ISACA, sector ISACs (information sharing and analysis centers)).

Policy: External Data Sharing & Information Exchange Policy.

Records: Group participation logs, threat bulletin advisories, and conference/forum notes.

Illustrative response: "We maintain active memberships in regional CERT (computer emergency response team) networks and sector ISACs (information sharing and analysis centers). Information exchange follows our Data Sharing Policy, ensuring threat intelligence is gained without disclosing proprietary operational data."

Control 5.7: Threat Intelligence

Implementation examples

Collect and evaluate threat intelligence across Strategic, Tactical, and Operational levels.

Process raw data feeds to extract actionable indicators of compromise (IoCs) and attacker TTPs (tactics, techniques and procedures).

Integrate intelligence directly into firewalls, SIEM (security information and event management, combining security logs for monitoring) rules, vulnerability scanning, and risk assessments.

Example audit questions

"How do you collect, analyze, and operationalize threat intelligence feeds?"

"Show how threat intelligence directly influences your risk register or defensive rules."

Examples of audit evidence

Procedure: Threat Intelligence Gathering & Analysis Procedure.

Reports: Contextual Threat Intelligence Reports and executive advisories.

Integration: SIEM (security information and event management, combining security logs for monitoring)/EDR (endpoint detection and response, monitoring devices for threats) configuration logs showing auto-imported threat feed IoCs (indicators of compromise, signs of a possible security breach).

Illustrative response: "We gather intelligence from commercial feeds and open-source advisories. Threat data is parsed by our SOC, converted into actionable SIEM (security information and event management, combining security logs for monitoring) detection rules, and used to update technical risk ratings during periodic assessments."

Control 5.8: Information Security in Project Management

Implementation examples

Embed security risk evaluations into initial project charter, scoping, and planning stages.

Define explicit technical, regulatory, and access security requirements early in projects.

Conduct security gates, testing, and sign-offs before project milestones and final rollout.

Example audit questions

"How do you ensure security requirements are included from the inception of new projects?"

"Show evidence of security risk assessments and sign-offs within a recent project file."

Examples of audit evidence

Framework: Security in Project Management Procedure / SDLC (software development life cycle) Guidelines.

Project Artifacts: Project charters with security requirements, risk logs, and gate sign-offs.

Minutes: Project Steering Committee minutes addressing security status and sign-offs.

Illustrative response: "Security is integrated into our project management framework from day one. Every project charter requires a security impact analysis, defined security requirements, and formal CISO (chief information security officer) sign-off before production release."

Control 5.9: Inventory of Information & Other Associated Assets

Implementation examples

Identify, catalog, and manage physical, logical, software, and data assets in a central repository.

Assign a explicit owner to every asset upon creation or acquisition.

Review inventories regularly and integrate dynamic discovery tools to capture asset changes.

Example audit questions

"How do you maintain a complete inventory of information assets and ensure owners are assigned?"

"Show me your asset inventory and how updates are triggered when new hardware/software is deployed."

Examples of audit evidence

Inventory: Central Asset Inventory / CMDB (covering hardware, software, data, physical items).

Policy: Asset Management Policy defining owner roles and lifecycles.

Reports: Automated dynamic asset discovery system reports and review logs.

Illustrative response: "We maintain a centralized CMDB (configuration management database) tracking hardware, software, and data assets with assigned owners. Automated discovery agents scan our infrastructure daily to register changes, supplemented by quarterly manual reconciliation."

Control 5.10: Acceptable Use of Information & Other Assets

Implementation examples

Publish comprehensive Acceptable Use Policies (AUP) covering IT (information technology) assets, data, and mobile devices.

Require written or digital policy acceptance from personnel before granting resource access.

Define clear operational handling rules matching asset classification and monitoring boundaries.

Example audit questions

"How do personnel acknowledge acceptable usage boundaries for corporate systems?"

"What rules govern the usage of personal devices or corporate assets outside the office?"

Examples of audit evidence

Policy: Approved Acceptable Use Policy (AUP).

Records: Signed employee onboarding acknowledgments and LMS (learning management system) policy sign-off logs.

Handling Procedures: SOPs (standard operating procedures) for handling sensitive assets, hardware, and mobile devices.

Illustrative response: "All employees review and sign our Acceptable Use Policy during onboarding and annual policy renewals. Systems display explicit login banners reminding users of monitoring and acceptable usage rules."

Control 5.11: Return of Assets

Implementation examples

Establish formal offboarding checklists tracking the physical return of hardware, badges, and keys.

Require handover of business-critical data, credentials, and documentation before departure.

Enforce secure remote wiping of company data from personal or BYOD (bring your own device) equipment.

Example audit questions

"What process ensures all physical and logical assets are recovered upon employee departure?"

"Show evidence of asset return for a recently offboarded employee."

Examples of audit evidence

Checklist: Completed HR (human resources)/IT (information technology) Offboarding Checklists.

Receipts: Signed hardware return receipts and badge surrender logs.

Wipe Logs: MDM (mobile device management) logs confirming remote data sanitization of mobile/BYOD (bring your own device) devices.

Illustrative response: "Our offboarding procedure triggers an automated IT (information technology) and HR (human resources) workflow. Leaving employees must surrender hardware and keys per our checklist, while MDM (mobile device management) tools automatically wipe corporate data from personal devices upon termination."

Control 5.12: Classification of Information

Implementation examples

Establish an Information Classification Policy outlining discrete levels (e.g., Public, Internal, Confidential, Restricted).

Base classification on business value, legal requirements, sensitivity, and criticality (CIA impact).

Assign data owners responsibility for classifying datasets and reviewing classification lifecycle.

Example audit questions

"What is your data classification structure, and how are sensitivity levels defined?"

"How do you verify data assets are correctly classified across your systems?"

Examples of audit evidence

Policy: Information Classification Policy and Schema Guidelines.

Matrix: Data Handling & Classification Matrix.

Asset Records: Asset Inventory showing assigned classification levels per dataset.

Illustrative response: "We classify data into four tiers: Public, Internal, Confidential, and Restricted. Data owners determine classification based on risk impact, and handling standards for each tier are published across our organization."

Control 5.13: Labelling of Information

Implementation examples

Develop standardized labeling guidelines for physical documents, digital files, and storage media.

Embed automated digital classification headers, footers, and metadata tags into office suite tools.

Train personnel on applying physical labels and managing exception workflows for low-risk media.

Example audit questions

"How do you enforce physical and digital labeling of sensitive documents and files?"

"Show examples of automated labeling or classification metadata enforced in your environment."

Examples of audit evidence

Policy: Information Labelling & Handling Standard.

System Config: DLP (data loss prevention)/DMS (document management system) configuration screenshots showing auto-applied visual tags and metadata.

Samples: Sample outputs (reports, exports, physical media labels) reflecting classification tags.

Illustrative response: "Digital assets are auto-labeled using Microsoft Purview metadata tags according to content sensitivity, inserting visible headers and footers. Physical media carrying confidential data receives standardized tamper-evident physical labels."

Control 5.14: Information Transfer

Implementation examples

Establish strict policies and encrypted channels for data transfer across electronic, physical, and verbal mediums.

Execute formal Data Transfer Agreements (DTAs) with third parties governing protection and liabilities.

Enforce mandatory transport-layer and file-level encryption for sensitive electronic transmissions.

Example audit questions

"How do you protect sensitive data during transfer to third parties or external networks?"

"Show executed information transfer agreements and evidence of technical transport controls."

Examples of audit evidence

Policy: Information Transfer Policy.

Agreements: Executed Data Transfer Agreements (DTAs) and vendor NDAs (non-disclosure agreements).

Technical Evidence: SFTP (SSH File Transfer Protocol, for encrypted file transfers)/TLS (Transport Layer Security, which protects data in transit) encryption configs, secure portal transfer logs, and courier tracking receipts.

Illustrative response: "Transfers of sensitive data require approved encrypted protocols (SFTP, TLS (Transport Layer Security, which protects data in transit) 1.3) or secure portals. Third-party transfers are governed by formal Data Transfer Agreements specifying encryption requirements and handling terms."

Control 5.15: Access Control

Implementation examples

Define a comprehensive Access Control Policy based on Least Privilege, Need-to-Know, and Need-to-Use.

Enforce formal access request, approval, provisioning, and termination workflows.

Conduct periodic access reviews across systems, applications, and physical entries.

Example audit questions

"What policy governs user access permissions, and how do you ensure least privilege?"

"Show evidence of management approval prior to granting user access rights."

Examples of audit evidence

Policy: Access Control Policy.

Tickets: Access Request Tickets showing explicit asset owner approval before provisioning.

Reviews: Quarterly User Access Review logs and signed re-certification reports.

Illustrative response: "Access is managed via role-based access controls following least privilege. All access requests require ticketed approval from the asset owner prior to IT (information technology) provisioning, backed by quarterly access reviews."

Control 5.16: Identity Management

Implementation examples

Assign unique user identifiers (IDs) to every individual to maintain full operational accountability.

Strictly limit shared, generic, or anonymous accounts, requiring secondary compensating logging if used.

Deactivate or delete identities immediately upon employee termination or role change.

Example audit questions

"How do you verify user uniqueness and ensure generic/shared accounts are avoided?"

"Show how user identity lifecycles are integrated with your HR (human resources) system."

Examples of audit evidence

Policy: Identity & Account Management Standard.

Identity Directory: IdP (identity provider)/Active Directory account listings proving unique user identifier (ID) naming rules.

Logs: Termination logs cross-referenced with immediate account deactivation timestamps.

Illustrative response: "Every user is assigned a unique identifier (ID) tied to HR (human resources) onboarding. Shared accounts are prohibited by policy. When an employee leaves, HR (human resources) system updates trigger automated SAML (Security Assertion Markup Language)/Active Directory deactivation within minutes."

Control 5.17: Authentication Information

Implementation examples

Establish strict password complexity, expiration, and multi-factor authentication (MFA) parameters.

Secure initial credential delivery via encrypted channels and mandate immediate change on initial login.

Instruct users on confidential credential management; prohibit password sharing or clear-text storage.

Example audit questions

"How do you distribute temporary credentials, and how are baseline authentication rules enforced?"

"Show technical configuration settings for password parameters and MFA (multi-factor authentication, using more than one type of identity check) enforcement."

Examples of audit evidence

Policy: Password & Authentication Standard.

System Config: Password policy configuration screenshots (length, complexity, lockout thresholds, MFA (multi-factor authentication, using more than one type of identity check) settings).

User Training: Awareness communications instructing staff on password manager usage.

Illustrative response: "Temporary credentials are delivered via secure single-use links requiring immediate change upon login. System settings enforce minimum 14-character passwords, account lockouts after 5 failures, and mandatory MFA (multi-factor authentication, using more than one type of identity check) across all systems."

Control 5.18: Access Rights

Implementation examples

Provision, modify, and revoke physical and logical access based on formal management authorization.

Conduct periodic, risk-based reviews of user access rights, focusing heavily on administrative privileges.

Revoke or downgrade access rights immediately upon employee role transitions or offboardings.

Example audit questions

"How often are user access rights re-evaluated, and who performs the review?"

"Show proof of account privilege modification for an employee who recently changed roles."

Examples of audit evidence

SOP (standard operating procedure): Access Provisioning and De-provisioning Standard.

Review Logs: Completed user access review sign-offs from system/data owners.

Role Change Records: Internal mobility tickets proving access revocation of old department permissions.

Illustrative response: "System access rights undergo formal quarterly reviews conducted by system owners. Role changes trigger an immediate review process, revoking permissions associated with the former position before new access is provisioned."

Control 5.19: Information Security in Supplier Relationships

Implementation examples

Establish a Supplier Security Policy defining security requirements for third-party engagements.

Conduct pre-engagement vendor risk assessments before granting system or data access.

Maintain a centralized inventory of suppliers categorized by risk impact and data sensitivity.

Example audit questions

"How do you evaluate security risks before engaging new vendors or cloud providers?"

"Show your supplier inventory and evidence of completed vendor security risk assessments."

Examples of audit evidence

Policy: Supplier Security Policy & Procurement Rules.

Vendor Register: Centralized Supplier Inventory categorized by risk rating.

Assessments: Completed Vendor Security Risk Assessment reports and SOC 2 (System and Organization Controls 2) review logs.

Illustrative response: "We assess all prospective vendors using standardized security questionnaires and SOC 2 (System and Organization Controls 2) evaluations before contract execution. Suppliers are registered in our central inventory and categorized by data sensitivity to dictate review cadence."

Control 5.20: Addressing Security Within Supplier Agreements

Implementation examples

Incorporate explicit security, privacy, SLA (service level agreement), and right-to-audit clauses into vendor contracts.

Mandate notification deadlines for supplier security breaches, operational changes, and sub-contractor usage.

Define specific data handling, return, and destruction duties upon contract termination.

Example audit questions

"How do you ensure security expectations are legally binding across your suppliers?"

"Show sample vendor contracts containing security obligations, breach notification terms, and audit rights."

Examples of audit evidence

Contract Templates: Master Services Agreement (MSA) security addendums and Data Processing Agreements (DPAs).

Executed Contracts: Sample signed supplier contracts incorporating security, incident alert, and audit clauses.

SLAs (service level agreements): Service level agreements tracking security uptime and performance commitments.

Illustrative response: "All vendor engagements mandate our standard Information Security Schedule and DPA (data protection authority). Contracts enforce 24-hour incident notification windows, right-to-audit privileges, and mandatory encryption controls."

Control 5.21: Managing Security in the ICT (information and communication technology) Supply Chain

Implementation examples

Require ICT (information and communication technology) suppliers to pass down security requirements to their sub-contractors and component vendors.

Track origin and integrity of critical software/hardware components to prevent tampering.

Evaluate supply chain continuity, component obsolescence, and vulnerability disclosure mechanisms.

Example audit questions

"How do you manage security risks associated with ICT (information and communication technology) components and third-party software libraries?"

"Show evidence of evaluating supply chain integrity for critical technology components."

Examples of audit evidence

Policy: ICT (information and communication technology) Supply Chain Risk Management Policy.

SBOM (software bill of materials, an inventory of software components): Software Bill of Materials (SBOM) tracking third-party components.

Evaluations: Vendor sub-processor reviews and hardware provenance verification logs.

Illustrative response: "We evaluate supply chain risks by requiring key ICT (information and communication technology) vendors to provide Software Bill of Materials (SBOM) and sub-processor tracking. Procurement policies enforce hardware traceability and software origin validation."

Control 5.22: Monitoring, Review & Change Management of Supplier Services

Implementation examples

Monitor supplier performance continuously against contractual SLAs (service level agreements) and security commitments.

Conduct periodic audits, review third-party SOC 2 (System and Organization Controls 2) reports and ISO/IEC 27001 certificates, and track service changes.

Assess operational changes in supplier services (infrastructure, software updates) for security impacts.

Example audit questions

"How do you monitor ongoing supplier compliance and manage vendor operational changes?"

"Show evidence of your most recent annual supplier security review."

Examples of audit evidence

Review Records: Annual Supplier Review Reports and SOC 2 (System and Organization Controls 2) / ISO certificate verification logs.

SLA (service level agreement) Tracking: Supplier performance tracking reports and vendor service metrics.

Change Tickets: CAB (change advisory board) tickets evaluating major third-party infrastructure modifications.

Illustrative response: "We perform annual security reviews for all critical suppliers, re-evaluating their SOC 2 (System and Organization Controls 2) Type II reports and security posture. Major changes in vendor service architecture are reviewed through our change control process."

Control 5.23: Information Security for Use of Cloud Services

Implementation examples

Draft and enforce a dedicated Cloud Usage Policy outlining authorized services and security rules.

Define explicit ownership boundaries using the Shared Responsibility Model for IaaS (infrastructure as a service, rented cloud computing resources)/PaaS (platform as a service, a hosted environment for developing applications)/SaaS (software as a service, software accessed online).

Maintain a live inventory of cloud services and enforce secure baseline configurations.

Example audit questions

"How do you govern cloud service usage and define shared security responsibilities?"

"Show your register of authorized cloud services and risk assessment records."

Examples of audit evidence

Policy: Cloud Security Policy.

Register: Active Cloud Services Register.

Assessments: Cloud Provider Risk Assessments and mapped Shared Responsibility Matrices.

Illustrative response: "Cloud usage is governed by our Cloud Security Policy. We maintain a register of approved SaaS (software as a service, software accessed online)/IaaS (infrastructure as a service, rented cloud computing resources) providers and document mapped Shared Responsibility Matrices to ensure our internal team manages configured cloud controls correctly."

Control 5.24: Incident Management Planning & Preparation

Implementation examples

Establish formal, documented Incident Response Procedures with defined roles, scopes, and workflows.

Train designated response teams and test incident playbooks regularly via tabletop exercises.

Define clear escalation paths, regulatory notification channels, and communication plans.

Example audit questions

"Show your Information Security Incident Response Plan and proof of periodic testing."

"Who forms the Incident Response Team, and how are roles assigned?"

Examples of audit evidence

Plan: Information Security Incident Response Plan & Incident Playbooks.

Test Evidence: Tabletop Exercise Reports, execution logs, and post-exercise action plans.

RACI (responsible, accountable, consulted and informed): Incident Management RACI (responsible, accountable, consulted and informed) and Escalation Matrix.

Illustrative response: "Our Incident Response Plan establishes clear containment and escalation workflows. The Incident Response Team tests these playbooks annually through simulated tabletop exercises, incorporating lessons learned to refine response steps."

Control 5.25: Assessment & Decision on Security Events

Implementation examples

Establish standardized categorization and severity scoring criteria for evaluating potential security events.

Designate points of contact and trained analysts to triage incoming alerts promptly.

Record assessment decisions detailing whether events are dismissed, escalated, or declared incidents.

Example audit questions

"What criteria do you use to evaluate whether a security event should be declared a security incident?"

"Show triage logs demonstrating how past security alerts were assessed and categorized."

Examples of audit evidence

Triage Matrix: Security Event Classification & Severity Rating Matrix.

Logs: SIEM (security information and event management, combining security logs for monitoring) Triage Logs and Ticketing System Event Assessment records.

SOP (standard operating procedure): Event Assessment & Escalation Operating Procedure.

Illustrative response: "Security events are triaged against our Severity Matrix using automated SIEM (security information and event management, combining security logs for monitoring) correlation rules and analyst review. Decisions to escalate an event to incident status are logged directly within our security ticketing system."

Control 5.26: Response to Security Incidents

Implementation examples

Execute incident response workflows promptly upon declaration to achieve containment and isolation.

Log all response actions, timeline activities, evidence preservation, and stakeholder updates.

Conduct root-cause analysis and execute formal closure documentation upon full remediation.

Example audit questions

"Show historical incident logs and records of actions taken during a past security incident."

"How do you handle containment and communication during an active breach?"

Examples of audit evidence

Incident Records: Completed Incident Handling Files and Ticket Action Logs.

Root Cause: Root Cause Analysis (RCA) Worksheets and Post-Incident Reports (PIR).

Communications: Stakeholder communication logs and regulatory notification records (if applicable).

Illustrative response: "When an incident occurs, our team follows defined playbooks to isolate systems and contain the threat. Every response action, timeline event, and technical mitigation is logged in our Incident Management System through post-incident closure."

Control 5.27: Learning from Security Incidents

Implementation examples

Conduct mandatory Post-Incident Reviews (PIR) for significant security incidents.

Identify control failures and deploy Corrective Action Plans (CAP) to prevent recurrence.

Feed incident learnings back into security awareness training, playbooks, and risk assessments.

Example audit questions

"How do you ensure lessons learned from past incidents lead to security control enhancements?"

"Show a Post-Incident Review report and the tracking of associated corrective action items."

Examples of audit evidence

PIR (post-incident review) Reports: Post-Incident Review (PIR) Reports detailing root causes and lessons learned.

CAP (corrective action plan) Register: Corrective Action Plan (CAP) tracking logs with verified closure sign-offs.

Training Updates: Refreshed security awareness slides incorporating real incident scenarios.

Illustrative response: "Following incident resolution, we conduct a formal Post-Incident Review to identify root causes. Actionable lessons are logged in our Corrective Action Register, used to update technical controls, and integrated into user training."

Control 5.28: Collection of Evidence

Implementation examples

Establish internal forensic guidelines for identifying, collecting, and preserving digital evidence.

Maintain strict Chain of Custody documentation for all hardware, drive images, and logs collected.

Utilize certified tools and non-destructive image acquisition methods aligning with legal admissibility standards.

Example audit questions

"What procedures govern digital evidence collection to ensure admissibility in legal proceedings?"

"Show a completed Chain of Custody form or forensic acquisition log."

Examples of audit evidence

SOP (standard operating procedure): Digital Forensics & Evidence Handling Procedure.

Chain of Custody: Completed Chain of Custody Forms.

Tools: Forensic tool licenses, hash verification output logs, and write-blocker verification records.

Illustrative response: "Evidence collection follows forensic procedures ensuring strict chain of custody and cryptographic hash verification. We use write-blockers and validated imaging software to capture system state without altering original media."

Control 5.29: Security During Disruption

Implementation examples

Identify security controls required to remain active during business disruptions or outages.

Deploy compensating security controls when primary systems or physical controls are degraded.

Verify that emergency operational modes do not bypass baseline access control and data protections.

Example audit questions

"How do you ensure information security is maintained during a operational failure or disaster recovery activation?"

"Show evidence of security control integration within your Business Continuity Plan."

Examples of audit evidence

Plan: Business Continuity Plan (BCP) incorporating specific security operational requirements.

Testing: BCP (business continuity plan) exercise reports demonstrating security control maintenance during failovers.

Compensating Controls: SOPs (standard operating procedures) for emergency manual access logging and fall-back security steps.

Illustrative response: "Our Business Continuity Plan explicitly mandates that security requirements, including access controls and encryption, remain active during disruptions. Failover testing validates that failback procedures maintain full security baselines."

Control 5.30: ICT (information and communication technology) Readiness for Business Continuity

Implementation examples

Conduct Business Impact Analysis (BIA) to set RTO (recovery time objective, the target time to restore a service), RPO (recovery point objective, the maximum acceptable data loss measured in time), and capacity requirements for ICT (information and communication technology) systems.

Design, implement, and maintain redundant ICT (information and communication technology) architecture to support recovery objectives.

Test ICT (information and communication technology) continuity plans annually through technical failover simulations and disaster recovery exercises.

Example audit questions

"How do you determine RTO (recovery time objective, the target time to restore a service) and RPO (recovery point objective, the maximum acceptable data loss measured in time) metrics for critical systems, and how often are DR (disaster recovery) plans tested?"

"Show your Business Impact Analysis report and recent disaster recovery test results."

Examples of audit evidence

BIA (business impact analysis): Business Impact Analysis (BIA) Report detailing system RTO (recovery time objective, the target time to restore a service)/RPO (recovery point objective, the maximum acceptable data loss measured in time) targets.

Plan: Disaster Recovery (DR) Plan / ICT (information and communication technology) Continuity Plan.

Test Results: Disaster Recovery Test Reports, failover logs, and remediation trackers.

Illustrative response: "System recovery objectives are established via our Business Impact Analysis. We maintain technical DR (disaster recovery) plans and test infrastructure failovers annually to verify systems restore within agreed RTO (recovery time objective, the target time to restore a service) and RPO (recovery point objective, the maximum acceptable data loss measured in time) metrics."

Control 5.31: Legal, Statutory, Regulatory & Contractual Requirements

Implementation examples

Maintain a centralized Compliance Register mapping all applicable laws, regulations, and contracts.

Assign specific internal roles responsibility for tracking legal updates and regulatory changes.

Verify compliance across cryptographic export laws, privacy acts, IP (intellectual property) legislation, and client SLAs (service level agreements).

Example audit questions

"How do you track and maintain awareness of legal, regulatory, and contractual obligations?"

"Show your Legal & Regulatory Compliance Register and evidence of periodic review."

Examples of audit evidence

Register: Legal, Statutory, Regulatory & Contractual Compliance Register.

Attestations: Third-party evidence, such as SOC 2 (System and Organization Controls 2) reports, ISO certificates and PCI DSS (Payment Card Industry Data Security Standard) attestations of compliance.

Reviews: Legal review minutes and updated compliance mappings.

Illustrative response: "We track compliance obligations in our centralized Legal Register, mapping privacy laws, contractual SLAs (service level agreements), and industry standards to specific technical controls. This register is reviewed semi-annually with legal counsel."

Control 5.32: Intellectual Property Rights

Implementation examples

Establish rules protecting proprietary software, copyrights, patents, trademarks, and code licenses.

Maintain software license asset inventories and conduct regular audits to prevent unlicensed software use.

Enforce contractual terms prohibiting unauthorized copying or distribution of third-party IP (intellectual property).

Example audit questions

"How do you prevent unauthorized software usage and safeguard intellectual property rights?"

"Show proof of software license compliance audits and asset ownership records."

Examples of audit evidence

Policy: Intellectual Property Rights & Software Licensing Policy.

License Inventory: Software License Reconciliation Register & Proof of Purchase Records.

Audits: SAM (Software Asset Management) audit logs and compliance reports.

Illustrative response: "Our IP (intellectual property) Policy strictly governs compliant software usage. We track licenses using automated software asset management tools, conducting periodic audits against active installations to guarantee full licensing compliance."

Control 5.33: Protection of Records

Implementation examples

Define a Records Retention Schedule mapping storage, protection, retention, and disposal timelines.

Protect physical and electronic records against tampering, unauthorized access, and degradation.

Configure automated system retention parameters and secure archival storage solutions.

Example audit questions

"What policy governs record retention and secure disposal, and how do you prevent record tampering?"

"Show system retention configurations and certified record destruction logs."

Examples of audit evidence

Policy: Records Management & Retention Policy (with Retention Schedule).

System Config: System archival configuration parameters (WORM storage, retention locks).

Disposal Logs: Secure record destruction certificates and purge logs.

Illustrative response: "Records are managed per our Retention Schedule, which maps retention periods to regulatory duties. Systems utilize immutable storage configurations to prevent tampering, and expired records are purged with audited destruction logs."

Control 5.34: Privacy & Protection of PII (personally identifiable information)

Implementation examples

Publish topic-specific Privacy Policies and appoint a Data Protection Officer (DPO) / Privacy Lead.

Execute Data Protection Impact Assessments (DPIA) prior to processing personal data.

Enforce organizational and technical measures protecting PII (personally identifiable information) throughout its collection and storage lifecycle.

Example audit questions

"How do you ensure processing of Personally Identifiable Information (PII) complies with privacy laws?"

"Show a completed Data Protection Impact Assessment (DPIA) and your PII (personally identifiable information) Processing Register."

Examples of audit evidence

Policy: Privacy Policy & PII (personally identifiable information) Protection Guidelines.

Register: Records of Processing Activities (RoPA) / PII (personally identifiable information) Inventory.

DPIA (data protection impact assessment): Completed Data Protection Impact Assessment (DPIA) reports.

Illustrative response: "PII (personally identifiable information) protection is overseen by our Data Protection Lead under our Privacy Policy. We maintain a Records of Processing Activities register and conduct DPIAs (data protection impact assessments) for any project involving personal data processing."

Control 5.35: Independent Review of Information Security

Implementation examples

Schedule independent evaluations of the ISMS (information security management system) at planned intervals or following major changes.

Appoint qualified, independent assessors (internal auditors outside the reporting line or external third parties).

Report audit findings directly to executive leadership and track corrective action resolution.

Example audit questions

"How do you ensure independent evaluation of your security program and controls?"

"Show independent security review reports presented to management and tracking of corrective actions."

Examples of audit evidence

Schedule: Independent Audit Schedule.

Reports: Internal/External Audit Reports (signed by independent assessors).

Executive Review: Management Review Minutes reviewing audit findings and CAP (corrective action plan) trackers.

Illustrative response: "Independent ISMS (information security management system) reviews are conducted annually by external certified auditors. Audit findings and remediation progress are presented directly to executive leadership during formal Management Reviews."

Control 5.36: Compliance with Security Policies & Standards

Implementation examples

Require system owners and managers to check compliance of technical setups against security policies routinely.

Utilize automated vulnerability scanners, baseline compliance tools, and audit scripts for verification.

Log identified non-compliances, execute root-cause analysis, and track corrective action steps.

Example audit questions

"How do managers verify that technical operations comply with security policies?"

"Show evidence of routine policy compliance reviews and remediation tracking."

Examples of audit evidence

Schedule: Policy Compliance Review Schedule.

Reports: Compliance Review Reports and automated configuration scan results.

Remediation: Non-Conformity Logs (NCR) showing root-cause analysis and action item sign-offs.

Illustrative response: "Managers verify security policy compliance using automated configuration checkers and periodic manual spot-checks. Non-compliance findings are logged in our NCR (nonconformity report) system, triggering root-cause analysis and remediation tracking."

Control 5.37: Documented Operating Procedures

Implementation examples

Create, maintain, and authorize standard operating procedures (SOPs) for all operational security activities.

Standardize instructions covering system maintenance, backups, logging, error handling, and setup.

Review SOPs (standard operating procedures) periodically and update them through formal change management approval processes.

Example audit questions

"Are operational security procedures formally documented, and where are they made available?"

"Show documented SOPs (standard operating procedures) for routine system administration and evidence of periodic review."

Examples of audit evidence

SOP (standard operating procedure) Library: Master Index of Standard Operating Procedures (SOPs) covering IT (information technology) operations.

Sample SOPs (standard operating procedures): Documented SOPs (standard operating procedures) for Backups, Patching, User Onboarding, and Incident Escalation.

Approvals: SOP (standard operating procedure) approval workflow logs and document revision history tables.

Illustrative response: "Operational security tasks follow written SOPs (standard operating procedures) published in our central document management system. Procedures are reviewed annually by team leads and updated via formal change control approvals."

People Controls (Clause 6)

Control 6.1: Screening

Implementation examples

Conduct background screening for all direct hires, contract staff, and third-party contractors.

Tailor checks based on role sensitivity and legal constraints (e.g., identity, CV (curriculum vitae, a summary of qualifications and experience), references, criminal, credit).

Enforce temporary access restrictions while background verification checks remain pending.

Example audit questions

"What background checks are conducted prior to granting employee and contractor system access?"

"Show sampled background screening verification records for newly hired personnel."

Examples of audit evidence

Policy: Background Screening Policy & Procedure.

Screening Files: Anonymized candidate verification logs (reference checks, identity verification, background reports).

Vendor Rules: Vendor contracts mandating contractor screening before deployment.

Illustrative response: "Background checks, including reference, education, identity, and criminal verification where legally permitted, are completed prior to onboarding. System access remains blocked until screening verification is fully confirmed."

Control 6.2: Terms & Conditions of Employment

Implementation examples

Incorporate explicit information security responsibilities into employment contracts and terms of service.

Mandate signed acceptance of security policies, NDAs (non-disclosure agreements), and acceptable use guidelines prior to work commencement.

Define clear post-employment security duties and contractual consequences for security breaches.

Example audit questions

"How are security obligations incorporated into employment agreements and job contracts?"

"Show sample employment terms containing security duties, confidentiality terms, and violation consequences."

Examples of audit evidence

Contract Templates: Standard Employment Contract Template & Code of Conduct.

Signed Terms: Sample signed employee agreements acknowledging security responsibilities.

Policy Acknowledgments: Signed onboarding policy receipt sign-offs.

Illustrative response: "Information security duties are embedded into standard employment contracts and our Code of Conduct. Employees sign these terms prior to day one, formally acknowledging policy compliance duties and post-employment NDAs (non-disclosure agreements)."

Control 6.3: Security Awareness, Education & Training

Implementation examples

Deliver mandatory security awareness training to all personnel during onboarding and at regular intervals.

Tailor specialized technical training for privileged users, developers, and incident response personnel.

Conduct periodic simulated phishing tests and knowledge evaluations to measure program effectiveness.

Example audit questions

"How do you train personnel on security awareness, and how do you track completion?"

"Show training completion metrics, curriculum materials, and phishing simulation results."

Examples of audit evidence

Plan: Security Awareness & Training Strategy / Curriculum.

Completion Logs: LMS (learning management system) completion dashboards proving >95% employee training completion.

Phishing Metrics: Simulated phishing campaign analytics and remedial training records.

Illustrative response: "All personnel undergo mandatory security awareness training upon hire and annually thereafter, tracked via our LMS (learning management system) platform. We supplement training with monthly simulated phishing exercises to evaluate and maintain user awareness."

Control 6.4: Disciplinary Process

Implementation examples

Publish a formal, tiered Disciplinary Policy governing information security policy violations.

Ensure incidents undergo impartial investigation to establish facts before applying sanctions.

Factor intent (accidental vs. malicious), impact severity, and historical violations into disciplinary actions.

Example audit questions

"What formal process governs non-compliance with information security policies?"

"Show your documented Disciplinary Policy and proof of distribution to employees."

Examples of audit evidence

Policy: Documented Disciplinary Policy / Employee Handbook section.

Communication: Proof of policy publication on intranet and employee sign-off logs.

Action Logs: Redacted HR (human resources) disciplinary meeting records for security policy non-compliance (if applicable).

Illustrative response: "Security violations are handled under our formal Disciplinary Policy detailed in the Employee Handbook. The policy enforces a tiered response scale based on incident severity and intent, executed in coordination with HR (human resources)."

Control 6.5: Responsibilities After Termination or Change of Employment

Implementation examples

Define post-employment security duties, non-disclosure terms, and IP (intellectual property) ownership in employment contracts.

Execute role-transition workflows revoking old access permissions before granting new role rights.

Conduct formal exit interviews reminding departing staff of ongoing confidentiality obligations.

Example audit questions

"How are ongoing confidentiality duties enforced after an employee leaves or changes roles?"

"Show signed exit interview acknowledgments confirming post-employment duties."

Examples of audit evidence

SOP (standard operating procedure): Offboarding & Role Transition Standard Operating Procedure.

Exit Sign-offs: Signed Exit Interview Acknowledgments emphasizing ongoing NDA (non-disclosure agreement) obligations.

Revocation Records: Immediate access revocation logs tied to termination dates.

Illustrative response: "Post-employment duties are defined in initial contracts and reiterated during formal exit interviews. Departing staff sign an exit acknowledgment confirming their ongoing non-disclosure and IP (intellectual property) protection obligations."

Control 6.6: Confidentiality or Non-Disclosure Agreements

Implementation examples

Require legally binding Non-Disclosure Agreements (NDAs) for all employees, contractors, and third parties.

Define specific scope, authorized use, protection duration, and breach liabilities within NDAs (non-disclosure agreements).

Review NDA (non-disclosure agreement) templates periodically to ensure alignment with current legal and business boundaries.

Example audit questions

"How do you ensure employees and external contractors sign confidentiality agreements?"

"Show sample executed NDAs (non-disclosure agreements) for staff, contractors, and third-party vendor engagements."

Examples of audit evidence

Templates: Standard Employee NDA (non-disclosure agreement) & Third-Party Mutual NDA (non-disclosure agreement) templates.

Executed NDAs (non-disclosure agreements): Sample executed NDAs (non-disclosure agreements) signed by employees, contractors, and vendors.

Review Logs: Annual legal review records of confidentiality agreement templates.

Illustrative response: "All staff, contractors, and vendors must sign legally binding non-disclosure agreements prior to receiving system or data access. Executed NDAs (non-disclosure agreements) are stored centrally in our legal repository and reviewed annually."

Control 6.7: Remote Working

Implementation examples

Publish a Remote Working Policy defining physical, technical, and environment security rules.

Mandate central device management (MDM/EDR (endpoint detection and response, monitoring devices for threats)), storage encryption, secure VPN (virtual private network, an encrypted network connection)/VDI (virtual desktop infrastructure) access, and MFA (multi-factor authentication, using more than one type of identity check).

Enforce clear desk/screen guidelines and physical storage controls within home/remote environments.

Example audit questions

"What policy governs remote working, and how are remote endpoint devices secured technically?"

"Show your Remote Working Policy and security configuration benchmarks for remote devices."

Examples of audit evidence

Policy: Remote Working & Telecommuting Policy.

Technical Evidence: VPN (virtual private network, an encrypted network connection)/MFA (multi-factor authentication, using more than one type of identity check) configuration logs, full-disk encryption compliance reports (BitLocker/FileVault).

BYOD (bring your own device) Agreement: Signed BYOD (bring your own device) agreements (if personal devices are permitted).

Illustrative response: "Remote work is governed by our Remote Working Policy. Corporate devices enforce mandatory disk encryption, central EDR (endpoint detection and response, monitoring devices for threats), multi-factor authentication, and encrypted VPN (virtual private network, an encrypted network connection) tunnels to ensure remote connections remain secure."

Control 6.8: Information Security Event Reporting

Implementation examples

Establish simple, accessible reporting mechanisms (e.g., dedicated email, intranet button, helpdesk tag).

Instruct personnel to report suspected incidents, vulnerabilities, phishing, or physical gaps promptly.

Prohibit staff from self-investigating or testing security vulnerabilities.

Example audit questions

"How do employees report suspected security events or phishing emails, and how are channels publicized?"

"Show staff guidance on security event reporting and sample user-submitted event tickets."

Examples of audit evidence

Procedure: Security Event Reporting Procedure / Guidelines.

Channels: Screenshots of intranet reporting forms, Phish-Alert Outlook buttons, and helpdesk portal options.

Ticket Logs: Sample user-reported event tickets logged in the helpdesk system.

Illustrative response: "Staff report security events via a dedicated 'Report Security Incident' portal button or email alias. Reporting steps are emphasized during onboarding and reinforced through monthly security communications."

Physical Controls (Clause 7)

Control 7.1: Physical Security Perimeters

Implementation examples

Define physical boundaries (walls, card-access doors, gates) protecting facilities and server rooms.

Ensure facility structures are physically sound without external gaps or weak entry points.

Equip exterior perimeter doors, windows, and ventilation routes with locks, alarms, and barriers.

Example audit questions

"How are physical security perimeters defined and secured against unauthorized entry?"

"Show site architectural plans and maintenance logs for physical perimeter entry barriers."

Examples of audit evidence

Blueprints: Facility site layout maps showing defined physical security perimeters.

Policy: Physical Security Policy.

Maintenance Logs: Door lock, physical barrier, and perimeter alarm inspection logs.

Illustrative response: "Our facility perimeters are defined by physical barriers, reinforced doors, and badge-access entryways. Physical boundaries undergo regular security sweeps and annual structural maintenance inspections."

Control 7.2: Physical Entry

Implementation examples

Control physical entry points using authentication mechanisms (badge readers, biometrics, PINs (personal identification numbers)).

Maintain visitor registration logbooks, visible badge requirements, and continuous escort rules.

Secure loading docks, delivery areas, and multi-tenant entry points away from processing facilities.

Example audit questions

"How do you restrict physical entry to authorized personnel and manage visitor access?"

"Show physical access logs, visitor registers, and physical access badge provisioning records."

Examples of audit evidence

Logs: Electronic access control system entry logs & Visitor Sign-in/Sign-out Registers.

SOP (standard operating procedure): Physical Access Control & Visitor Management Procedure.

Visual Evidence: Photos or visual inspection evidence of physical access control readers.

Illustrative response: "Physical access requires authenticated keycard access linked to our central access control system. Visitors must register at reception, wear visible badges, and remain escorted by authorized personnel at all times."

Control 7.3: Securing Offices, Rooms & Facilities

Implementation examples

Design internal spaces to isolate critical processing assets away from public access areas.

Maintain low-profile facilities without external signage signaling sensitive operations.

Restrict internal directory details and apply physical access boundaries to sensitive rooms.

Example audit questions

"How are internal high-risk areas (e.g., server rooms, execution hubs) physically isolated?"

"Show design layouts and access permission lists for internal secure rooms."

Examples of audit evidence

Layout Maps: Facility floor plans showing secure internal zoning and server room isolation.

Permissions: Access control system configuration listing users authorized for secure rooms.

Inspection Logs: Internal facility inspection logs verifying door locks and restricted signage.

Illustrative response: "Server rooms and sensitive execution hubs are located deep within our facility layout, requiring secondary badge authentication for access. External signage is deliberately avoided to maintain a low profile."

Control 7.4: Physical Security Monitoring

Implementation examples

Deploy continuous physical surveillance (CCTV, intruder motion sensors, door contact alarms).

Secure surveillance feeds, recording equipment, and alarm control panels from unauthorized access.

Conduct routine testing of physical alarm systems, CCTV (closed-circuit television) cameras, and motion sensors.

Example audit questions

"How do you monitor physical perimeters and secure areas for unauthorized physical entry?"

"Show CCTV (closed-circuit television) recording configuration details, alarm test logs, and physical surveillance design plans."

Examples of audit evidence

System Config: CCTV (closed-circuit television) retention settings (verifying 30-90 day footage retention) and access lists.

Test Logs: Intruder alarm test logs and CCTV (closed-circuit television) preventative maintenance records.

Design Specifications: Physical surveillance system topology and camera placement maps.

Illustrative response: "Facilities are monitored continuously via CCTV (closed-circuit television) cameras and motion sensors linked to an alarm system. Video footage is encrypted, access-restricted, retained for 90 days, and verified through monthly alarm testing."

Control 7.5: Protecting Against Physical & Environmental Threats

Implementation examples

Identify physical hazards (fire, flood, environmental risk, power surge, natural disaster).

Deploy protective controls: early fire detection/suppression, water leak sensors, UPS (uninterruptible power supply) power, and surge arrestors.

Conduct regular preventative maintenance and environmental risk assessments.

Example audit questions

"What protective measures defend your processing hardware from fire, water, and power disruptions?"

"Show maintenance records for fire suppression systems, UPS (uninterruptible power supply) batteries, and environmental sensors."

Examples of audit evidence

Risk Assessment: Physical & Environmental Risk Assessment Report.

Maintenance Logs: FM-200/Inergen fire suppression service logs, UPS (uninterruptible power supply) battery inspection records.

Certificates: Municipal fire safety compliance certificates and environmental test logs.

Illustrative response: "Data processing equipment is protected by gas-based fire suppression systems, environmental water sensors, and redundant UPS (uninterruptible power supply) systems. Protective gear undergoes scheduled semi-annual vendor maintenance."

Control 7.6: Working in Secure Areas

Implementation examples

Establish strict operational guidelines for working inside secure areas (e.g., server rooms, SOC).

Prohibit unmonitored lone working, photography, recording devices, and unauthorized user gear.

Keep unoccupied secure areas locked and conduct regular physical verification sweeps.

Example audit questions

"What operational rules govern staff activities inside high-security physical zones?"

"Show documented secure area guidelines and physical inspection logs for secure rooms."

Examples of audit evidence

Policy: Working in Secure Areas Procedure / Rules Notice.

Signage: Photos showing posted secure area entry rules (No Cameras, Escort Required).

Audit Logs: Secure area physical inspection sweep logs and access authorization lists.

Illustrative response: "Working in secure zones requires adherence to posted operational rules: mobile devices and recording gear are prohibited, spaces remain locked when unoccupied, and lone working is prohibited by policy."

Control 7.7: Clear Desk & Clear Screen

Implementation examples

Publish a Clear Desk and Clear Screen Policy covering physical paperwork, screens, and media.

Enforce automatic screen lock timeouts (e.g., 5-10 minutes) across all endpoint computers.

Require secure locking of physical paperwork and conduct unannounced workplace spot checks.

Example audit questions

"How do you enforce clear desk and screen rules across office environments?"

"Show your Clear Desk Policy, screen lock GPO/MDM (mobile device management) configuration settings, and spot-check logs."

Examples of audit evidence

Policy: Clear Desk & Clear Screen Policy.

Config Screenshots: Central GPO/MDM (mobile device management) settings enforcing automatic 5-minute screen locks.

Spot Check Logs: Completed physical security spot-check audit reports.

Illustrative response: "Our Clear Desk Policy mandates locking away paper files when unattended. Screens automatically lock after 5 minutes of inactivity via central MDM (mobile device management) policies, supported by routine after-hours spot checks."

Control 7.8: Equipment Siting & Protection

Implementation examples

Position equipment to minimize physical hazard exposures, unauthorized viewing, and environmental risks.

Protect server racks and network cabinets using physical keylocks or keypad access locks.

Prohibit eating, drinking, and smoking near sensitive processing hardware.

Example audit questions

"How is server and network equipment physically sited and protected from unauthorized access?"

"Show physical equipment placement rules and spot-check logs of server room conditions."

Examples of audit evidence

Guidelines: Equipment Siting & Protection Standard.

Rack Security: Photos/logs showing locked server racks and cable management enclosures.

Environmental Logs: Temperature and humidity sensor monitoring logs.

Illustrative response: "Processing equipment is sited in restricted server rooms, housed in locked server racks, and positioned to prevent shoulder surfing or environmental exposure. Environmental conditions are continuously monitored."

Control 7.9: Security of Assets Off-Premises

Implementation examples

Require formal authorization and inventory logging before taking hardware off-premises.

Enforce full-disk encryption, remote wipe capabilities, and central endpoint protection on mobile assets.

Instruct users on physical care, preventing unattended exposure in public, and incident reporting.

Example audit questions

"How do you manage physical and logical security for assets used outside company facilities?"

"Show authorization logs for off-site equipment and proof of full-disk encryption compliance."

Examples of audit evidence

Policy: Mobile Asset & Off-Premises Equipment Policy.

Asset Logs: Equipment checkout logs and MDM (mobile device management) enrollment inventories.

Technical Proof: Disk encryption compliance status reports (BitLocker/FileVault).

Illustrative response: "Taking assets off-site requires ticketed management approval. All portable assets enforce full-disk encryption, active MDM (mobile device management) controls, remote wipe capabilities, and physical handling rules."

Control 7.10: Storage Media

Implementation examples

Establish strict guidelines for managing removable storage media (USBs, external drives, tapes).

Encrypt all sensitive data written to removable media and restrict unauthorized media connections.

Sanitize or destroy storage media securely before reuse or disposal, retaining destruction logs.

Example audit questions

"How do you govern the usage, transfer, encryption, and disposal of storage media?"

"Show your Removable Media Policy, device USB (Universal Serial Bus) restriction settings, and media destruction logs."

Examples of audit evidence

Policy: Storage Media Management & Disposal Policy.

Technical Control: EDR (endpoint detection and response, monitoring devices for threats)/MDM (mobile device management) configuration screenshots blocking unauthorized USB (Universal Serial Bus) storage devices.

Destruction Certificates: Certificates of Data Destruction for sanitized or shredded drives.

Illustrative response: "Removable media usage is restricted via central EDR (endpoint detection and response, monitoring devices for threats) policies. Where authorized, media must be encrypted. Deprecated storage media is sanitized using NIST (National Institute of Standards and Technology) 800-88 standards and physically destroyed by certified vendors."

Control 7.11: Supporting Utilities

Implementation examples

Maintain redundant power (UPS, backup generators), telecommunication links, and HVAC (heating, ventilation and air conditioning) systems.

Perform routine inspection and vendor servicing of supporting utility systems per specifications.

Isolate networked utility management interfaces onto dedicated, access-restricted VLAN (virtual local area network) segments.

Example audit questions

"How are supporting utilities (power, HVAC (heating, ventilation and air conditioning), water) maintained to ensure continuous system operation?"

"Show preventative maintenance contracts, inspection logs, and failover test records for utility infrastructure."

Examples of audit evidence

Maintenance Contracts: Vendor SLAs (service level agreements) for generator, UPS (uninterruptible power supply), and HVAC (heating, ventilation and air conditioning) servicing.

Logs: Preventative maintenance reports and monthly generator run-test logs.

Architecture: Network diagrams showing isolated building management system (BMS) VLANs (virtual local area networks).

Illustrative response: "Supporting utilities feature dual power feeds, UPS (uninterruptible power supply) backup, and diesel generators. Equipment undergoes monthly test runs and quarterly vendor servicing, while utility management software resides on isolated VLANs (virtual local area networks)."

Control 7.12: Cabling Security

Implementation examples

Route power and telecommunication cabling underground or enclose them inside protective conduits.

Maintain physical separation between power cables and data lines to avoid signal interference.

Lock access to patch panels, cable risers, and wiring closets; label cables clearly at both ends.

Example audit questions

"How are power and data cables protected against physical damage, interception, or interference?"

"Show wiring closet access logs, physical cable routing guidelines, and installation photos."

Examples of audit evidence

Guidelines: Network Cabling & Physical Infrastructure Standard.

Visual Evidence: Photos of conduit-enclosed cables, locked patch cabinets, and tagged patch leads.

Access Logs: Physical access logs for network wiring closets and riser rooms.

Illustrative response: "Network cables are encased in protective conduits, routed away from power lines to eliminate interference, and terminate in locked wiring closets accessible strictly to authorized network engineers."

Control 7.13: Equipment Maintenance

Implementation examples

Service equipment regularly per manufacturer specifications and vendor service schedules.

Restrict maintenance activities to qualified vendor personnel and escort technicians on-site.

Inspect hardware post-servicing to verify integrity and clear temporary maintenance access.

Example audit questions

"How do you ensure equipment maintenance is conducted safely without compromising security?"

"Show equipment maintenance schedules, vendor service logs, and technician escort records."

Examples of audit evidence

Schedule: Central Hardware Preventative Maintenance Schedule.

Service Logs: Vendor maintenance service tickets and technician visit sign-in logs.

SOP (standard operating procedure): Third-Party Technician Escort & Servicing Procedure.

Illustrative response: "Hardware maintenance is conducted per vendor schedules. Third-party technicians must be vetted, escorted continuously during site visits, and restricted from system data, with all completed service logged."

Control 7.14: Secure Disposal or Re-Use of Equipment

Implementation examples

Verify equipment contains no sensitive data prior to disposal, recycling, or re-assignment.

Sanitize storage media using certified overwriting tools (NIST 800-88) or physical destruction.

Remove all company asset tags, labels, and proprietary markings before hardware leaves custody.

Example audit questions

"How do you verify hardware is fully sanitized before disposal or equipment re-allocation?"

"Show documented equipment disposal procedures and sample Certificates of Data Destruction."

Examples of audit evidence

Policy: Equipment Sanitization & Disposal Policy.

Disposal Logs: Equipment Disposal Register tracking asset serial numbers.

Certificates: Certified Certificates of Destruction / NIST (National Institute of Standards and Technology) 800-88 Wiping Verification Logs.

Illustrative response: "Before disposal or reuse, equipment drives are sanitized using NIST (National Institute of Standards and Technology) 800-88 compliant software. Unusable drives undergo physical shredding by licensed vendors, yielding formal Certificates of Destruction."

Technological Controls (Clause 8)

Control 8.1: User End Point Devices

Implementation examples

Enforce centralized management (MDM/EDR (endpoint detection and response, monitoring devices for threats)) across all company workstations, laptops, and mobiles.

Automate security baselines: full-disk encryption, OS (operating system) auto-updates, personal firewalls, and EDR (endpoint detection and response, monitoring devices for threats) agents.

Configure remote wiping capabilities and enforce containerization for BYOD (bring your own device) corporate data.

Example audit questions

"How are endpoint devices configured and managed technically to enforce security controls?"

"Show central MDM (mobile device management)/EDR (endpoint detection and response, monitoring devices for threats) dashboard configuration status proving 100% encryption and patching compliance."

Examples of audit evidence

Policy: Endpoint Security Standard.

Dashboard Exports: Central MDM (Intune/Jamf) reports showing disk encryption (BitLocker) and EDR (endpoint detection and response, monitoring devices for threats) active status.

Configs: Baseline policy deployment exports showing password lock and remote wipe rules.

Illustrative response: "Workstations are managed centrally via MDM (mobile device management), enforcing BitLocker disk encryption, automated patching, active EDR (endpoint detection and response, monitoring devices for threats) agents, and 5-minute screen lockouts. Non-compliant devices are auto-blocked from network access."

Control 8.2: Privileged Access Rights

Implementation examples

Restrict administrative privileges strictly based on job role necessity and formal management approval.

Require dedicated, separate admin accounts; prohibit conducting daily tasks (email, browsing) on admin identifiers (IDs).

Implement Privileged Access Management (PAM), Multi-Factor Authentication (MFA), and detailed audit logging.

Example audit questions

"How do you manage, restrict, and review administrative privileges across your systems?"

"Show your privileged account inventory, authorization tickets, and administrative activity logs."

Examples of audit evidence

Policy: Privileged Access Management (PAM) Policy.

Inventory: Register of Domain/System Administrative Accounts.

Approvals & Reviews: Ticketed authorization approvals for privilege grants and quarterly PAM (privileged access management) review logs.

Illustrative response: "Privileged access is governed strictly under our PAM (privileged access management) policy. System admins use dedicated, separate administrative accounts secured with MFA (multi-factor authentication, using more than one type of identity check), and all administrative session activities are logged continuously."

Control 8.3: Information Access Restriction

Implementation examples

Restrict access to sensitive information and application functions per the Access Control Policy.

Implement Role-Based Access Controls (RBAC) and Attribute-Based Access Controls (ABAC).

Enforce object-level access controls and data masking within application databases and storage.

Example audit questions

"How do systems restrict access to sensitive datasets based on user roles and permissions?"

"Show access permission configurations and access control lists (ACLs) for sensitive system files."

Examples of audit evidence

RBAC (role-based access control) Matrix: Defined Role-Based Access Control permission matrix per application.

ACL (access control list) Proof: Database/File System ACL (access control list) configuration exports showing restricted user permissions.

Access Logs: Application audit logs showing access authorization enforcement.

Illustrative response: "Application access is governed by RBAC (role-based access control) matrices enforced at the database and application layers. Users access strictly the data objects authorized for their operational role, verified via automated ACL (access control list) enforcement."

Control 8.4: Access to Source Code

Implementation examples

Centralize source code inside secure repositories (e.g., GitHub Enterprise, GitLab).

Restrict write/commit permissions to authorized developers; mandate peer code reviews.

Enforce Multi-Factor Authentication (MFA), branch protection rules, and access audit logging.

Example audit questions

"How do you restrict read and write access to application source code and configuration files?"

"Show repository permission settings, branch protection rules, and commit authorization logs."

Examples of audit evidence

Policy: Source Code Access & Repository Policy.

Repo Config: GitHub/GitLab permission settings demonstrating restricted write permissions and enforced MFA (multi-factor authentication, using more than one type of identity check).

Audit Logs: Repository access and commit history audit logs.

Illustrative response: "Source code resides in centralized, MFA (multi-factor authentication, using more than one type of identity check)-protected repositories. Read access aligns with role necessity, while write access mandates branch protection rules requiring peer code review sign-off before merging."

Control 8.5: Secure Authentication

Implementation examples

Implement strong authentication protocols tailored to system criticality (MFA, SSO (single sign-on), FIDO2 (Fast Identity Online 2, a standard for strong authentication) tokens).

Enforce secure login workflows: password masking, non-descript error messages, and CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) / lockout rules.

Configure automated session timeouts and alert triggers for anomalous login attempts.

Example audit questions

"What secure authentication mechanisms defend your critical applications and infrastructure?"

"Show MFA (multi-factor authentication, using more than one type of identity check) enforcement configurations, SSO (single sign-on) parameters, and account lockout setting screenshots."

Examples of audit evidence

Policy: Authentication & Identification Standard.

Config Proof: Identity Provider (Okta/Azure AD) configuration exports proving global MFA (multi-factor authentication, using more than one type of identity check) enforcement.

Settings: Screenshots of application lockout rules (e.g., lock after 5 invalid attempts).

Illustrative response: "All corporate applications enforce single sign-on (SSO) backed by mandatory Multi-Factor Authentication. Login portals enforce input masking, account lockouts after 5 failed attempts, and automatic session timeouts."

Control 8.6: Capacity Management

Implementation examples

Monitor processing, storage, memory, network, and facility capacity metrics continuously.

Project future resource requirements based on business growth forecasts and system performance trends.

Implement autoscaling cloud rules and resource tuning to prevent performance degradation.

Example audit questions

"How do you monitor current system capacity and project future infrastructure requirements?"

"Show capacity monitoring dashboards, utilization trend reports, and capacity management plans."

Examples of audit evidence

Plan: Capacity Management Plan.

Dashboards: Monitoring system metrics (Datadog/CloudWatch) tracking CPU (central processing unit), memory, and storage utilization.

Reviews: Quarterly Infrastructure Resource & Scaling Review reports.

Illustrative response: "We monitor CPU (central processing unit), memory, and storage utilization via cloud monitoring tools set with alert thresholds at 80%. System trends are reviewed quarterly to scale resources proactively in alignment with growth projections."

Control 8.7: Protection Against Malware

Implementation examples

Deploy centralized Next-Gen Anti-Malware / Endpoint Detection and Response (EDR) across all endpoints and servers.

Automate malware signature definitions, real-time file scanning, and malicious traffic blocking.

Isolate infected devices automatically and train users to recognize malicious content.

Example audit questions

"How do you defend systems against malware, and how are signature updates verified?"

"Show central EDR (endpoint detection and response, monitoring devices for threats) management console reports confirming real-time protection and auto-updates."

Examples of audit evidence

Policy: Anti-Malware & Endpoint Protection Policy.

EDR (endpoint detection and response, monitoring devices for threats) Console: Central EDR (endpoint detection and response, monitoring devices for threats) dashboard exports showing 100% active agent coverage and auto-update status.

Alert Logs: Historical malware detection, isolation, and remediation event logs.

Illustrative response: "Anti-malware protection is deployed centrally via our EDR (endpoint detection and response, monitoring devices for threats) platform. Definitions update automatically in real-time, agents perform continuous behavioral scanning, and infected endpoints isolate automatically upon threat detection."

Control 8.8: Management of Technical Vulnerabilities

Implementation examples

Maintain an accurate asset software inventory and run routine automated vulnerability scans.

Evaluate vulnerability severity (CVSS scores) and apply patches within defined SLA (service level agreement) windows (e.g., Critical = 7 days).

Perform periodic third-party penetration testing and enforce change management for patch deployments.

Example audit questions

"What is your vulnerability management process, and what SLAs (service level agreements) govern security patch deployment?"

"Show recent vulnerability scan reports, penetration test summaries, and patch execution logs."

Examples of audit evidence

Policy: Technical Vulnerability & Patch Management Policy (with SLA (service level agreement) targets).

Scan Reports: Internal/External Vulnerability Scan Reports (Nessus/Qualys) and Pen-Test Reports.

Patch Logs: Patch deployment logs (WSUS/Intune) verifying vulnerability remediation within SLAs (service level agreements).

Illustrative response: "We run weekly automated vulnerability scans and annual third-party penetration tests. Identified flaws are prioritized by CVSS (Common Vulnerability Scoring System) score and remediated according to SLA (service level agreement) targets, deploying patches through formal change control."

Control 8.9: Configuration Management

Implementation examples

Establish and document secure configuration baselines (hardening standards) based on CIS (Center for Internet Security) benchmarks.

Automate configuration management using infrastructure-as-code and central deployment scripts.

Monitor live configurations continuously to detect and remediate configuration drift.

Example audit questions

"How do you establish, enforce, and monitor secure configuration baselines across hardware and software?"

"Show your server/endpoint hardening standards and automated configuration compliance reports."

Examples of audit evidence

Hardening Guides: Documented Server, Database, and Workstation Hardening Standards (aligned to CIS (Center for Internet Security)).

IaC (infrastructure as code) Scripts: Ansible/Terraform/GPO configuration baseline files.

Drift Reports: Automated configuration compliance monitoring logs verifying baseline adherence.

Illustrative response: "Systems are hardened against CIS (Center for Internet Security) benchmarks using automated configuration scripts (Terraform/Ansible). Configuration management tools continuously monitor live environments, alerting our team to any configuration drift."

Control 8.10: Information Deletion

Implementation examples

Establish automated data retention and secure deletion workflows for expired data datasets.

Utilize certified cryptographic erasure or overwriting tools preventing data recovery.

Execute formal data erasure verification across cloud storage, backup media, and databases.

Example audit questions

"How do you ensure data is securely and permanently deleted when no longer required?"

"Show technical deletion procedures, automated purge scripts, and cloud erasure verification logs."

Examples of audit evidence

SOP (standard operating procedure): Information Deletion & Sanitization Procedure.

Purge Logs: Database purge execution logs, automated S3 bucket lifecycle rule configurations.

Vendor Certificates: Certified Data Erasure Reports from cloud or storage vendors.

Illustrative response: "Data deletion is automated using database retention scripts and cloud lifecycle rules that execute cryptographic erasure upon expiration, generating automated purge logs confirming permanent deletion."

Control 8.11: Data Masking

Implementation examples

Apply data masking, pseudonymization, or anonymization to sensitive datasets (PII, financial).

Enforce dynamic data masking within production systems based on user role permissions.

Mask sensitive operational data before exporting datasets into development or testing setups.

Example audit questions

"Where and how do you implement data masking or anonymization to protect sensitive information?"

"Show data masking rules configured in applications/databases and masked database export samples."

Examples of audit evidence

Policy: Data Masking & Anonymization Standard.

Technical Config: Database dynamic data masking configuration scripts (SQL Server/Postgres).

Samples: Redacted UI (user interface) screenshots or scrubbed dataset export files demonstrating masked fields.

Illustrative response: "We employ dynamic data masking at the database layer to obfuscate PII (personally identifiable information) and payment data for unauthorized roles. Non-production environments receive scrubbed, anonymized datasets generated via automated masking pipelines."

Control 8.12: Data Leakage Prevention (DLP)

Implementation examples

Deploy DLP (data loss prevention) tools across endpoints, email gateways, cloud storage, and network boundaries.

Define DLP (data loss prevention) rules detecting sensitive data patterns (SSNs (social security numbers), credit card numbers, source code, IP (intellectual property)).

Configure DLP (data loss prevention) tools to alert, restrict, or block unauthorized transfers to personal media or web sites.

Example audit questions

"How do you detect and prevent unauthorized data exfiltration across network channels and endpoints?"

"Show DLP (data loss prevention) policy configuration settings, sensitive data rule definitions, and DLP (data loss prevention) alert event logs."

Examples of audit evidence

Policy: Data Leakage Prevention (DLP) Policy.

System Config: DLP (data loss prevention) tool (Microsoft Purview/Symantec) policy configuration dashboards.

Alert Logs: DLP (data loss prevention) incident monitoring logs showing blocked file uploads or restricted USB (Universal Serial Bus) writes.

Illustrative response: "DLP (data loss prevention) software monitors endpoints, email, and cloud channels. Rules block unauthorized transfers of classified data, such as PII (personally identifiable information) or source code, to external web services or removable storage, generating real-time SOC alerts."

Control 8.13: Information Backup

Implementation examples

Establish a Backup Policy defining full/incremental backup schedules matching system RPO (recovery point objective, the maximum acceptable data loss measured in time) goals.

Store backup copies off-site or in geographically isolated, access-restricted cloud locations.

Encrypt backups in transit and at rest; test restoration procedures regularly in isolated test environments.

Example audit questions

"What backup schedules are maintained, how are backups secured, and how often is restoration tested?"

"Show your Backup Policy, automated backup job logs, off-site storage configs, and restoration test logs."

Examples of audit evidence

Policy: Backup & Recovery Policy.

Execution Logs: Automated backup completion logs proving daily/weekly backup success.

Test Evidence: Quarterly Backup Restoration Test Reports verifying data integrity and RPO (recovery point objective, the maximum acceptable data loss measured in time) metrics.

Illustrative response: "We perform automated daily incremental and weekly full backups encrypted via AES-256 and replicated to an isolated cloud region. Restoration integrity is validated quarterly through trial data restores."

Control 8.14: Redundancy of Information Processing Facilities

Implementation examples

Design system architecture with redundant components (dual firewalls, load balancers, multi-AZ (availability zone) cloud).

Configure automated failover mechanisms to maintain system availability during hardware/site failures.

Test failover mechanisms periodically to verify seamless operational transitions without data loss.

Example audit questions

"How is redundancy built into system infrastructure to eliminate single points of failure?"

"Show architecture diagrams proving component redundancy and recent failover test reports."

Examples of audit evidence

Architecture: High-Availability (HA) Network & System Topology Diagrams.

Config Logs: Load balancer, database clustering, and multi-region replication configuration exports.

Failover Logs: Completed DR (disaster recovery)/HA (high availability) failover simulation test logs.

Illustrative response: "Our architecture eliminates single points of failure through multi-region cloud deployment, database clustering, and auto-scaling load balancers. Failover automation is verified during annual continuity exercises."

Control 8.15: Logging

Implementation examples

Define logging requirements capturing security events, admin actions, login attempts, and system errors.

Include standard metadata in logs: user identifier (ID), timestamp, event type, source IP (Internet Protocol), and success/failure status.

Protect log files against unauthorized editing or deletion using append-only, encrypted SIEM (security information and event management, combining security logs for monitoring) storage.

Example audit questions

"What security events are logged, and how do you protect log files from unauthorized alteration?"

"Show your Logging Policy, SIEM (security information and event management, combining security logs for monitoring) log collector configurations, and log immutability settings."

Examples of audit evidence

Policy: Central Logging & Audit Trail Policy.

SIEM (security information and event management, combining security logs for monitoring) Config: SIEM (security information and event management, combining security logs for monitoring) log ingestion rules and WORM (write once, read many)/append-only storage bucket permission settings.

Sample Logs: Raw log exports showing standardized timestamped event metadata.

Illustrative response: "System, application, and administrative events are forwarded to a centralized SIEM (security information and event management, combining security logs for monitoring). Logs capture timestamps, user identifiers (IDs), and event details, protected against tampering via read-only, append-only storage configurations."

Control 8.16: Monitoring Activities

Implementation examples

Deploy continuous automated monitoring tools (SIEM, EDR (endpoint detection and response, monitoring devices for threats), IDS (intrusion detection system)/IPS (intrusion prevention system), NTA (network traffic analysis)) to detect anomalous behavior.

Establish normal operational baselines and configure alert thresholds to identify potential attacks.

Assign SOC analysts to investigate, triage, and escalate triggered monitoring alerts 24/7.

Example audit questions

"How do you monitor systems for anomalous behavior, and what process handles generated security alerts?"

"Show SIEM (security information and event management, combining security logs for monitoring) alert configuration rules, SOC triage dashboards, and alert investigation reports."

Examples of audit evidence

SOP (standard operating procedure): Security Monitoring & Alert Triage Standard Operating Procedure.

Alert Rules: SIEM (security information and event management, combining security logs for monitoring)/IDS (intrusion detection system) anomaly detection rule configurations and baseline parameters.

Investigation Logs: SOC alert investigation tickets showing analysis and resolution steps.

Illustrative response: "Our SOC uses SIEM (security information and event management, combining security logs for monitoring) and behavioral analytics to monitor network and system activities continuously against baselines. Anomalous events trigger automated alerts evaluated by analysts per our Triage SOP (standard operating procedure)."

Control 8.17: Clock Synchronization

Implementation examples

Synchronize system clocks across all servers, routers, firewalls, and security gear to trusted time sources.

Utilize Network Time Protocol (NTP / PTP (Precision Time Protocol)) synchronized to atomic or GPS (Global Positioning System) standard reference clocks (Stratum 1/2).

Monitor clock drift and log synchronization errors across hybrid and cloud infrastructure.

Example audit questions

"How are system clocks synchronized across your infrastructure to support log correlation?"

"Show NTP (Network Time Protocol) server configuration files and clock synchronization verification logs."

Examples of audit evidence

Policy: Clock Synchronization Standard.

NTP (Network Time Protocol) Configs: Central server and network device configuration exports showing NTP (Network Time Protocol) reference sources (e.g., pool.ntp.org).

Drift Logs: SIEM (security information and event management, combining security logs for monitoring)/NTP (Network Time Protocol) drift monitoring logs proving clock synchronization consistency.

Illustrative response: "System clocks across all servers, databases, and network devices are synchronized to external Stratum 1 NTP (Network Time Protocol) time sources. Central monitoring alerts our team if clock drift exceeds 500 milliseconds."

Control 8.18: Use of Privileged Utility Programs

Implementation examples

Restrict access to system utilities capable of overriding operating system and application controls.

Require formal authorization, MFA (multi-factor authentication, using more than one type of identity check), and privileged account access to execute utility software.

Log all utility usage comprehensively and segregate utility software from operational production applications.

Example audit questions

"How do you control and monitor the use of privileged utility programs that can override security controls?"

"Show your authorized utility inventory, access restriction configs, and utility execution logs."

Examples of audit evidence

Inventory: Register of Authorized Privileged Utility Programs.

Permissions: System access lists showing restricted execution permissions for utilities.

Execution Logs: SIEM (security information and event management, combining security logs for monitoring) log reports filtering utility execution events (e.g., Regedit, Process Explorer, dd).

Illustrative response: "Privileged utility programs capable of overriding controls are restricted to authorized infrastructure engineers via PAM (privileged access management) access. Execution rights require MFA (multi-factor authentication, using more than one type of identity check), and all utility operations are captured in audit logs."

Control 8.19: Installation of Software on Operational Systems

Implementation examples

Restrict software installation on live production servers strictly to authorized system administrators.

Prohibit users from installing unapproved software; block unauthorized execution using AppLocker/EDR (endpoint detection and response, monitoring devices for threats).

Deploy software updates via controlled deployment tools after testing in pre-production setups.

Example audit questions

"How do you prevent unauthorized software installation on operational systems?"

"Show software installation restriction policies, application whitelisting rules, and change deployment tickets."

Examples of audit evidence

Policy: Software Installation & Application Whitelisting Policy.

Technical Control: AppLocker / Software Restriction Policy configuration screenshots.

Change Tickets: CAB (change advisory board) tickets approving software updates deployed to production.

Illustrative response: "Standard users lack administrative rights to install software on endpoints, reinforced by AppLocker application whitelisting rules. Production server software updates require formal change ticket approval following staging tests."

Control 8.20: Network Security

Implementation examples

Design, secure, and manage network infrastructure (switches, routers, firewalls, VPNs (virtual private networks)) systematically.

Apply hardening standards to network hardware and separate network management traffic onto isolated VLANs (virtual local area networks).

Encrypt network communications passing across wireless, public, or untrusted networks (IPsec, TLS (Transport Layer Security, which protects data in transit)).

Example audit questions

"How are network devices secured, managed, and monitored to safeguard data in transit?"

"Show network architecture diagrams, firewall rulesets, and network device hardening baselines."

Examples of audit evidence

Architecture: Comprehensive Network Architecture & Topology Diagrams.

Hardening Rules: Network Device Hardening Baseline Standards.

Configs: Firewall rulesets, switch VLAN (virtual local area network) configurations, and encrypted management interface logs.

Illustrative response: "Network security is enforced using hardened firewalls, routers, and switches configured per CIS (Center for Internet Security) baselines. Network management traffic is restricted to an out-of-band management VLAN (virtual local area network) accessible only via encrypted VPN (virtual private network, an encrypted network connection)."

Control 8.21: Security of Network Services

Implementation examples

Establish explicit security requirements, service levels (SLAs), and monitoring for all network services.

Incorporate encryption, firewalling, intrusion prevention, and access controls into network service contracts.

Review third-party network provider performance, security attestations, and audit logs regularly.

Example audit questions

"How do you define, monitor, and verify security requirements for internal and external network services?"

"Show network service contracts, provider SLAs (service level agreements), IDS (intrusion detection system)/IPS (intrusion prevention system) deployment records, and network monitoring reports."

Examples of audit evidence

Contracts & SLAs (service level agreements): Network Provider Contracts incorporating security requirements and SLAs (service level agreements).

Service Logs: IDS (intrusion detection system)/IPS (intrusion prevention system) configuration logs, network performance monitoring reports.

Attestations: Third-party SOC 2 (System and Organization Controls 2) reports and ISO/IEC 27001 certificates from network service providers.

Illustrative response: "Network service providers are bound by strict SLAs (service level agreements) defining security, uptime, and encryption standards. We monitor service performance via automated netflow tools and verify compliance through annual SOC 2 (System and Organization Controls 2) reviews."

Control 8.22: Segregation of Networks

Implementation examples

Segregate network infrastructure into distinct security zones (DMZ, Server VLAN (virtual local area network), Corporate, Guest Wi-Fi).

Control traffic crossing zone perimeters using firewalls, security groups, and micro-segmentation.

Isolate guest wireless networks completely from internal corporate resources and systems.

Example audit questions

"How are networks segregated into separate security domains based on risk and trust levels?"

"Show network segmentation diagrams, VLAN (virtual local area network) configurations, and firewall zone rule matrices."

Examples of audit evidence

Diagrams: Network Segmentation Topology Maps (showing DMZs (demilitarized zones, separate network areas for public-facing services), VLANs (virtual local area networks), and cloud VPC (virtual private cloud) subnets).

Firewall Rules: Firewall rule exports proving restricted traffic flows between segregated zones.

Wireless Config: Guest Wi-Fi isolation settings routing guest traffic directly to external gateways.

Illustrative response: "Networks are segregated into isolated VLANs (virtual local area networks) and cloud subnets based on trust boundaries. Firewalls and security groups enforce strict access rules between zones, while guest Wi-Fi is physically segregated from corporate systems."

Control 8.23: Web Filtering

Implementation examples

Restrict employee access to unauthorized, malicious, or inappropriate web categories.

Deploy web filtering systems (SWG, DNS (Domain Name System, which maps domain names to network addresses) filtering) using dynamic threat intelligence blocklists.

Block access to known phishing domains, C2 (command and control) servers, malware hosts, and unapproved cloud storage sites.

Example audit questions

"How do you restrict access to malicious or unapproved websites across endpoints and networks?"

"Show web filtering configuration dashboards, blocked category lists, and web filtering audit logs."

Examples of audit evidence

Policy: Web Filtering & Internet Usage Policy.

Config Screenshots: Secure Web Gateway (SWG) / DNS (Domain Name System, which maps domain names to network addresses) filter (e.g., Cisco Umbrella) category block rules.

Logs: Web filtering event logs showing blocked connection attempts to malicious domains.

Illustrative response: "Web traffic is filtered via DNS (Domain Name System, which maps domain names to network addresses) security tools that block access to known malicious domains, phishing sites, and unapproved file-sharing services, backed by dynamic threat feeds updated continuously."

Control 8.24: Use of Cryptography

Implementation examples

Establish a Cryptography Policy defining approved algorithms, key lengths, and cipher suites (e.g., AES-256, TLS (Transport Layer Security, which protects data in transit) 1.3).

Protect data at rest (full-disk, database encryption) and data in transit (TLS/IPsec encryption).

Manage cryptographic keys securely across generation, distribution, storage, rotation, and revocation lifecycles.

Example audit questions

"What policy governs cryptographic controls, and how are cryptographic keys managed throughout their lifecycle?"

"Show your Cryptography Policy, Key Management SOP (standard operating procedure), and system encryption configuration exports."

Examples of audit evidence

Policy: Policy on Cryptography & Key Management Standard.

Key Logs: Key Management Service (KMS) access control lists and automated key rotation logs.

Cipher Configs: Web server TLS (Transport Layer Security, which protects data in transit) configuration exports proving fallback blocking of legacy ciphers (TLS 1.0/1.1).

Illustrative response: "Cryptography follows our formal Cryptography Policy, enforcing AES-256 for data at rest and TLS (Transport Layer Security, which protects data in transit) 1.3 for data in transit. Keys are managed via cloud KMS (key management service) with automated annual rotation and strict access controls."

Control 8.25: Secure Development Life Cycle (SDLC)

Implementation examples

Embed security checkpoints, threat modeling, and testing across all phases of the software development lifecycle.

Establish secure coding standards tailored to programming languages used across development teams.

Separate development, testing, and production environments strictly; require code reviews prior to release.

Example audit questions

"How is security integrated into your software development lifecycle from design through deployment?"

"Show your Secure SDLC (software development life cycle) Policy, threat modeling records, and release gate sign-off logs."

Examples of audit evidence

Policy: Secure SDLC (software development life cycle) Policy & Developer Security Guidelines.

Artifacts: Completed Threat Modeling Worksheets and Security Gate Review Checklists for recent releases.

Training: Developer secure code training completion logs (OWASP Top 10).

Illustrative response: "Our Secure SDLC (software development life cycle) incorporates threat modeling during design, secure coding guidelines during build phases, automated static analysis scanning, and mandatory CISO (chief information security officer) gate sign-offs prior to production releases."

Control 8.26: Application Security Requirements

Implementation examples

Identify application security requirements derived from formal risk assessments and privacy requirements.

Incorporate core controls: input validation, secure session handling, transaction logging, and encryption.

Embed payment, non-repudiation, and fraud prevention controls into transactional and e-commerce applications.

Example audit questions

"How are application security requirements identified, documented, and validated during development?"

"Show security requirement specifications and risk assessment outputs for a recently developed application."

Examples of audit evidence

Requirements Doc: Application Security Requirement Specifications (SRS) document.

Risk Assessments: Completed Application Risk Assessment Reports.

Validation: System acceptance test results verifying security functional requirements.

Illustrative response: "Application security requirements are defined during project scoping based on application risk assessments. Functional requirements, including input sanitization and session encryption, are validated during acceptance testing."

Control 8.27: Secure System Architecture & Engineering Principles

Implementation examples

Establish and document secure system engineering principles across all architectural tiers.

Apply core concepts: Defense-in-Depth, Zero Trust, Least Privilege, Fail-Secure, and Attack Surface Minimization.

Conduct architectural security design reviews for new systems and enforce standards across outsourced partners.

Example audit questions

"What secure architecture and engineering principles govern your system designs?"

"Show documented engineering principles and architecture design review records for core systems."

Examples of audit evidence

Principles: Secure Engineering Principles & Architectural Design Guidelines.

Design Reviews: Architectural Security Review Minutes and System Design Documents (SDD).

Outsource Terms: Development vendor contracts mandating architectural security compliance.

Illustrative response: "System architectures are engineered using Zero Trust and Defense-in-Depth principles. New system designs undergo formal security architectural reviews to validate control layers before implementation."

Control 8.28: Secure Coding

Implementation examples

Establish baseline secure coding standards prohibiting common flaws (OWASP Top 10, SANS Top 25).

Utilize Static Application Security Testing (SAST) and peer code reviews to catch vulnerabilities early.

Inventory third-party components and libraries, patching vulnerable open-source dependencies routinely.

Example audit questions

"How do you enforce secure coding practices and manage third-party software component vulnerabilities?"

"Show Secure Coding Guidelines, SAST (static application security testing, checking code without running it) scan reports, and Software Composition Analysis (SCA) dependency logs."

Examples of audit evidence

Guidelines: Language-Specific Secure Coding Standards.

Scan Outputs: SAST (static application security testing, checking code without running it) tool (SonarQube/Checkmarx) scan logs and SCA (Snyk/Dependabot) dependency vulnerability reports.

Review Records: Pull request code review sign-off logs.

Illustrative response: "Developers adhere to OWASP (Open Worldwide Application Security Project)-aligned secure coding standards. Code changes undergo static analysis scanning (SAST) and peer code review, while dependency scanners (SCA) automatically check third-party libraries for vulnerabilities."

Control 8.29: Security Testing in Development & Acceptance

Implementation examples

Conduct security testing, including SAST (static application security testing, checking code without running it), DAST (dynamic application security testing, testing a running application), dependency scanning, and penetration testing, throughout development.

Define explicit acceptance criteria validating that all identified critical/high security bugs are resolved.

Perform acceptance testing in dedicated staging setups that closely mirror production environments.

Example audit questions

"What security testing is performed prior to deploying code to production, and how are flaws remediated?"

"Show security test plans, DAST (dynamic application security testing, testing a running application)/SAST (static application security testing, checking code without running it) execution reports, and pre-deployment bug sign-off records."

Examples of audit evidence

Plan: Security Testing Strategy & Acceptance Criteria Procedure.

Test Results: Dynamic Application Security Testing (DAST) reports and penetration test remediation validation logs.

Sign-offs: Production Release Sign-off Tickets confirming 0 open critical/high vulnerabilities.

Illustrative response: "Before release, applications undergo SAST (static application security testing, checking code without running it), DAST (dynamic application security testing, testing a running application), and staging vulnerability scans. Acceptance rules prohibit releasing code with open high or critical vulnerabilities, requiring formal security re-testing and approval."

Control 8.30: Outsourced Development

Implementation examples

Incorporate explicit secure design, coding, testing, and IP (intellectual property) ownership terms into external developer contracts.

Monitor outsourced development activities through regular code reviews, security scans, and status meetings.

Conduct mandatory independent acceptance testing and vulnerability assessments before accepting code deliverables.

Example audit questions

"How do you govern outsourced development to ensure third parties comply with your security standards?"

"Show vendor development contracts, code review reports for outsourced code, and acceptance test records."

Examples of audit evidence

Contracts: Third-Party Development Contracts containing mandatory Secure SDLC (software development life cycle) addendums.

Audit Reports: Independent code review and vulnerability assessment reports for vendor deliverables.

Acceptance Logs: Formal Acceptance Testing Sign-off certificates.

Illustrative response: "Outsourced developers are bound by contract to our Secure SDLC (software development life cycle) guidelines. Deliverables undergo mandatory SAST (static application security testing, checking code without running it)/DAST (dynamic application security testing, testing a running application) security scanning and internal acceptance testing before code integration."

Control 8.31: Separation of Development, Test & Production Environments

Implementation examples

Isolate Development, Testing, and Production environments on separate logical or physical infrastructure.

Restrict production access to authorized deployment roles; keep development tools off production servers.

Prevent sensitive production data from being copied into lower development or testing environments.

Example audit questions

"How do you maintain strict separation between development, test, and production environments?"

"Show environment architecture diagrams, access permission matrices across environments, and data masking rules."

Examples of audit evidence

Architecture: Environment Segregation Topology Map (showing separate VPCs (virtual private clouds)/Subscriptions).

Access Control: IAM (identity and access management) access control lists proving developers lack direct production access.

Data Rules: Environment Data Policy prohibiting live production data in non-production environments.

Illustrative response: "Dev, Test, and Production environments are hosted in separate isolated cloud VPCs (virtual private clouds). Developers are restricted from production access, and deployment pipelines automate releases through strict approval gates."

Control 8.32: Change Management

Implementation examples

Enforce a formal change management workflow (Request, Risk Impact Assessment, Test, Approve, Deploy, Rollback).

Require Change Advisory Board (CAB) or authorized lead approval for all infrastructure and software changes.

Maintain detailed change audit logs and verify contingency rollback plans prior to executing changes.

Example audit questions

"What process governs operational changes to systems, and how are security impacts evaluated?"

"Show Change Management Procedures, recent CAB (change advisory board) meeting minutes, and approved change request tickets."

Examples of audit evidence

Policy: Change Management Policy & Standard Operating Procedure.

Tickets: Sample completed Change Request Tickets (showing risk assessment, test results, approval, and rollback plan).

CAB (change advisory board) Minutes: Signed Change Advisory Board (CAB) review meeting minutes.

Illustrative response: "System changes follow our Change Management Policy. Changes require documented risk evaluations, peer-reviewed test results, rollback plans, and formal CAB (change advisory board) approval before deployment into production."

Control 8.33: Test Information

Implementation examples

Utilize synthetic or anonymized test data whenever possible for system development and testing.

Obtain explicit management authorization if production data copies are required for testing setups.

Apply masking, encryption, access controls, and immediate purge workflows to production data in test setups.

Example audit questions

"How do you protect sensitive data when conducting system testing, and how is test data managed?"

"Show Test Data Handling Procedures, production data copy approval tickets, and test data sanitization logs."

Examples of audit evidence

Policy: Test Data Management & Protection Standard.

Approvals: Data Owner sign-off logs authorizing temporary production data usage for testing.

Sanitization Logs: Data scrubbing execution scripts and post-testing test environment deletion logs.

Illustrative response: "Testing uses synthetic data by default. If production data is strictly required, formal data owner approval is mandated, sensitive fields are masked via automated scripts, and data is deleted upon test completion."

Control 8.34: Protection of Information Systems During Audit Testing

Implementation examples

Plan, schedule, and gain formal management approval for operational audit testing (pen-tests, vulnerability scans).

Limit audit test access to read-only rights whenever possible; schedule tests during low-impact operational hours.

Monitor audit testing activities continuously to prevent inadvertent operational disruptions.

Example audit questions

"How do you ensure audit testing and vulnerability assessments do not disrupt operational production systems?"

Are audit tests pre-approved, and how are they conducted?

Examples of audit evidence

Documented agreements for cloud service audit testing, management approvals for test schedules, and access logs verifying tests were conducted according to agreed scopes and constraints.

Illustrative response: A tests are pre-approved by management. Scope, timing, and read-only access are planned to prevent disruption, while execution logs provide compliance evidence.