Audit Readiness

Your contact details *

First Name

Last Name

Do you have your own licensed copy of the ISO 27001:2022 standard? *

Yes

No

Does the organisation have the following:

- Organisational Chart - Description of job roles and descriptions - Description of information security roles and responsibilities - Diagram of core, support and business processes which has been integrated into the ISMS

Yes

No

Have you made a SWOT analysis taking into account information security? Are the internal and external issues made known and documented?

Yes

No

Do you have an established Statement of Applicability (SOA) according to ISO 27001:2022?

Yes

No

Do you have a risk assessment process or policy?

Yes

No

Do you have an established Risk Register that addresses all risks that are identified?

Yes

No

Have actions to address risks and opportunities been planned, and integrated into the ISMS processes, and are they evaluated for effectiveness?

Yes

No

Have measurable ISMS objectives and targets been established, documented, monitored and communicated throughout the organization?

Yes

No

Have you completed the internal audit programme? Do you have an internal audit programme in place?

Yes

No

Planned

Is there documented evidence retained to demonstrate that processes and policies have been carried out as planned?

Yes

No

Are changes planned and controlled, and unintended changes reviewed to mitigate any adverse results? Is there change management process?

Yes

No

Do you have a business continuity and disaster recovery plan? Has there been a documented test made which includes RPO and RTO?

Yes

No

Have outsourced processes been determined and are they controlled? Are the outsourced processes assessed?

Yes

No

Has the information security risk treatment plan been implemented and documented information retained?

Yes

No

Are appropriate contacts with authorities and special interest groups maintained?

Yes

No

Is there a policy, procedure or process for information security addressed in project management?

Yes

No

Is there a remote working policy or procedure in place?

Yes

No

Do you have an incident response plan? Has there been a documented test made?

Yes

No

Is there a policy or guideline in place for assessing cloud providers?

Yes

No

Are human resources (employees, contractors) subject to screening before they join the organization?

Yes

No

Do they have terms and conditions of employment defining information security responsibilities?

Yes

No

Do they have terms and conditions of employment defining information security responsibilities?

Yes

No

Are employees provided with security awareness, education and training and is this tracked?

Yes

No

Is there a disciplinary process for information security violations?

Yes

No

Is there a secure off-boarding process or procedures for employees/contractors? Is there a lifecycle management process for employee accounts?

Yes

No

Is there an asset register? This should contain the list of assets, asset owners, business processes, protection requirements.

Yes

No

Is there an acceptable use policy, or guidelines defined?

Yes

No

Is there a procedure or process for the return, destruction or disposal of assets?

Yes

No

Is there an Information Classification Policy implemented? Does the policy include protection of data leaks? Handling of media? Metadata requirements?

Yes

No

Are there procedures for transit of media containing information?

Yes

No

Is there a secure on-boarding procedure in place?

Yes

No

Are privileged access rights restricted and controlled? Is there a documented review in place?

Yes

No

Is there an access control policy in place? Are there documented procedures in place to enforce this?

Yes

No

Is there a password guideline or procedure in place?

Yes

No

Is there a secure development life (or system security) cycle policy or procedure in place? If there is no code or software development in place, this would be in the form of a system security policy

Yes

No

Is there a policy for the use of cryptography? Including key management?

Yes

No

Is there a physical security police in place and implemented?

Yes

No

Do you have a third party (supplier, vendor) policy in place and implemented? Is there a vendor register or documented evidence?

Yes

No

By filling in this form, you agree to be contacted by an authorized representative of Superuser for follow up to the questionnaire. Your questionnaire answers will only be used as part of the internal client onboarding process-matching and will not be used for information filled in for other parties, such as auditing bodies. *

I Agree