ISO 27001 CHECKLIST

TEMPLATE
ISO 27001 IMPLEMENTATION PHASES TASKS
IN
NOTES
COMPLIANC
CONTROL
E?
5 Information Security Policies

5.1 Management direction for information security

Security Policies exist?

All policies approved

5.1.1 Policies for information security
by management?

Evidence of compliance?

6 Organization of information security

6.1 information security roles and responsibilities

6.1.1 Security roles and responsibilities Roles and responsibilities

defined?

6.1.2 Segregation of duties Segregation of duties defined?

Verification body /
6.1.3 Contact with authorities authority contacted for
compliance verification?

Establish contact with

Contact with special
6.1.4 special interest groups
interest groups
regarding compliance?

Information security in Evidence of information security

6.1.5
project in project management?
management
6.2 Mobile devices and teleworking

6.2.1 Mobile device policy Defined policy for mobile devices?

Defined policy for

6.2.2 Teleworking
working
remotely?
7 Human resource security

7.1 Prior to employment

Defined policy for screening

7.1.1 Screening
employees prior to
employment?

Terms and conditions Defined policy for HR terms

7.1.2
of employment and conditions of
employment?
7.2 During employment

Defined policy for

7.2.1 Management responsibilities
management
responsibilities?
Defined policy for
Information security
7.2.2 information security
awareness, education,
awareness, education, and
and training
training?
Defined policy for
7.2.3 Disciplinary process disciplinary process
regarding
information
security?
7.3 Termination and change of employment

Defined policy for HR

Termination or change of
7.3.1 termination or change-of-
employment
employment policy regarding
responsibilities
information security?
8 Asset management

8.1 Responsibilities for assets

8.1.1 Inventory of assets Complete inventory list of

assets?

8.1.2 Ownership of assets Complete ownership list of

assets

Defined "acceptable use" of

8.1.3 Acceptable use of assets
assets policy

8.1.4 Return of assets Defined return of assets policy?

8.2 Information classification

Defined policy for

8.2.1 Classification of information
classification of
information?

Defined policy for

8.2.2 Labeling of information
labeling
information?

Defined policy for

8.2.3 Handling of assets
handling of
assets?
8.3 Media handling

Management of removable Defined policy for

8.3.1
media management of
removable media?

Defined policy for

8.3.2 Disposal of media
disposal of
media?

Defined policy for

8.3.3. Physical media transfer
physical media
transfer?
9 Access control

9.1 Responsibilities for assets

Defined policy for

9.1.1 Access policy control
access control
policy?

Access to networks Defined policy for access to

9.1.2
and network networks and network
services services?
9.2 Responsibilities for assets

User registration and Defined policy for user asset

9.2.1
de- registration registration and de-
registration?

Defined policy for user

9.2.2 User access provisioning
access
provisioning?

Management of Defined policy for

9.2.3
privileged access management of privileged
rights access rights?
 Defined policy for
Management of secret
9.2.4 management of secret
authentication information of
authentication information of
users
users?

Defined policy for review of

9.2.5 Review of user access rights
user access rights?

Removal or Defined policy for removal

9.2.6
adjustment of or adjustment of access
access rights rights?
9.3 User responsibilities

Use of secret Defined policy for use of

9.3.1
authentication secret authentication
information information?
9.4 System and application access control

Defined policy for

9.4.1 Information access restrictions
information access
restrictions?

Defined policy for secure log-

9.4.2 Secure log-on procedures
in procedures?

Defined policy for

9.4.3 Password management system
password management
systems?

Defined policy for use of

9.4.4 Use of privileged utility
privileged utility
programs
programs?

Access control to program Defined policy for access

9.4.5
source code control to program source
code?
10 Cryptography

10.1 Cryptographic controls

Policy on the use of Defined policy for use

10.1.1
cryptographic of cryptographic
controls controls?

Defined policy for

10.1.2 Key management
key
management?
11 Physical and environmental security

11.1 Secure areas

Defined policy for physical

11.1.1 Physical security perimeter
security perimeter?

Defined policy for physical

11.1.2 Physical entry controls
entry controls?

Securing offices, rooms Defined policy for securing

11.1.3
and facilities offices, rooms and
facilities?
Defined policy for
Protection against external
11.1.4 protection against external
and environmental
and environmental
threats
threats?

Defined policy for working

11.1.5 Working in secure areas
in secure areas?

Defined policy for delivery

11.1.6 Delivery and loading areas
and loading areas?
11.2 Equipment

Defined policy for equipment

11.2.1 Equipment siting and protection
siting and protection?

Defined policy for

11.2.2 Supporting utilities
supporting
utilities?

Defined policy for

11.2.3 Cabling security
cabling
security?

Defined policy for

11.2.4 Equipment maintenance
equipment
maintenance?

Defined policy for removal

11.2.5 Removal of assets
of assets?

Defined policy for security

Security of equipment and
11.2.6 of equipment and assets
assets off-premises
off- premises?

Secure disposal or re-use Secure disposal or re-use

11.2.7
of equipment of equipment?

Defined policy for unattended

11.2.8 Unattended user equipment
user equipment?

Defined policy for clear desk

11.2.9 Clear desk and clear screen policy
and clear screen policy?

12 Operations security

12.1 Operational procedures and responsibilities

Documented operating Defined policy for

12.1.1
procedures documented operating
procedures?

Defined policy for change

12.1.2 Change management
management?

Defined policy for

12.1.3 Capacity management
capacity
management?
Separation of Defined policy for separation
12.1.4 development, testing and of development, testing and
operational environments operational environments?

12.2 Protection from malware

Defined policy for controls

12.2.1 Controls against malware
against malware?

12.3 System Backup

Defined policy for backing

12.3.1 Backup
up systems?

Defined policy for

12.3.2 Information Backup
information
backup?
12.4 Logging and Monitoring

12.4.1 Event logging Defined policy for event logging?

 Defined policy for protection
12.4.2 Protection of log information
of log information?

Defined policy for

12.4.3 Administrator and operator log
administrator and
operator log?

Defined policy for

12.4.4 Clock synchronization
clock
synchronization?
12.5 Control of operational software

Installation of software Defined policy for installation

12.5.1
on operational of software on operational
systems systems?
12.6 Technical vulnerability management

Management of technical Defined policy for management

12.6.1
vulnerabilities of technical vulnerabilities?

Defined policy for restriction

12.6.2 Restriction on software
on software
installation
installation?
12.7 Information systems audit considerations

Defined policy for

12.7.1 Information system audit control
information system
audit control?
13 Communications security

13.1 Network security management

Defined policy for

13.1.1 Network controls
network
controls?

Defined policy for security

13.1.2 Security of network services
of network services?

Defined policy for segregation

13.1.3 Segregation in networks
in networks?

13.2 Information transfer

Information transfer policies Defined policy for information

13.2.1
and procedures transfer policies and
procedures?

Agreements on Defined policy for agreements

13.2.2
information on information transfer?
transfer

Defined policy for

13.2.3 Electronic messaging
electronic
messaging?

Confidentiality or non- Defined policy for

13.2.4
disclosure confidentiality or non-
agreements disclosure agreements?
Defined policy for system
System acquisition,
13.2.5 acquisition, development
development and
and maintenance?
maintenance
14 System acquisition, development and maintenance

14.1 Security requirements of information systems

Defined policy for information

Information security
14.1.1 security requirements analysis
requirements analysis and
and specification?
specification
 Defined policy for securing
Securing application services
14.1.2 application services on
on public networks
public networks?

Protecting application Defined policy for protecting

14.1.3
service application service
transactions transactions?
14.2 Security in development and support processes

Defined policy for in-

14.2.1 In-house development
house
development?
15 Suppliers relationships

Defined policy for

15.1.1 Suppliers relationships
supplier
relationships?
16 Information security incident management

Defined policy for

16.1.1 Information security management
information security
management?
17 Information security aspects of business continuity management

17.1 Information security continuity

Defined policy for

17.1.1 Information security continuity
information security
continuity?
17.2 Redundancies

17.2.1 Redundancies Defined policy for redundancies?

18 Compliance

18.1 Compliance with legal and contractual requirements

Identification of applicable Defined policy for identification

18.1.1 legislation and of applicable legislation and
contractual requirement contractual requirement?

Defined policy for

18.1.2 Intellectual property rights
intellectual property
rights?

Defined policy for protection

18.1.3 Protection of records
of records?

Defined policy for privacy

Privacy and protection of
18.1.4 and protection of
personally identifiable
personally identifiable
information
information?

Regulation of Defined policy for regulation

18.1.5
cryptographic of cryptographic control?
control
18.1 Independent review of information security

Defined policy for

Compliance with security
18.1.1 compliance with security
policies and
policies and standards?
standards

Defined policy for

18.1.2 Technical compliance review
technical compliance
review?
 DISCLAIMER

Any articles, templates, or information provided by Smartsheet on the website are for
reference only. While we strive to keep the information up to date and correct, we make
no representations or warranties of any kind, express or implied, about the
completeness, accuracy, reliability, suitability, or availability with respect to the website
or the information, articles, templates, or related graphics contained on the website. Any
reliance you place on such information is therefore strictly at your own risk.

This template is provided as a sample only. This template is in no way meant as legal
or compliance advice. Users of the template must determine what information is
necessary and needed to accomplish their objectives.