A.5.24 Audit Checklist

When to use this

Use this during internal audits to verify that incident management planning and preparation are defined, communicated, and ready to operate.

Checklist

• Incident management process exists.
• Incident roles and responsibilities are defined.
• Reporting channels are communicated.
• Event and weakness reporting is covered.
• Triage and classification criteria are defined.
• Escalation criteria are defined.
• Investigation and recovery processes are defined.
• Communication responsibilities are defined.
• Evidence preservation expectations are defined.
• Incident exercises or tabletop tests are performed.
• Incident register exists.
• Lessons learned are captured.
• Corrective actions are tracked.
• Supplier/cloud incidents are integrated where relevant.

Related notes

• A.5.24 Information Security Incident Management Planning and Preparation
• A.5.24 Audit Evidence Pack
• Incident Management Plan
• Incident Roles and Communications Matrix