A.5.25 Audit Checklist

When to use this

Use this during internal audits to test whether A.5.25 Assessment and Decision on Information Security Events is designed, implemented, operating, and evidenced.

Audit checklist

• Event records show receipt time, triage time, assessor, impact assessment, category, decision, and justification.
• Classification criteria are documented and available to points of contact.
• Major events are confirmed by the incident response role or team.
• Triage targets align with breach notification and contractual timescales.
• Changes to categorization guidance are communicated to points of contact.

Evidence requested

• Procedure or guidance reviewed.
• Sample records selected.
• Owner interviewed.
• Evidence location recorded.
• Gaps converted into findings or corrective actions.

Related notes

• A.5.25 Assessment and Decision on Information Security Events
• A.5.25 Audit Evidence Pack