When to use this
Practical use
Use this as a working artifact. Fill it with real owners, dates, decisions, evidence locations, and review status.
Use this during internal audits to test whether A.5.26 Response to Information Security Incidents is designed, implemented, operating, and evidenced.
Audit checklist
- Incident records map to documented procedure steps.
- Roles and responsibilities are visible in the response record.
- Containment, eradication, recovery, communication, and closure decisions are timestamped.
- Evidence collection decisions are made early and recorded.
- Management approval is present for high-impact decisions.
Evidence requested
- Procedure or guidance reviewed.
- Sample records selected.
- Owner interviewed.
- Evidence location recorded.
- Gaps converted into findings or corrective actions.
Related notes
- Iso27001
- ISO27002
- Template
- Audit
- A5 26
Note Metadata
Aliases: A.5.26 Checklist
Source: 90 Templates/A.5.26 Audit Checklist.md
Graph-sourced resources
Templates and evidence
Auditor evidence packs
Evidence collections and audit-facing verification material.