A.5.27 Audit Checklist

When to use this

Use this during internal audits to test whether A.5.27 Learning from Information Security Incidents is designed, implemented, operating, and evidenced.

Audit checklist

• Post-incident review records identify root causes and control failures.
• Corrective actions are tracked to closure with evidence.
• Lessons update procedures, controls, risk assessments, training, or supplier controls.
• Anonymized examples are used in awareness where appropriate.
• Incident trends are reported to management review.

Evidence requested

• Procedure or guidance reviewed.
• Sample records selected.
• Owner interviewed.
• Evidence location recorded.
• Gaps converted into findings or corrective actions.

Related notes

• A.5.27 Learning from Information Security Incidents
• A.5.27 Audit Evidence Pack