A.5.29 Audit Checklist

When to use this

Use this during internal audits to test whether A.5.29 Information Security During Disruption is designed, implemented, operating, and evidenced.

Audit checklist

• Documented information security continuity objectives are approved by management.
• Business impact analysis includes security requirements, not only recovery timing.
• Continuity and disaster recovery plans include access control, communications, supplier, data protection, and emergency change controls.
• Security and continuity specialists both contributed to plan design or review.
• Continuity exercises include information security scenarios and responsibilities.
• Supplier continuity arrangements are reviewed for security adequacy.

Evidence requested

• Procedure or plan reviewed.
• Business owner interviewed.
• IT or continuity owner interviewed.
• Sample test or event record reviewed.
• Evidence location recorded.
• Gaps converted into findings or corrective actions.

Related notes

• A.5.29 Information Security During Disruption
• A.5.29 Audit Evidence Pack