A.5.6 Audit Checklist

When to use this

Use this during internal audits to verify that the organization maintains relevant external security knowledge contacts and uses received information appropriately.

Checklist

• Relevant groups, forums, associations, or advisory sources are identified.
• Participation is proportionate to organization size, sector, and risk.
• Owners are assigned for each group or source.
• Participation or monitoring records exist.
• Confidentiality and disclosure rules are documented.
• Useful information is shared internally.
• External information influences risk assessment, controls, awareness, or management reporting where relevant.
• Membership or participation value is reviewed periodically.
• Personnel can explain what they receive and how it is used.

Related notes

• A.5.6 Contact with Special Interest Groups
• A.5.6 Audit Evidence Pack
• Special Interest Group Participation Register