A.5.1 Audit Evidence Pack
The auditor wants to confirm that information security policies are defined, approved, published, communicated, acknowledged, controlled, and reviewed.
Templates & evidence
ISO27002 domain with 118 resources grouped for implementation and audit work.
Domain guide
What this domain covers
Templates, evidence packs, and proof patterns that support ISO 27002-aligned control implementation.
118 resources
Guide + resources
Grouped resources
Evidence packs
Audit evidence packs, registers, proof records, and evidence examples.
A.5.10 Audit Evidence Pack
The auditor wants to confirm that acceptable use rules and information handling procedures are defined, communicated, acknowledged, implemented, and enforced for relevant users...
A.5.11 Audit Evidence Pack
The auditor wants to confirm that employees, contractors, third-party users, and other relevant parties return organizational assets when employment, contract, agreement, or rol...
A.5.12 Audit Evidence Pack
The auditor wants to confirm that the organization has a clear, usable classification scheme and that information is classified according to confidentiality, integrity, availabi...
A.5.13 Audit Evidence Pack
The auditor wants to confirm that labelling procedures exist, align with the classification scheme, and are implemented across relevant physical and digital forms of information.
A.5.14 Audit Evidence Pack
The auditor wants to confirm that the organization has documented and implemented rules, procedures, or agreements for transferring information internally and externally across...
A.5.15 Audit Evidence Pack
The auditor wants to confirm that physical and logical access rules are defined, implemented, approved, reviewed, and based on business and information security requirements.
A.5.16 Audit Evidence Pack
The auditor wants to confirm that identities are uniquely registered where possible and managed through the full lifecycle: creation, authorization, change, review, disabling, d...
A.5.17 Audit Evidence Pack
The auditor wants to confirm that secret authentication information is issued, managed, changed, reset, stored, and handled through a controlled process, and that users understa...
A.5.18 Audit Evidence Pack
The auditor wants to confirm that access rights are formally provisioned, reviewed, modified, and removed according to access control rules.
A.5.19 Audit Evidence Pack
The auditor wants to confirm that supplier information security risks are identified, assessed, controlled, contractually addressed, and reviewed.
A.5.2 Audit Evidence Pack
The auditor wants to confirm that information security roles and responsibilities are defined, allocated, documented, communicated, understood, accepted, current, and applied to...
A.5.20 Audit Evidence Pack
The auditor wants to confirm that supplier security requirements are established, agreed, authorized, and appropriate to the supplier relationship before access or information s...
A.5.21 Audit Evidence Pack
The auditor wants to confirm that ICT supply-chain risks are identified and managed, including inherited risks from subcontractors, cloud providers, support parties, hosting pro...
A.5.22 Audit Evidence Pack
The auditor wants to confirm that supplier security practices and service delivery are monitored, reviewed, evaluated, and changed through a controlled process.
A.5.23 Audit Evidence Pack
The auditor wants to confirm that cloud service acquisition, use, management, and exit are governed according to the organization's information security requirements.
A.5.24 Audit Evidence Pack
The auditor wants to confirm that incident management processes, roles, responsibilities, reporting routes, and preparation activities are defined, established, communicated, an...
A.5.25 Audit Evidence Pack
The auditor wants to confirm that reported security events are assessed using defined criteria and that the incident/non-incident decision is recorded with justification and tim...
A.5.26 Audit Evidence Pack
The auditor wants to confirm that confirmed information security incidents are responded to according to documented procedures and that response decisions, actions, responsibili...
A.5.27 Audit Evidence Pack
The auditor wants to confirm that knowledge from incidents is captured and used to improve controls, procedures, awareness, risk treatment, and the ISMS.
A.5.28 Audit Evidence Pack
The auditor wants to confirm that procedures exist and operate for identifying, collecting, acquiring, preserving, storing, and protecting evidence related to information securi...
A.5.29 Audit Evidence Pack
The auditor wants to confirm that information security is maintained at an appropriate level during disruption and that continuity plans include security objectives, roles, requ...
A.5.3 Audit Evidence Pack
The auditor wants to confirm that conflicting duties and responsibilities have been identified and segregated, or that compensating controls exist where segregation is not pract...
A.5.30 Audit Evidence Pack
The auditor wants to confirm that ICT readiness is planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements.
A.5.31 Audit Evidence Pack
The auditor wants to confirm that applicable legal, statutory, regulatory, and contractual information security requirements are identified, documented, owned, kept current, and...
A.5.32 Audit Evidence Pack
The auditor wants to confirm that procedures protect intellectual property rights and that software, content, source code, libraries, and AI-generated material are used within a...
A.5.33 Audit Evidence Pack
The auditor wants to confirm that required records are identified, retained, protected from loss/alteration/unauthorized access/release, reviewed, accessible through retention,...
A.5.34 Audit Evidence Pack
The auditor wants to confirm that privacy and PII requirements are identified, mapped, implemented, reviewed, and evidenced for all relevant PII holdings, roles, transfers, and...
A.5.35 Audit Evidence Pack
The auditor wants to confirm that the information security approach and implementation are independently reviewed at planned intervals and after significant changes, with findin...
A.5.36 Audit Evidence Pack
The auditor wants to confirm that compliance with information security policies, rules, and standards is regularly reviewed through management and technical checks, with finding...
A.5.37 Audit Evidence Pack
The auditor wants to confirm that operating procedures for information processing facilities are documented, controlled, current, available to personnel who need them, and used...
A.5.4 Audit Evidence Pack
The auditor wants to confirm that managers actively require personnel to apply information security according to policies and procedures.
A.5.5 Audit Evidence Pack
The auditor wants to confirm that the organization has identified relevant authorities, assigned authorized liaison roles, defined contact triggers, maintained accurate contact...
A.5.6 Audit Evidence Pack
The auditor wants to confirm that the organization maintains proportionate contact with relevant specialist security groups, forums, or professional associations and that useful...
A.5.7 Audit Evidence Pack
The auditor wants to confirm that threat information is collected, analyzed, validated, contextualized, and used to support risk assessment, risk treatment, control improvement,...
A.5.8 Audit Evidence Pack
The auditor wants to confirm that information security is integrated into the project management method and applied in real projects from initiation through transition to operat...
A.5.9 Audit Evidence Pack
The auditor wants to confirm that information and associated assets are identified, owned, classified, maintained, protected, and updated through change, project, procurement, a...
A.6.1 Audit Evidence Pack
The auditor wants evidence that background verification checks are defined, applied, documented, and protected as personal data.
A.6.2 Audit Evidence Pack
The auditor wants evidence that security responsibilities are defined, accepted, role-appropriate, current, and applicable to employees, contractors, and third-party users in sc...
A.6.3 Audit Evidence Pack
The auditor wants evidence that training is role-relevant, current, recorded, repeated where needed, and improved based on effectiveness feedback.
A.6.4 Audit Evidence Pack
The auditor wants evidence that the organization can respond fairly and consistently when personnel or relevant interested parties violate information security policy.
A.6.5 Audit Evidence Pack
The auditor wants proof that old access and assets are removed, relevant parties are notified, and continuing duties are communicated after termination or role change.
A.6.6 Audit Evidence Pack
The auditor wants evidence that agreements reflect actual confidentiality requirements and are legally usable where needed.
A.6.7 Audit Evidence Pack
The auditor wants evidence that information remains protected when accessed, processed, or stored outside organization premises.
A.6.8 Audit Evidence Pack
The auditor wants proof that reporting channels are known, usable, timely, and connected to event assessment and incident management.
A.7.1 Audit Evidence Pack
The auditor wants evidence that physical zones protect assets and information, not just a floorplan showing rooms.
A.7.10 Audit Evidence Pack
- Media handling follows classification. - Media is inventoried and labelled where appropriate. - Dispatches are authorized and recorded. - Sensitive media is protected during t...
A.7.11 Audit Evidence Pack
- Critical facilities have documented utility dependencies. - UPS/generator tests include load, runtime, cooling, and maintenance evidence. - Alarms detect utility failures and...
A.7.12 Audit Evidence Pack
- Cable routes are documented and protected. - Power/data segregation is implemented where needed. - Patch panels, cabinets, and connections are locked or access-controlled. - L...
A.7.13 Audit Evidence Pack
- Maintenance is scheduled and recorded. - Faults and repairs are tracked. - Maintainers are authorized and qualified. - External maintainers are escorted where required. - Conf...
A.7.14 Audit Evidence Pack
- Records identify asset, storage media, classification, method, verifier, and date. - Sanitization method matches media type and sensitivity. - Contractor records are asset-spe...
A.7.2 Audit Evidence Pack
The auditor wants evidence that only authorized people can enter secure areas and that visitor, badge, delivery, and loading controls operate in practice.
A.7.3 Audit Evidence Pack
- Controls are based on value, liability, importance, and classification. - Sensitive room purpose is not unnecessarily exposed. - Internal directories and access clues are prot...
A.7.4 Audit Evidence Pack
- Monitoring scope is documented and risk-based. - Alerts have owners, response times, and escalation paths. - Monitoring tests are performed and recorded. - Monitoring staff kn...
A.7.5 Audit Evidence Pack
- Hazard assessment includes site, room, utility, and neighbor risks. - Specialist advice exists for material hazards. - Controls are implemented and maintained. - Continuity ar...
A.7.6 Audit Evidence Pack
- Secure-area work is identified and risk-assessed. - Need-to-know, device, media, supervision, and dual-control rules are documented. - Employees, contractors, and third partie...
A.7.7 Audit Evidence Pack
- Rules cover papers, removable media, screens, printers, faxes, storage, and confidential waste. - Auto-lock settings are enforced. - Sensitive print/fax workflows are controll...
A.7.8 Audit Evidence Pack
- Equipment inventory includes location, owner, and protection requirement. - Siting assessment covers physical, environmental, viewing, access, and interference risks. - Networ...
A.7.9 Audit Evidence Pack
- Asset removal is authorized and logged. - Off-site assets are recorded with custodian, location, and review date. - Mobile devices are encrypted and managed. - Long-term loans...
Templates
Reusable implementation, audit, and operational templates.
A.5.10 Audit Checklist
Use this during internal audits to verify that acceptable use and handling rules are defined, acknowledged, implemented, and enforced.
A.5.11 Audit Checklist
Use this during internal audits to verify that assets are returned during termination, contract end, agreement end, or role change.
A.5.12 Audit Checklist
Use this during internal audits to verify that information classification is defined, implemented, understood, and maintained.
A.5.13 Audit Checklist
Use this during internal audits to verify that information labelling procedures are defined and implemented in line with the classification scheme.
A.5.14 Audit Checklist
Use this during internal audits to verify that information transfer rules, procedures, and agreements are defined and implemented across actual transfer channels.
A.5.15 Audit Checklist
Use this during internal audits to verify that physical and logical access controls are defined, implemented, approved, and reviewed.
A.5.16 Audit Checklist
Use this during internal audits to verify that identities are managed across the full lifecycle.
A.5.17 Audit Checklist
Use this during internal audits to verify that secret authentication information is allocated and managed through a controlled process.
A.5.18 Audit Checklist
Use this during internal audits to verify that access rights are provisioned, reviewed, modified, and removed according to access control rules.
A.5.19 Audit Checklist
Use this during internal audits to verify that supplier information security risks are identified, assessed, controlled, and reviewed.
A.5.20 Audit Checklist
Use this during internal audits to verify that supplier security requirements are formally agreed and appropriate to the supplier relationship.
A.5.21 Audit Checklist
Use this during internal audits to verify that ICT supply-chain dependencies and inherited security risks are identified and managed.
A.5.22 Audit Checklist
Use this during internal audits to verify that supplier services and security practices are monitored, reviewed, evaluated, and changed through a controlled process.
A.5.23 Audit Checklist
Use this during internal audits to verify that cloud services are acquired, used, managed, and exited according to information security requirements.
A.5.24 Audit Checklist
Use this during internal audits to verify that incident management planning and preparation are defined, communicated, and ready to operate.
A.5.25 Audit Checklist
Use this during internal audits to test whether A.5.25 Assessment and Decision on Information Security Events is designed, implemented, operating, and evidenced.
A.5.26 Audit Checklist
Use this during internal audits to test whether A.5.26 Response to Information Security Incidents is designed, implemented, operating, and evidenced.
A.5.27 Audit Checklist
Use this during internal audits to test whether A.5.27 Learning from Information Security Incidents is designed, implemented, operating, and evidenced.
A.5.28 Audit Checklist
Use this during internal audits to test whether A.5.28 Collection of Evidence is designed, implemented, operating, and evidenced.
A.5.29 Audit Checklist
Use this during internal audits to test whether A.5.29 Information Security During Disruption is designed, implemented, operating, and evidenced.
A.5.30 Audit Checklist
Use this during internal audits to test whether A.5.30 ICT Readiness for Business Continuity is designed, implemented, operating, and evidenced.
A.5.31 Audit Checklist
Use this during internal audits to test whether A.5.31 Legal, Statutory, Regulatory and Contractual Requirements is designed, implemented, operating, and evidenced.
A.5.32 Audit Checklist
Use this during internal audits to test whether A.5.32 Intellectual Property Rights is designed, implemented, operating, and evidenced.
A.5.33 Audit Checklist
Use this during internal audits to test whether A.5.33 Protection of Records is designed, implemented, operating, and evidenced.
A.5.34 Audit Checklist
Use this during internal audits to test whether A.5.34 Privacy and Protection of PII is designed, implemented, operating, and evidenced.
A.5.35 Audit Checklist
Use this during internal audits to test whether A.5.35 Independent Review of Information Security is designed, implemented, operating, and evidenced.
A.5.36 Audit Checklist
Use this during internal audits to test whether A.5.36 Compliance with Policies, Rules and Standards for Information Security is designed, implemented, operating, and evidenced.
A.5.37 Audit Checklist
Use this during internal audits to test whether A.5.37 Documented Operating Procedures is designed, implemented, operating, and evidenced.
A.5.5 Audit Checklist
Use this during internal audits to test whether relevant authority contacts are identified, maintained, authorized, and usable.
A.5.6 Audit Checklist
Use this during internal audits to verify that the organization maintains relevant external security knowledge contacts and uses received information appropriately.
A.5.7 Audit Checklist
Use this during internal audits to verify that threat information is collected, analyzed, contextualized, and used to support ISMS decisions.
A.5.8 Audit Checklist
Use this during internal audits to verify that information security is embedded in project governance and applied to sampled projects.
A.5.9 Audit Checklist
Use this during internal audits to verify that information and associated assets are inventoried, owned, maintained, and protected.
A.6.1 Audit Checklist
- Confirm the organization has a documented screening procedure. - Confirm screening applies to employees, contractors, temporary staff, and third-party users in ISMS scope. - C...
A.6.2 Audit Checklist
Use this checklist during an internal audit of employment, contractor, and third-party security responsibility terms.
A.6.3 Audit Checklist
Use this checklist during an internal audit of information security awareness, education, training, and update processes.
A.6.4 Audit Checklist
Use this checklist during an internal audit of disciplinary handling for information security policy violations.
A.6.5 Audit Checklist
Use this checklist during an internal audit of leaver, mover, contractor offboarding, and continuing responsibility controls.
A.6.6 Audit Checklist
Use this checklist during an internal audit of confidentiality and non-disclosure agreement controls.
A.6.7 Audit Checklist
- Confirm remote working policy and procedures exist. - Confirm authorized remote workers, locations, activities, data, and controls are recorded. - Check remote working risk as...
A.6.8 Audit Checklist
Use this checklist during an internal audit of information security event reporting.
A.7.1 Audit Checklist
- Confirm physical security perimeters are defined. - Confirm zones are linked to information/assets and risk. - Review perimeter diagrams or zone register. - Walk the perimeter...
A.7.10 Audit Checklist
Use this checklist during an internal audit of storage media acquisition, use, transport, storage, disposal, destruction, and damaged-media handling.
A.7.11 Audit Checklist
Use this checklist during an internal audit of power, cooling, telecommunications, water, emergency lighting, fire protection, and building-management utility resilience.
A.7.12 Audit Checklist
Use this checklist during an internal audit of power, data, telecommunications, and supporting service cabling.
A.7.13 Audit Checklist
Use this checklist during an internal audit of equipment maintenance and repair controls.
A.7.14 Audit Checklist
Use this checklist during an internal audit of equipment disposal, reuse, sale, donation, recycling, or repair dispatch.
A.7.2 Audit Checklist
- Confirm secure areas are identified. - Confirm entry controls match risk and sensitivity. - Review physical access authorization and logs. - Check physical access review recor...
A.7.3 Audit Checklist
Use this checklist during an internal audit of physical security design for offices, rooms, and facilities.
A.7.4 Audit Checklist
- Confirm premises monitoring scope is documented. - Confirm monitoring is continuous where required. - Review monitoring service or personnel responsibilities. - Check alarm re...
A.7.5 Audit Checklist
Use this checklist during an internal audit of physical and environmental threat protection.
A.7.6 Audit Checklist
Use this checklist during an internal audit of work performed inside secure areas.
A.7.7 Audit Checklist
Use this checklist during an internal audit of clear desk, clear screen, printer, fax, and unattended information controls.
A.7.8 Audit Checklist
Use this checklist during an internal audit of equipment siting, physical protection, environmental exposure, and remote equipment scope.
A.7.9 Audit Checklist
Use this checklist during an internal audit of assets taken, used, stored, or accessed outside organization premises.
Template - A.5.1 Audit Checklist
Research note.
Template - A.5.2 Audit Checklist
Research note.
Template - A.5.3 Audit Checklist
Research note.
Template - A.5.4 Audit Checklist
Research note.
Deep links
Link to this domain with /research/iso27002/templates-evidence/ . Link directly to exact notes from any resource card above.