ISO/IEC 27007:2020
Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing
This document provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011.
This document is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$343.00 NZD
|
|
| HardCopy |
$389.00 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles of auditing
5 Managing an audit programme
5.1 General
5.2 Establishing audit programme objectives
5.3 Determining and evaluating audit programme risks and opportunities
5.4 Establishing audit programme
5.4.1 Roles and responsibilities of the individual(s) managing audit programme
5.4.2 Competence of individual(s) managing audit programme
5.4.3 Establishing extent of the audit programme
5.4.4 Determining audit programme resources
5.5 Implementing audit programme
5.5.1 General
5.5.2 Defining the objectives, scope and criteria for an individual audit
5.5.3 Selecting and determining audit methods
5.5.4 Selecting audit team members
5.5.5 Assigning responsibility for an individual audit to the audit team leader
5.5.6 Managing audit programme results
5.5.7 Managing and maintaining audit programme records
5.6 Monitoring audit programme
5.7 Reviewing and improving audit programme
6 Conducting an audit
6.1 General
6.2 Initiating audit
6.2.1 General
6.2.2 Establishing contact with auditee
6.2.3 Determining feasibility of audit
6.3 Preparing audit activities
6.3.1 Performing review of documented information
6.3.2 Audit planning
6.3.3 Assigning work to audit team
6.3.4 Preparing documented information for audit
6.4 Conducting audit activities
6.4.1 General
6.4.2 Assigning roles and responsibilities of guides and observers
6.4.3 Conducting opening meeting
6.4.4 Communicating during audit
6.4.5 Audit information availability and access
6.4.6 Reviewing document information while conducting audit
6.4.7 Collecting and verifying information
6.4.8 Generating audit findings
6.4.9 Determining audit conclusions
6.4.10 Conducting closing meeting
6.5 Preparing and distributing audit report
6.5.1 Preparing audit report
6.5.2 Distributing audit report
6.6 Completing audit
6.7 Conducting audit follow-up
7 Competence and evaluation of auditors
7.1 General
7.2 Determining auditor competence
7.2.1 General
7.2.2 Personal behaviour
7.2.3 Knowledge and skills
7.2.4 Achieving auditor competence
7.2.5 Achieving audit team leader competence
7.3 Establishing auditor evaluation criteria
7.4 Selecting appropriate auditor evaluation method
7.5 Conducting auditor evaluation
7.6 Maintaining and improving auditor competence
Annex A (informative) Guidance for ISMS auditing practice
Bibliography
Previous versions
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 3842:1998
Guide 62: General requirements for bodies operating assessment and certification/registration of quality systems
-
AS/NZS 4417.1:2012
Regulatory compliance mark for electrical and electronic equipment - Part 1: Use of the mark -
AS/NZS 4417.1:2012AA
Regulatory compliance mark for electrical and electronic equipment - Part 1: Use of the mark: Amendment A -
AS/NZS 4417.2:2020
Regulatory compliance mark for electrical and electronic equipment Part 2: Specific requirements for particular regulatory applications
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles of auditing
5 Managing an audit programme
5.1 General
5.2 Establishing audit programme objectives
5.3 Determining and evaluating audit programme risks and opportunities
5.4 Establishing audit programme
5.4.1 Roles and responsibilities of the individual(s) managing audit programme
5.4.2 Competence of individual(s) managing audit programme
5.4.3 Establishing extent of the audit programme
5.4.4 Determining audit programme resources
5.5 Implementing audit programme
5.5.1 General
5.5.2 Defining the objectives, scope and criteria for an individual audit
5.5.3 Selecting and determining audit methods
5.5.4 Selecting audit team members
5.5.5 Assigning responsibility for an individual audit to the audit team leader
5.5.6 Managing audit programme results
5.5.7 Managing and maintaining audit programme records
5.6 Monitoring audit programme
5.7 Reviewing and improving audit programme
6 Conducting an audit
6.1 General
6.2 Initiating audit
6.2.1 General
6.2.2 Establishing contact with auditee
6.2.3 Determining feasibility of audit
6.3 Preparing audit activities
6.3.1 Performing review of documented information
6.3.2 Audit planning
6.3.3 Assigning work to audit team
6.3.4 Preparing documented information for audit
6.4 Conducting audit activities
6.4.1 General
6.4.2 Assigning roles and responsibilities of guides and observers
6.4.3 Conducting opening meeting
6.4.4 Communicating during audit
6.4.5 Audit information availability and access
6.4.6 Reviewing document information while conducting audit
6.4.7 Collecting and verifying information
6.4.8 Generating audit findings
6.4.9 Determining audit conclusions
6.4.10 Conducting closing meeting
6.5 Preparing and distributing audit report
6.5.1 Preparing audit report
6.5.2 Distributing audit report
6.6 Completing audit
6.7 Conducting audit follow-up
7 Competence and evaluation of auditors
7.1 General
7.2 Determining auditor competence
7.2.1 General
7.2.2 Personal behaviour
7.2.3 Knowledge and skills
7.2.4 Achieving auditor competence
7.2.5 Achieving audit team leader competence
7.3 Establishing auditor evaluation criteria
7.4 Selecting appropriate auditor evaluation method
7.5 Conducting auditor evaluation
7.6 Maintaining and improving auditor competence
Annex A (informative) Guidance for ISMS auditing practice
Bibliography