Iso 27001 Internal Audit

| Problem | Solution | |---------|----------| | Data is stale (> 7 days old) | Refresh from monitoring dashboard or re-export from source systems | | Can't determine which controls apply | Start with the SoA; if no SoA exists, use the decision tree above | | Too many findings to address before audit | Prioritize: fix all Major nonconformities first, then Critical-tier Minors | | Evidence timestamps don't match audit period | Re-collect evidence within the audit window (typically 12 months) | | Cloud provider controls not documented | Request SOC 2 Type II report from provider; map their controls to your SoA | | Internal audit has never been done | This IS the first internal audit — document that in the report and plan for regular cadence |

For detailed per-control guidance, load the appropriate rules file:

| File | Coverage | |------|----------| | rules/access-control.md | A.5.15-A.5.18, A.8.2-A.8.5 — identity, authentication, authorization | | rules/incident-response.md | A.5.24-A.5.29, A.6.8 — incident lifecycle | | rules/encryption.md | A.8.24, A.8.10-A.8.12 — cryptographic controls | | rules/change-management.md | A.8.25-A.8.34, A.8.9, A.8.32 — SDLC and configuration | | rules/logging-monitoring.md | A.8.15-A.8.17 — audit trails and monitoring | | rules/business-continuity.md | A.5.30, A.8.13-A.8.14 — backup, DR, BCP | | rules/people-controls.md | A.6.1-A.6.8 — HR security lifecycle | | rules/supplier-management.md | A.5.19-A.5.23 — third-party risk | | rules/isms-management.md | Clauses 4-10 — management system operation |