Agree the ISMS scope
Identify the business activities, systems and dependencies to include. Establish who can approve risk decisions and policy changes.
ISO 27001 consulting
Build an ISMS you can demonstrate.
Connect risk decisions, control ownership and evidence so your information security management system is ready for independent audit.
Can an auditor trace an access decision?
A risk register identifies former employees retaining privileged access. A dated record should show what the team checked and what changed.
For your review, bring the ISMS scope, risk register, Statement of Applicability and any outstanding audit findings.
Illustrative audit evidence
- Risk and owner
- The IT manager owns the privileged-access review. Identify the systems and accounts within the review boundary.
- Evidence
- Keep the account list, reviewer approvals and tickets showing which access was removed. Link the record to the risk treatment decision.
- Next review
- Bring the ISMS scope, risk register, Statement of Applicability and outstanding audit findings to the readiness discussion.
Engagement scope
From gap review to audit preparation
Review the treatment decisions
Identify the controls needed to treat the risks, compare them with Annex A, and record applicability, implementation and exceptions in the Statement of Applicability. Link each gap to a named owner and review date.
Prepare for independent review
Use a pre-audit to rehearse how the team will demonstrate its controls. An independent certification body makes the certification decision.
Which part of the business will your information security management system cover?
Plan your ISO 27001 work ↗