This checklist audits IMS1 Section 8, from information security arrangements and IT equipment to risk management and the statement of applicability.

Effective Audit Checklists

Prepared using the F-Q2 Audit Checklist form template.

The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Checklist number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information security and internal auditing:

• ISO 27001 knowledge base
• Managing Information Security Risks
• Physical Security for Information
• Internal Auditing knowledge base

Logo Update Service

Download this audit checklist template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This checklist is also included in the ISO 27001 Toolkit and the integrated toolkits that include ISO 27001, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

IMS1 Section 8 Audit Checklist Template - Information Security Management

An audit checklist for Section 8 of IMS1, covering information security management for ISO 27001. Each question is referenced to its IMS1 section. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top, and each question alongside the auditee and the evidence viewed, response and findings.

Areas Covered

• 8.1 Commitment to information security management - whether the information security management system is complete and meets the needs of the organisation
• 8.2 Information security arrangements - awareness training, policies acknowledged by workers, the F-IMS25 Information Assets Register, information classification, confidentiality agreements, incidents, user accounts, access removal and passwords
• 8.3 IT equipment and physical security - the ER10 IT Equipment Logins Register, handheld devices, IT systems monitoring on F-Q25, premises security, and clear desk and clear screen
• 8.4 Information security risk management - ER15 Information Security Risks, monitoring, threat intelligence, and the F-IMS26 Statement of Applicability with a sample of controls validated

Carrying Out the Audit

The last question asks for a number of controls from F-IMS26 to be reviewed and validated, which is the heart of this audit. Choose controls that matter most to the business and see each one working, then check a few devices against ER10 and look for unlocked screens and papers left out on a walk round.

Planning the Audit

Have IMS1 Section 8, F-IMS25, F-IMS26, ER10, ER15 and the incident log to hand, and arrange time with whoever manages the IT systems.

Who Should Carry Out the Audit?

Anyone trained in internal auditing who is independent of the area being audited. The questions are written in plain language, so the checklist also works well for training new internal auditors.

Included in the ISO 27001 Toolkit

This checklist is part of the ISO 27001 Toolkit and the integrated toolkits that include ISO 27001.

Related Documents

Documents that work alongside this checklist:

• F-IMS25 Information Assets Register
• F-IMS26 Statement of Applicability
• ER10 IT Equipment Logins Register
• ER15 Information Security Risks
• F-Q25 IT Systems Monitoring

Part of the IMS1 Audit Checklists

The IMS1 audit checklists follow the sections of the alphaZ IMS1 manual. Sections 6, 7 and 8 cover environmental, health and safety and information security management, and the IMS1 ISO 9001 Checklist covers Sections 1 to 5, so the whole system can be audited across the year using the ER11 Audit Schedule. The results can be written up using the F-Q31 Audit Report.

Not Using IMS1?

For a management system that is not built on IMS1, the Information Security Management System Audit Checklist covers the same ground without the IMS1 references.

Using the Findings

Controls found not to be working, or risks without action, are raised as actions and the statement of applicability and risks register are updated.