So annex a dot one of the twenty-seven thousand seven ISO standard gives guidance on auditing an ISM. So that 2707 ISO standard provides generic guidance on how organizations should be audited that claim conformance to the ISO 27001. So this the guidance that is given in the ISO 2707 is um independent of the size of the organization or the industry that it in so the guidance is very uh generic and of course the guidance can also be used both for internal and external auditors So again, we will dive deeper and we will have another couple of slides where we dive deeper into that guidance for auditing in ISMS. So in the ISO 2707, there are a couple of tables that you need to understand. So when looking at auditing and understanding the organization and its context. you will get um a referral to the subclauses. So in the ISO standard it ref refers back to clauses Um six dot uh one nine point three. Um you have the twenty-seven thousand uh definition, uh external context, information security Internal context management system. And then you will have a look at okay, what is the audit practice guide and what is the audit evidence So you will basically have a look at how that evidence can be obtained through documented information or other information on important issues that affect positive or negatively the ISMS. You can have Information on the organization, the purpose, the intended outcomes. You can also look at environmental characteristics or conditions, the climate changes, they're of course important. You can have a look at what is the culture, what are the policies, do you see trends in risk assessment and so forth So you want to have a look as or you should confirm if the organization has a high-level understanding on um yeah the the effects that uh or the internal and external um effects on the organization. And you should also um understand uh you need to check if the organization knows what those external internal issues Issues are that are relevant for its purpose and that affect its ability to achieve the attended outcome of the management system. So looking at the risk assessment, looking at the SWOT analysis, looking at confidentiality and integrity, though what they need to confirm that the organization has a good insight. uh on important topics for the organization um uh you want to see uh how do how does that affect the management system. When you want to address climate change within the requirements of clause 4. 1, this is a new requirement. Organizations shall determine whether climate change is a relevant issue. With all my customers, this is a challenge. People find it a very difficult requirement. So to audit this new requirement, you should think about a couple of things. You need to see if they if an organization has included climate change in the assessment of internal and external. Issues. We also want to check in the risk assessment if there are any risks related to climate change. And you also want to see if there is anything in the strategic direction that takes into account climate change. There also might be stakeholders that are requiring it. So looking at the risk assessments Strategic meetings, stuff like that. So you want to get a little bit insight in that context as well. Understanding needs and expectations of interested parties. Goes to clauses 4. 1 and 4. 3. Um linked to the 27,000 definition is an interested party. Um so you want to audit their uh evidence of the interested parties, you want to check uh what interested parties Have been included. Are there customers? Do you have authorities in there? Do you have suppliers? Neighborhood neighbors, members of the organization, and others working on the behalf of the organization. So you should be able as an auditor to confirm that the organization has a high level understanding of the needs and expectations of the relevant interested parties. So there are a lot of things that you can include, of course, there. And again dependent on the organization, you might include authorities or regulatory agencies, licenses. obligations, communication, and that might be very different per organization. Interested parties can of course have different interests which can be completely aligned. Disaligned, opposed to the business objective. So that needs to become clear out of that stakeholder analysis as well When addressing climate change in this requirement, the clause 4. 2, where relevant interested parties can have requirements to the climate change. uh you can consider uh the following uh are there um expectations um of relevant interested parties concerning that climate change And evaluate of those customer requirements, Li regulatory obligations, or other external parties expectations include climate change related measures. So you that might be the case. I see more and more that in tendering um in questions that that customers ask. um that um environment climate change uh becomes uh a growing uh thing so uh there might be the case that there is Uh something that can be reflected there. So you also want to verify if there are ISMS objectives or controls that reflect any newer changing expectations related to that climate change And you also want to verify that the organization has a method to regularly verify and update understanding of interested parties. So You should look for any climate change requirements related from parrot companies, customers, suppliers, and so forth. When auditing climate change issues that might influence the organization's ISMS, auditors should consider the following. Is climate change a thing within the organization? Has it been identified? And is it aligned with whatever applicable statutory, regulatory, or contractual requirements that were? So you should check if an organization has assessed that potential for climate change. both to the physical and digital infrastructure and the implications on information security. So if climate change has been deemed a relevant issue, the organ the auditor should also check If the organization has considered its broader business applications all the way down the supply chain, uh how uh could it directly and indirectly impact the information? Information security and auditors may need to examine how the organization manages data protection and cybersecurity during climate-induced incidents, such as extreme weather events, for example, that could lead to data breaches. When determining the scope of the information security management system as related to clauses 4. 1 and 4. 2, the audit evidence can be gained through documented evidence information or other information of the scope of the organization management system, the scope of an organization certification, statement of applicability can also help, of course Um so you should um confirm that the organization establishes both physical, informational, legal, and organizational boundaries to which the ISMS Is applied so that there is a good understanding if it's applicable for the whole organization or for a business unit. So understanding that context of the organization uh and again the requirements of the interested parties um and the interfaces and dependencies between activities performed by the organization uh should be considered when establishing uh the scope Auditors should also have a look at the information security risk assessment and risk treatment so that it reflects the activities um that are included in that scope and that's um as as as defined in that scope and they should also verify that um one statement of applicability And that all controls determined in the risk management process are also included in the statement of applicability. And of course, controls that are the necessary controls referred to in ISO 27001 are not necessarily all the NXA controls. So they might also include sector-specific controls that are not part of the NXA. control. If there are any interfaces or any outsourcing activities that should also be clear. It needs to be clear where the overlap sits within the organization and how that is managed. For example, if you have a sharing of facilities of IT systems and stuff like that, you should be able to determine that in the scope as well. need to ensure as an auditor that the documentation of the scope is of course created in line with whatever you've identified in your procedure for documented inference. When looking at an information security management system and that goes to a couple of controls, s 6. 1. 1. 2. 3, but also 81, 82, and 8. 3 You should find uh information or evidence in the documented information um towards the processes that are included in the management system. and how is there an operational planning linked to those processes? Do you have a structured approach? Do you also include your outsourcing outsourced processes? How do you verify those What are the processes for risk management, risk treatment? How do you execute those? And what is the process to achieve information security risks? So the auditor should confirm that the organization creates um necessary but sufficient set of processes and controls in order to uh meet conformance of ISO 20. 27,001 and also check that there are interrelating systems and so forth. So the auditor should confirm that the organization In however it's set up with the capacity with the processes with the authority to decide how it will fulfill the ISMS requirements, including the level of detail and extent to which it will integrate the ISMS requirements. In its business. When auditing the policy, which is related to 6. 2 and 7. 4, the audit evidence can obviously be obtained by looking at the information security policy, but also to the information. Information security objectives. So auditors should confirm that the information security policy specifies the high-level organizational commitments as required by the standard, taking into account the organization's purpose. The information security policy is either used to frame or build the information security objectives that the organization sets for itself or are stated explicitly as part of the information. security policy and that there is also documented information of that information security policy and that this is controlled in line with the information security document management procedure. So in addition, you also need to check that the information security policy is communicated internally but also externally to other interested parties. when that is necessary. So those are the the most important things that you need to consider when auditing the security policy. When auditing resources, that goes back to clauses 5. 1, 6. 2, 7. 2, audit evidence can be gathered through documented information um to check if um if you have established something around um the implementation of the isms or the Implementation, the operation and the controls, but also um something around the maintaining and the continually improving of the IS SMS. So auditors should there really look for is the organization ready both to anticipate but also to allocate resources. Needed to both establish and implement uh the ISMS but also to maintain and to continually improve it. So resources here can really include your people Of course, uh specialized skill, money, uh technology. Um, so it might be uh a whole set of things that you can uh check for, and you might, for example, uh check a budget sheet to see if there is any allocation of money into the budget. Sheet. When auditing a management review, there's go uh related to a lot of subclauses, so 4. 1, 4. 2, 8. 1. 2, 8. 1. 3, 9. 1, 9. 2, 10. 1, and 10. 2 So you can of course find a lot of information. You want to check if the reviews are done in a planned interval, so you want to check agendas or stuff like that. You want to check the status from the previous management review meeting. You want to see that there are changes in internal and external issues. You want to see that the organization has had a look at that. You want to get insight on feedback of that information security performance. So you want to see trends or measures in relation to non-conformities and corrective actions. You want to see some monitoring and measurements results, audit results, but also the fulfillment of information Information security objectives. You want to check that the organization has done something with the feedback from interested parties. You want to see an overview of the risk assessment and the status of the risk treatment plan. And you want to see some opportunity. For improvement. So the auditor, you should as an auditor check with the management that you've that they've done the management review and that they have a schedule of that and that they have addressed all the topics that are required by the standard. So you should check that everybody off-top management has been involved through that, and you should also check if the management has formed some kind of a conclusion. And so what is listed in the audit evidence? What are decisions moving forward? How does the management think about the ISMS? So there are a couple of things that need to be considered Then lastly, some guidance on auditing non-conformities and corrective actions. Clauses 7. 5, 8. 1, and 10. 2 are related to that. So audit evidence can be obtained through documented information or other information about what is the nature of nonconformities and any subsequent actions taken, what were the results of the corrective actions How were those results monitored and measured? How was the audit program and the audit results? You can have a look at those. You should have a look at the management review to see what any non-conformity And corrective actions came out of that. And if the non-conformities have been discussed in the management review, any requirements from interested parties that have an impact and changes to the ISMS brought by corrective action. So, what you basically want to audit or what you want to confirm is that the organization responds in a correct way to non-conformities and that they undertake the actions that are necessary. So you need to take the actions, you want to see that they've done a root cause analysis, you want to do see an impact analysis, and you also want to see that an organization checks the effectiveness of the corrective measures that they have implemented. So this was a pretty long section on how to conduct or how to create audit test plans and also how you could audit a couple of the clauses. So First of all, the auditor should develop audit test plans to verify whether the auditee complies with the requirements of the standard and the audit criteria. An auditor can also combine different audit procedures in order to collect sufficient and reliable evidence. And we have of course presented several examples of audit test plans Which consisted of a combination of the following audit procedures. So we always spoke about observation, documented information, review, interviews, analysis, or technical verification.