Section 16 gives some general recommendations that auditors should consider when creating audit test plan. Additionally, we will also give various examples of other test plans applied to the context of ISO 2701. Audit test plans. So of course you need to prepare, uh we will give some uh general recommendations. Uh an auditor should develop audit test plans By selecting the most suitable and valid ones to verify whether the audit T complies with the standard requirements and the audit criteria. It is best practice, of course, to use a combination of audit test plans. Where you should use a test plan to verify if an audit complies with the standard requirement and the audit criteria, especially when the first one isn't interested. Verbal evidence is usually considered as insufficient evidence. That being said, supporting evidence is required. So I usually say I don't believe anything that you say uh jokingly. I I want to see evidence of for most of the things. So just having a verbal interview is not enough. The auditor should ensure that sufficient audit test plans have been prepared. And the quantity of the required audit test plans will, of course, depend on the materiality of the processes being audited, as well as the reliability and sufficiency of the evidence. When creating test plans, an auditor should also try to group audit plans intended for a particular requirement of the standard in order to avoid disruption of the audities. Operations. Now, when an auditor visits the same audit team multiple times, the test planch should be modified as well, of course. That enables the auditor to conform the audit test performed on previous audits. So, in the following slides, we will introduce six examples of the test plans. So, in order to collect sufficient and reliable evidence, the auditor can basically combine different audit procedures. So, first of all, you can conduct an observation, you can conduct documented information interview, you can do interviews, you can do analysis, and you can also go over a technical verification So we will dive a little bit deeper into the examples and give some more explanation on those test plans So the first example is to check the so we're looking at clause 4. 1, which is understanding the organization and the uh context. So the audit criteria is basically what is stated within the standard. So the organization shall determine internal and external issues That are relevant to its purpose and that affect its ability to achieve the intended outcome of the information security management system. The organization shall determine whether climate change is a relevant issue. So if you then look at the test plans that has been or the other test plans that have been associated with here, so observation has been deemed not applicable. There will be a documented information review so it states there you should review the documented evidence of the processes so will you will have a look at is there a SWOT is there a PESL analysis is there anything done You will also verify if the organization has taken into account climate change and you will also have a look at does the organization does a regular review of that analysis. On the interview aspect, the uh auditor can um to have a chat with uh members of the management team. Um you can also have chats with cross-functional teams to um check how strategic Strategic planning happens, what risk assessments are, how they consider the organization's context in managing information security. You can do a technical verification. In this case, you can have a look at the tools and the methods that have been used to analyze, like the SWOT or a PESEL. But also to have a look if there is anything with climate change on how these issues influence the organization's strategic and operational planning. And lastly, you can do an analysis where you can have a look at the selection of documented information that show how the organization has considered its internal and external context. in setting information security objectives. And that could, for example, include an evaluation of how climate change is considered a relevant issue The second example is in relation to understanding the needs and expectations of the interested parties. So again, audit criteria is what's is stated in clause 402 of the ISO 2701. So I I read out loud the organizations shall determine the interested parties that are relevant to the information. Information security management system. We'll evaluate the relevant requirements of these interested parties and which of these requirements will be addressed through the information security management system. Relevant interested parties can have requirements related to climate change. So the climate change aspect comes back again So you can consider in this example we've considered uh three other test plans. So observation and technical verification will not be done. There will be a documented uh information review done to check what the approach was to come to the um needs and expectations of interested parties. Um you should look for climate change There will be an interview conducted with people that are responsible for understanding the organization's context, engagement with interested parties. So that might be somebody from management to understand, okay, how did you come about these needs and expectations and how have they been addressed? Again, is climate change a thing? And of course the auditor can also do an analysis of selected evidence, how the organization ISMS addresses those requirements and to check if the document information is reflecting those considerations and how the organization is feeding that back to the interested parties. Example three is about control of documented information. In this case, we will look at 7. 5. 3. So the audit criteria is documented information required by the information security management system. And by this document shall be controlled to ensure that A it's available and suitable for use where and when it's needed, B, it's adequately protected, for example, from loss of confidentiality, improper use, loss of integrity. For the control of documented information, the organization shall address the following activities as applicable: the distribution, access, retrieval, and use Storage and preservation, including the preservation of legibility and control of changes and retention and dispositions So it's a lot that we want to check here. So all the different audit test plans will be included here. So as an observation, the auditor should observe How an organization ensures that protection of documented information and if the actions are consistent with policies and procedures. Auditor will do a review of the policy on documenting information management if there is a policy, but also at the procedures, lifecycle management to check if the organization has documented anything. You can do an interview with members of top management, related to the policies, of course, and to personnel responsible for the documented information management and archiving. and to see if they adhere to the policy and procedure that has been set up. You can do a technical um uh verification where you can validate the electronic structure for classifying and storing documented information and to see if the protection mechanism is working and of course you can also do an analysis to see if the documented information that you review that it follows the format and the guidelines as is set in the policy. procedure. Example four, related to addressing information security within supplier agreements. This is in relation to Annex A520, where the audit criteria is relevant information security requirements shall be established and agreed with each supplier based on the type of supplier relationship. So basically, observational technical verification has been deemed not applicable. However, for an internal audit, you can also ask that person to be uh in the meeting where the organization establishes those information security requirements. The auditor can also have a look at the policies that you've uh put out to work with suppliers, but also standard agreements, clauses on information. Information security, performance reports, SLAs, internal reports, and that can all be part of the documentation review. You can also, of course, conduct an interview both with top management To understand how they came up with the requirements, but also to a procurement manager, for example, or somebody else who's responsible for dealing with suppliers to understand how they apply this. And you can also select the sample of documented information to see if everything is already included in all the documents and uh that the organization follow its own policies. Example five is about information backup, which goes to Annex A8 13. Backup copies of information, software, and systems shall be maintained and shall regularly be tested in accordance with the agreed topic-specific policy on backup So again we will be performing all the audit test plans so you can observe how the backup procedure is performed and the locations where copies are kept. So I usually ask them to If possible, do a backup during the audit so you can follow it. You want to see the labeling, the physical and the environmental security, so you want to follow up that You can review the policy where you can check is there a definition of the required backup levels? Is there backup criteria? Is there anything about encryption, for example? Is there a link with the business? Business continuity plan. Has the organization established procedures on how to do backup and restore of backup? Do they do dry runs? Are there any records available? You can do an interview, of course, with the operations manager to understand how it works, to explain the strategy. You can do a technical configuration where you can verify backup system configurations. And security mechanisms like encryption, where you can ask to do a restore of an archived file, and you can select a sample to verify if the entries have been well documented in the backup. So you can do a lot of things. Example six is about identity management, which relates to annex A516. The full life cycle of identities shall be managed Again, we will complete all the audit test plans so you can do an observation to see how user identities are established and how the configuration process works You can in the documented information review any policy that there is about identity and access management, but also the review and approval of user identities. you there might be user access review rights, so there might be different documentation available. You can conduct an interview with an help desk manager, for example, to confirm The features covered by identity and access management policy and to check if the help desk follows those. You can do a technical verification where you verify the configuration and operation of system I used for activating new identities. And you can do an analysis where you select a sample of users and you validate if they have unique identities when accessing the information. the organization's information and if the identity and access management policy has been properly followed. Example seven is about management of technical vulnerabilities, and which relates to Annex A8. 8, where the audit criteria are information about technical vulnerabilities Of information systems in use shall be obtained, the organization's exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken. Again, all the other test plans will be followed or can be followed and you can observe a technician performing activities related to the management of vulnerabilities. So you can have a look at intrusion test or vulnerability scanning and you can have a look at those. You can do a documented information review where you can check if there is a procedure around vulnerability management, if there is an um An asset inventory of computer material. If you have a list of potential vulnerabilities, you might see if there is a distribution list of software publishers. related to vulnerabilities you can check if the organization is subscribed to certain newsletters. There are a couple of things that you can review there. You can uh interview the information security manager to determine whether the procedure for the management of technical vulnerabilities has been established. And of course, you should also interview You can do a technical verification to see if the latest version, for example, on a system is installed and how vulnerabilities are treated. And you can also select a sample of technical vulnerabilities to see if they were treated in accordance with whatever is written in the procedure. To see if the organization follows their own procedures. The last example is example eight, which is related to information security event reporting. related to Annex A6. 8, the organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner. Again, all other test plans will be followed. As an observation, you can, for example, observe how somebody reports an information security. uh event of course when it occurs during the audit. If not you can ask of course um somebody uh randomly if there would be an information Security event, what is it what you would do? You can review the information security event procedure and information security incident management policy. You can review those documents. You should interview the information security manager or an help desk manager to confirm that the process and procedures are followed You can do a technical verification of the configuration of automated alerts embedded in information systems and test their effectiveness. And you should also do an analysis of security events where you can check if they were treated according to whatever has been written in the procedure. So you should check if there is a root cause analysis lesson. Slurred and so on