Source: [LinkedIn](https://www.linkedin.com/pulse/iso-27001-ask-gerardus-blokdyk/)  
Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)  
Publication date: March 22, 2022
Retrieved from on March 23, 2022

Relevant ISO 27001:2013 clauses/controls:
- [[ISO 27001 C 9.2 Internal audit]]
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)


## ISO 27001: Ask This;

  

### TLDR: Ask This;

  

1. How do you increase information security management automation in the context of the ISO 27001 process model?

2. Does organization has an access control policy that shall be established, documented and reviewed based on business and information security requirement?

3. How does your organization place confidence in the actual information security controls of business partners?

4. Do you have agreement with the suppliers about information security requirement for mitigating the risk associated with suppliers access to your organizations assets?

5. What are the minimum protocols of your organization for information security management standards?

6. Has your organization ever asked business partners to implement information security measures?

7. Are information security policies that provide management direction defined and regularly reviewed?

8. Is the security of information and data exchanged within your organization and with any external entity maintained?

9. Does your organization implement security countermeasures required for information system operation?

10. Do you modify your information security controls in response to changes in risk acceptance criteria?

11. Is management able to determine whether security activities delegated to people or implemented by information security are performing as expected?

12. Does top management review the information security management system at planned intervals?

13. Do you modify your information security controls in response to changes in business processes?

14. Do you modify your information security controls in response to changes in business requirements?

15. Is the information security risk assessment process sufficient to identify risks associated with loss of confidentiality, integrity and availability for information within the scope of the ISMS?

16. Has the information security risk treatment plan been implemented and documented information retained?

17. Have you defined and applied an information security risk treatment process to select risk treatment options, determine controls, formulated a treatment plan and including risk owners?

18. Is the information security management system integrated in an existing management system?

19. Are information security risk assessments carried out at planned intervals or when significant changes occur, and is documented information retained?

20. Has information about the information security risk assessment process been documented and is available?

21. Has an information security risk assessment process been established to include risk acceptance criteria?

22. Have you determined internal and external issues that are relevant to your organization as relevant to information security management?

23. Has your organization implemented appropriate measures to protect audit and logging facilities and log data against security attacks?

24. Have you considered external and internal issues, the requirements of interested parties and determined the information security risks and opportunities that need to be addressed?

25. Do you modify your information security controls in response to changes in your levels of risk?

26. Do you modify your information security controls in response to changes in contractual obligations?

27. Do you modify your information security controls in response to changes in legal requirements?

28. Do you modify your information security controls in response to changes in regulatory requirements?

29. Do you retain documented information of the results of the information security risk assessments?

30. Have you defined and applied an information security risk assessment process that establishes risk criteria, identifies risks, analyses risks, evaluates risks?

31. Is there policy for information security that has been reviewed in a planned time interval?

32. Have you planned, implemented and controlled the processes needed to meet all information security system requirements?

33. How can needs be addressed through proper information security management practices?

34. Is there a consistent and effective approach applied to the management of information security events?

35. Has the information security risk assessment process been developed to be repeatable?

36. Does your organization have a policy that distinguishes the need for security professionals?

37. Who is responsible for implementing the continuous monitoring process for individual information systems or common security controls?

38. Does the information system developer create a security test and evaluation plan, implement the plan, and document the results?

39. Are information security events and weaknesses associated with information systems communicated in a manner to allow timely corrective action to be taken?

40. Are information system developers required to implement and document security functional and assurance requirements?

41. What information security risks exist in the environment in which your business operates?

42. Does your organization have the level of security control, you really need or expect?

43. Have you implemented an audit programme, ensured results are reported to management and retained documented information as evidence of the audit program and audit results?

44. Does your organization have a procedure describing how to implement and enforce security policy?

45. Do you ensure your providers adhere to your information security and privacy policies?

46. Has a process for identifying, assessing, and treating information security risks been established?

47. Is the security of organizations information and information processing facilities maintained when corresponding are accessed, processed, communicated to or managed by external parties?

48. Do you provide antimalware training specific to mobile devices as part of your information security awareness training?

  

## Organized by Key Themes: SECURITY, RISK, MANAGEMENT, DEVELOPMENT, DATA, COMPLIANCE, SYSTEMS, INFORMATION, QUALITY, INDUSTRY:

  

### SECURITY:

  

Did the requirements permit updating security requirements as new threats/vulnerabilities are identified and as new technologies are implemented?

Work with the Information Security Risk and Compliance team to support the development and updating of your (internal) clients security policies and standards and ensure the ongoing compliance with both regulatory obligations and internally developed policies and standards that are in alignment with industry standards. 

  

What attitude changes are needed to cause smes to take a strategic approach to information security?

Make sure the cybersecurity risk management services support the CSO Information Security and Cyber Protection Program by providing a structured approach to integrating risk management and information security into the System Development Lifecycle (SDLC) of IT systems and services. 

  

Is there a formal process for monitoring, reviewing and regularly updating the programme?

Secure that your organization is responsible for proposing, implementing, and maintaining systems which support information security and compliance measures, including network/server infrastructure, monitoring platforms, collaboration tools, and identity management systems. 

  

Do the isms objectives compatible with the strategic direction of your organization?

Certify your workforce is supporting the development, documentation and maintenance of policies, procedures, and standards across the organization ranging from Information Security and Data Protection to Quality Management and Environmental. 

  

What information security risks exist in the environment in which your business operates?

Make sure the information security risk and compliance is responsible for supporting and maintaining the information security program to ensure that information assets and associated information systems are adequately protected in the digital ecosystem in which the client operates. 

  

Do you follow operational standards or frameworks for managing Information Security/cybersecurity?

Establish that your operation works collaboratively with all team members to collect Quality Management System (QMS) and Information Security Management System (ISMS) input, update existing process, procedures, work instruction and guidance documentation. 

  

Have security measures been implemented upon receipt or sending of the information or data?

Ensure your operation is responsible for proposing, implementing, and maintaining systems which support information security and data compliance measures. 

  

Does the pandemic tech solution comply with the values, standard and policies of the project owner?

Warrant that your organization is involved in common Information Security Compliance standards and frameworks as, ISO 27001/2, PCI, SOC 1/2/3, and NIST etc. 

  

Does your organization have perimeter scanning/monitoring agreements with managed network services providers?

Make sure the security architecture work includes all areas of Information Security such as IAM Authentication/access management, threat management, incident response, forensics, logging, monitoring, application security, data protection, vulnerability management, and configuration management in relation to multiple Cloud Service Providers. 

  

Have you implemented segregation of duties for tasks that may have security implications?

Oversee that your design plans, implements, and maintains the IT security risk management program capabilities and collaborates with Compliance ERM. 

  

### RISK:

  

Do you conduct internal audits regularly as prescribed by industry best practices and guidance?

Support the design of independent technology risk oversight program which defines the engagement and integration with various risk management programs, including Process Risk Self Assessments, Business Continuity Management, New Product Approval, Mergers and Acquisitions etc. 

  

Do you generate decisions and actions to improve the effectiveness of your organizations ISMS?

Secure that your strategy conducts in-depth inquiry and data analysis to understand complex cyber and technology operations, assess risk based on industry risk profile, and develops project scope for complex and cross-functional process areas, leveraging business knowledge and expertise. 

  

Does the research plan set out the affiliation of each person involved in the research?

Check that your organization is involved in data governance, vulnerability, DLP, and risk management systems. 

  

What standards, guidelines, best practices, and tools is your organization using to understand, measure, and manage risk at the management, operational, and technical levels?

Clearly understand the on premises and cloud technology and operational risk to the Information Technology Services organization as well as related laws, regulations, and industry standards, specifically as related to internal and cloud technology solutions. 

  

Is there any information about possible additional ISMS processes in the other standards?

Be confident that your team follows written legal risk and compliance policies and procedures for business activities. 

  

Are all program changes and effective dates recorded in a manner which preserves an accurate chronological record of the system?

Warrant that your team is ensuring that relevant information risk and governance policies and objectives are maintained in line with your organizations risk appetite and with changes to organization, legislative, regulatory, group and operational requirements. 

  

Is key management in place to support your organizations use of cryptographic techniques?

Support GRC solutions as Risk Management, Enterprise Management, Business Continuity Management, Audit Management, Compliance Management, Incident Management, and Vendor Risk Management. 

  

Does the property topography provide security or reduce the means of attack or access?

Ensure your process oversees and conducts risk assessments and regular audits on information assets, both IT and non-IT, analyze findings, and develops and proposes solutions to mitigate risks; develops, implements, and monitors controls to reduce unacceptable risks. 

  

Do you have capability to recover data for a specific customer in the case of a failure or data loss?

Confirm that your workforce is participating in vendor management and review processes to ensure key vendors do not expose your organization to unnecessary risk. 

  

Do you provide antimalware training specific to mobile devices as part of your information security awareness training?

Be part of incident management and risk mitigation processes of your organization to do root cause analysis, report generation and provide mitigation solutions. 

  

### MANAGEMENT:

  

Has the information security risk assessment process been developed to be repeatable?

Assure your strategy works closely with all departments to understand their critical operations, analyze business continuity requirements, help them assess key technology and compliance risks and ensure the consistent application of policies and standards across all technology projects, systems, and services including, privacy, risk management, compliance, business continuity management and incident response. 

  

What measures are included in the standards for the logistics of industrial projects?

Interface so that your staff analyzes trends and changes in threat and compliance environment with respect to organizational risk; advises organization management and develops and executes plans for compliance and mitigation of risk; performs risk and compliance self-assessments, and engages and coordinates third-party risk and compliance assessments. 

  

Have past employees/ terminated employees been removed from having access to the property?

Be certain that your staff solutions define and deliver innovative compliance and risk management approaches to (internal) customers that help the customer understand how to move sensitive workloads onto the cloud faster. 

  

How integrated are environmental, quality and other standardized management systems?

Ensure your process maintains network configuration and security integrity through CI management and documented procedures. 

  

Have qualified staff been assigned to perform external dependency management activities as planned?

Warrant that your organization is understanding or previous involvement working with risk management and compliance frameworks as NIST, ISO 27001, PCI, GDPR, etc. 

  

Does your organization have the level of security control, you really need or expect?

Make sure your operation develops and oversees effective disaster recovery policies and standards to align with the enterprise business continuity management (BCM) program goals, with the realization that components supporting primary business processes have to be outside the corporate perimeter. 

  

Did your organization require additional resources to implement and run the Toolbox?

Certify your process remains current on PCI DSS industry requirements and shares relevant information with management and applicable business units. 

  

Are os and antivirus patches also considered under change management/ patch management?

Safeguard that your personnel is documenting Application Access and Change Management procedures to ensure all systems and processes are documented in accordance with internal controls compliance regulations. 

  

Does your organizations incident management plan and processes include systems in the AWS environment?

Utilize GRC tools to manage list of external authoritative sources, information technology controls, corporate policies and procedures, vendor management system, and risk management workflows. 

  

Do you modify your information security controls in response to changes in contractual obligations?

Confirm that your organization is involved in Management of Change systems, as process and product validations. 

  

### DEVELOPMENT:

  

How do you satisfy yourself that audit quality is always the number one priority?

Be confident that your organization is involved in information system design, including application programming on large scale DBMS and the development of complex software to satisfy design objectives. 

  

Where nonconformities are identified, has your organization put in place appropriate processes for managing nonconformities and the related corrective actions?

Lend expertise to the product design, development, and engineering teams to ensure development specifications, quality standards and testing requirements are appropriately documented. 

  

How do you organizations system?

Manage the development and implementation process of a specific organization product involving departmental or cross functional teams focused on the delivery of new or existing products. 

  

Are rules defining how your organization information is protected at teleworking sites?

Ensure staff development is an ongoing focus of this operation including having team members work with each other to ensure the distribution of skill sets. 

  

Does the software provider or the user group manage the agenda and contents of the meetings?

Ensure the software development process and the final delivered product adhere to established standards and meet requirements and (internal) customers expectations. 

  

Has a process for identifying, assessing, and treating information security risks been established?

Ensure your strategy is participating in development of organization cyber scorecards to identify business strengths, weaknesses, and opportunities. 

  

Which contains references to expected Business Continuity Planning practices that other organizations must implement?

Collaborate with engineering leaders and teams across your organization to advance development of cloud enabled software, CI/CD, and related modern software engineering practices. 

  

Is there a standard set of tools and/or methods in use to identify vulnerabilities in assets?

Safeguard that your group participates in business planning, new service development, partnership development and other tactical processes and procedures to identify service enhancements. 

  

Does your organization have a methodology in place for the proper allocation of business resources to invest in, create and maintain IT standards?

Make sure the Cloud Architect is responsible for partnering with key stakeholders, IT and project teams for the overall development and design of robust, scalable, optimized cloud- based platforms and solutions. 

  

Does management decide on the criteria for accepting risks and the acceptable levels of risks?

Development of your (internal) customers by meeting the needs, including security services and products. 

  

### DATA:

  

Who does your organization, its staff and/or customers complain to if there is a privacy breach?

Warrant that your organization coordinates Disaster Recovery, Business Continuity and Incident Response planning to ensure effective protection and recovery of information services, organization data and business operations. 

  

How do you ensure that generated reports protect privacy?

Work closely with the development and data team members to implement the data model changes and provide validation support on the outgoing data reports. 

  

How do you obtain assurance over large volumes of sales transactions across the year?

Make sure the CISO directs the management of data; identifies and minimizes data and cyber risks; and proposes and implement solutions, oversees crisis management, third party arrangements and agreements, and compliance efforts relative to applicable data privacy and confidentiality laws and regulations. 

  

Is it possible for all relevant publicly available information to be analyzed and used for trading purposes in the stock markets?

Assure your personnel is conducting surveys, focus groups, and other accepted techniques for data collection in support of organization studies that specifically assess and analyze current organization states and management systems. 

  

How do you acquire leadership buy in and guarantee the necessary support for your ISMS objectives?

Make sure the billing analyst (project contract analyst) is responsible for data analysis of an internal portfolio of projects and the aggregation of metrics for ediscovery services; generating invoicing bill points, reports, and customer deliverables in support of the legal technologies sales, project management, and operations teams. 

  

What are your suggestions to make information security benefits more visible in your organization?

Drive the strategy to let every function in your organization leverage data in making key business decisions. 

  

Is there management oversight of the performance of the change management activities?

Warrant that your strategy is involved in data governance and retention (Retention policies/tags, data governance reports and dashboards, information holds, managing inactive mailboxes). 

  

Are users made aware of the responsibilities for maintaining a safe and secure working environment?

Work with Legal and Data Privacy teams to secure and properly process organization data. 

  

Is the process of documenting and reporting corrective actions formal and traceable?

Be certain that your process is involved in data design and modeling, ETL processing, Enterprise/Web Reporting, Query analysis and development. 

  

How do you acquire leadership buy in and guarantee the necessary support for your ISMS objectives?

Make sure the delivery of automated performance metrics and reporting that support data driven decision making and IV and V for quality, delivery, and testing organization wide. 

  

### COMPLIANCE:

  

How are the skills of personnel involved in conducting assessment activities established?

Establish that your organization is involved in full Governance, Risk Management and Compliance Lifecycle. 

  

Are there evidence of management commitment to the establishment, implementation, operation, monitoring, review, maintenance and improvement of the ISMS?

Safeguard that your operation monitors and enforces appropriate and consistent application of the IT General Control Framework - plans, organizes, and executes control monitoring and testing in a manner that meets reporting deadlines, performs impact assessments when weaknesses are identified, and provides training to various IT and business teams on proper application of IT controls to improve your organizations overall compliance posture. 

  

Are all the records protected according to identified regulatory, contractual and other requirements?

Interface with the Risk, Certification, and Accreditation team, and Compliance teams to ensure necessary changes reflected in policies to address the risks identified for critical information assets. 

  

Have you planned, implemented and controlled the processes needed to meet all information security system requirements?

Work with software development teams to build safe and secure public safety and communications SaaS products which modernize and scale in the cloud to meet local, state, overarching, and international compliance standards. 

  

Is there an effective internal process that ensures that identities are managed lifecycle?

Make headway so that your process ensures accurate identification, communication, and mitigation of risks, processes, and internal control gaps with potential adverse operational, financial, strategic and compliance risk implications. 

  

Are physical security practices formally governed, documented, maintained, and enforced?

Make sure the cfe regulatory compliance team facilitates adherence to internal and external cfe regulatory requirements and standards through control automation, control monitoring and embedding requirements into modern engineering practices. 

  

What are the risk management method phases supported by each analyzed software tool?

Identify, research, and evaluate new compliance requirements impacting the audit and assurance practice and analyze impact to your organizations (internal) clients and organization processes, policies and procedures. 

  

Are the controls, as defined in Annex A, adequate to protect us in the online sphere?

Secure that your group is involved in compliance requirements and industry standards like PCI, HIPAA, ISO 27001, NIST, CSF, ITIL, COBIT, Sarbanes Oxley and SANS 20. 

  

Have actions to control, correct and deal with the consequences of nonconformities been identified?

Make sure the GRC team is your organization enabler and is responsible for maintaining and executing a regulatory compliance roadmap. 

  

Are services prioritized based on analysis of the potential impact if the services are disrupted?

Act as an internal consultant on business and technology projects to ensure appropriate compliance considerations are prioritized and integrated. 

  

### SYSTEMS:

  

Is higher level management aware of issues related to the performance of change management?

Make sure your workforce oversees implementation of IT Security Policies as they relate to database systems security. 

  

How do you improve your auditing performance?

Establish that your staff supports introduction of new tools, systems and technologies to improve business process efficiency. 

  

What measures are included in the standards for the logistics of industrial projects?

Validate systems with specific emphasis on network operations and cyber tactics, techniques, and procedures focused on the threat to information networks; assess performance using evaluation criteria and technical performance measures. 

  

Has your organization determined the knowledge necessary for the already stated performing ISMS roles?

Make sure your team audits internally all systems and areas for compliance to AS9100 specifications. 

  

How is sox compliance achieved if in scope systems are deployed in the cloud provider environment?

Be confident that your process expands its knowledge in integrating diverse, sophisticated software systems and tools, and implementing operational workflows, processes and procedures to deploy capabilities across large, complex organizations. 

  

Do you have antimalware programs that support or connect to your cloud service offerings installed on all of your systems?

Devise and establish IT policies and systems to support the implementation of the overall organization strategies. 

  

Which automated work steps will occur during the processing of individual transactions?

Make sure your workforce leads and coordinates activities of other lower level information systems architects. 

  

Are resources available to establish policies and procedures to support the selected controls?

Be sure your organization is involved in infrastructure deployment, systems administration, support, and maintenance. 

  

Are information processing facilities implemented with redundancy to meet availability requirements?

Work with Stakeholders to understand requirements and iteratively design and develop applications and systems to meet the needs. 

  

What is the single most important benefit that ISO 27001 implementation has brought or will bring to your organization?

Make certain that your process is managing multiple disciplines (external and internal) to bring Industrial Control Systems from the design stage to production. 

  

### INFORMATION:

  

Do you generate decisions and actions to respond to changes in your organizations levels of risk?

Interface so that your organization researches, assembles, and/or evaluates information or data regarding industry practices or applicable regulatory changes affecting information system policies or programs; recommends changes in development, maintenance, and system. 

  

Does your organization support account lockout policies on the customers hosted site?

Oversee that your group delivers reliable and effective Information Technology services to organization (internal) clients in support of critical mission needs. 

  

Are change control procedures in place for application software and is source code protected?

Make sure the team determines through monitoring, control testing and business consultation that your organizations information resources are secure from unauthorized access, protected from inappropriate alteration, physically secure, and available to users in a timely fashion. 

  

Which properties of information should be maintained in the context of information security?

Ensure your operation works with standards team to include robust and updated information on privacy in the csf framework and helps to develop and maintain privacy certification. 

  

Do you aim for complying with ISO/IEC 27001, the international standard for information security management?

Ensure products and systems comply with requirements and organization information and cybersecurity standards through formal verification methods. 

  

Are resilience and recovery controls updated to reflect new, changed and retired systems?

Ensure the list of suppliers for the Flutter group is updated with accurate information including business relationship owners and the risk category. 

  

How do you maintain control over it?

Certify your staff works with organization administration, legal counsel, and other related parties to represent the organizations information privacy interests with external parties, including organizational bodies and other key stakeholders. 

  

How do you get comfort over the long term viability of the cloud service and the cloud provider?

Safeguard that your group identifies, designs, builds, and maintains metrics systems that provide high quality information to leadership, the Board of Directors, and regulatory departments. 

  

Are the corrective actions appropriate to the effects of the nonconformities encountered?

Be confident that your design performs or oversees information privacy risk assessment/analysis, mitigation and remediation. 

  

Has an access control policy been defined and reviewed, and is user access to the network controlled in line with the policy?

Ensure you are able to use the systems in accordance with organization policy to properly document service information in accordance with organization and manufacturer guidelines. 

  

### QUALITY:

  

How does your organization manage changes to IT systems involved in revenue generating activities?

Make headway so that your strategy is involved in the development of a quality manual and/or quality management system. 

  

Do you have a process for tracking and tracing your product while in development and manufacturing?

Make headway so that your organization manages and directs quality area functions ensuring product compliance from all aspects of manufacturing. 

  

Are aspects of information security considered in the different processes of your organization?

Warrant that your organization ensures employee performance adheres to the Quality Management System processes. 

  

How are you ensuring the integration of the ISMS requirements into its business processes?

Be certain that your strategy is leading and managing a team of Quality Engineers in ensuring product and process compliance. 

  

Do your service deliverables outline which services can be done remotely and which cannot?

Ensure you use a variety of technologies and approaches to deliver quality product and services to organization departments and technology companies. 

  

Does the policy relating to ethics, bribery and corruption cover only your organization?

Oversee that your team complies with all appropriate legal and regulatory requirements when reporting and to the requesting organization while relating all facts accurately with a high quality standard. 

  

Are there policies and agreements to maintain the security of information transferred within or outside of your organization?

Ensure the quality management system procedures and processes are implemented and maintained. 

  

Are management review improvement decisions and change requirements promptly implemented?

Manage and improve the quality business process for (internal) customer requirements. 

  

Does your organization have an identity management strategy that supports the adoption of cloud services?

Verify that your operation provides strategic quality direction in support of new business initiatives. 

  

Who is responsible for implementing the continuous monitoring process for individual information systems or common security controls?

Be confident that your workforce leads site standardization initiatives and will be responsible for compliance with the quality system. 

  

### INDUSTRY:

  

Has your organization implemented appropriate measures to protect audit and logging facilities and log data against security attacks?

Guarantee your operation monitors technological advancements to ensure that solutions are continuously improved, supported, and aligned with industry and organization standards as well as emerging business requirements. 

  

How do you get involved in the development of security standards?

Oversee that your team is involved in IoT and durable goods industry. 

  

Do you have confidence in the resilience of the systems and processes that manage payroll data?

Be certain that your group is involved in industry and networks of relationships across businesses of varying sizes. 

  

How might you be able to learn about if/how a group experiences systemic oppression?

Warrant that your process is existing relationships with key industry press with Crypto and Mainstream publications. 

  

How do corresponding practices relate to existing international standards and practices?

Develop and enforce IT policies based on industry standards and best practices to further secure computing resources. 

  

How do you keep up with developments to the ISO 27000 series standards?

Ensure you bring the necessary involvement to streamline and automate deployment pipelines, while driving the adoption of industry best practices to keep your infrastructure secure, scalable, and efficient. 

  

Are source code audits performed by someone other than the person or team that wrote the code?

Make headway so that your design redefining an age old industry. 

  

Is the policy been published and communicated to all employees and relevant external parties?

Be certain that your staff participates in industry wide conferences. 

  

Is higher level management aware of issues related to the performance of service continuity?

Secure that your workforce continues executive education to remain abreast of the changing financial industry. 

  

Has a program to ensure the ISMS achieves its outcomes, requirements and objectives been developed and implemented?

Keep track of new regulations, industry best practices, and implement continuous improvement.