← All templates
ISO 27001:2022
International standard for information security management systems (ISMS). Covers 93 controls across 4 themes.
33 questions·Version 2022
Organisational Controls
- Do you have a documented information security policy approved by management?A.5.1
- Are information security roles and responsibilities clearly defined?A.5.2
- Do you have a process for managing information security in supplier relationships?A.5.19
- Do you have a documented acceptable use policy for information assets?A.5.10
- Is there a process for reporting information security events?A.5.24
- Do you have a documented business continuity management process?A.5.29
People Controls
- Are background verification checks conducted for all new employees?A.6.1
- Do employees receive information security training during onboarding?A.6.3
- Is there a disciplinary process for information security policy violations?A.6.4
- Are information security responsibilities enforced upon termination?A.6.5
Physical Controls
- Are physical security perimeters defined to protect sensitive areas?A.7.1
- Is physical access to sensitive areas controlled and logged?A.7.2
- Is equipment protected against physical threats and environmental hazards?A.7.8
- Is there a clear desk and clear screen policy?A.7.7
Technological Controls
- Is user endpoint access controlled through an access management process?A.8.1
- Is privileged access rights management documented and reviewed regularly?A.8.2
- Is all sensitive information encrypted in storage and transit?A.8.24
- Do you have malware protection on all endpoints?A.8.7
- Do you conduct regular backups and test restores?A.8.13
- Is there a process for managing technical vulnerabilities?A.8.8
- Are audit logs collected and protected from tampering?A.8.15
- Is network traffic monitored for anomalies?A.8.16
- Are networks segregated to reduce unauthorised access?A.8.22
- Do you have web filtering and application controls in place?A.8.23
Risk Management
- Do you conduct a formal information security risk assessment?Clause 6.1
- Is the risk assessment process documented and repeatable?Clause 6.1
- Do you maintain a risk treatment plan?Clause 6.1
Compliance
- Do you identify and document applicable legal and regulatory requirements?A.5.31
- Are intellectual property rights respected and documented?A.5.32
- Do you conduct regular internal audits of your ISMS?Clause 9.2
Certification
- Do you hold a current ISO 27001 certification?Clause 10
- When does your current ISO 27001 certification expire?Clause 10
- Can you provide a copy of your ISO 27001 certificate?Clause 10
Send this questionnaire to your vendors
VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.