Published by Jackson Godwin | jacksontechnology.com.ng | info@jacksontechnology.com.ng
How to use this checklist This checklist covers all 93 controls across the four Annex A categories of ISO 27001:2022. For each control, use the checkbox column to mark progress during your audit. The Status column can be updated with: Compliant | Partial | Non-Compliant | N/A. Sample findings are provided to illustrate what non-compliance looks like in practice. Use this as a gap analysis tool, internal audit aid, or client-facing deliverable.
STATUS LEGEND
| ✓ Compliant | ~ Partial | ✗ Non-Compliant | N/A Not Applicable |
| A.5 | Organizational Controls (A.5.1 – A.5.37) |
| ✓ | Control | Description | Sample Finding | Status |
| ☐ | A.5.1 | Policies for Information Security | Policy not reviewed in 2+ years. | — |
| ☐ | A.5.2 | Information Security Roles & Responsibilities | Incident response roles not clearly defined. | — |
| ☐ | A.5.3 | Segregation of Duties (SoD) | Users hold developer and admin privileges simultaneously. | — |
| ☐ | A.5.4 | Management Responsibilities | No formal management oversight for security policies. | — |
| ☐ | A.5.5 | Contact with Authorities | No procedure for reporting breaches to regulatory bodies. | — |
| ☐ | A.5.6 | Contact with Special Interest Groups | No record of participation in security sharing forums. | — |
| ☐ | A.5.7 | Threat Intelligence | Threat intelligence not regularly collected or integrated. | — |
| ☐ | A.5.8 | Information Security in Project Management | Security risks not assessed during new project planning. | — |
| ☐ | A.5.9 | Inventory of Information & Associated Assets | Asset inventory excludes cloud-based storage locations. | — |
| ☐ | A.5.10 | Acceptable Use of Information & Assets | No tracking of employee compliance with AUP. | — |
| ☐ | A.5.11 | Return of Assets | Former employees retain access to corporate laptops. | — |
| ☐ | A.5.12 | Classification of Information | Customer financial data not classified by sensitivity. | — |
| ☐ | A.5.13 | Labeling of Information | Confidential files mislabeled, leading to unauthorized access. | — |
| ☐ | A.5.14 | Information Transfer | Sensitive data transferred via unencrypted email. | — |
| ☐ | A.5.15 | Access Control | Access permissions not reviewed; excessive privileges persist. | — |
| ☐ | A.5.16 | Identity Management | Inactive user accounts remain active, increasing risk. | — |
| ☐ | A.5.17 | Authentication Information | MFA not enforced for privileged accounts. | — |
| ☐ | A.5.18 | Access Rights | Former employees retain sensitive system access. | — |
| ☐ | A.5.19 | Information Security in Supplier Relationships | Vendor security assessments not conducted before onboarding. | — |
| ☐ | A.5.20 | Addressing IS in Supplier Agreements | Supplier contracts lack data protection clauses. | — |
| ☐ | A.5.21 | Managing IS in the ICT Supply Chain | No risk management process for third-party software vendors. | — |
| ☐ | A.5.22 | Monitoring, Review & Change Mgmt of Supplier Services | Third-party security controls not audited in over a year. | — |
| ☐ | A.5.23 | Information Security for Cloud Services | Cloud data not encrypted at rest, violating policy. | — |
| ☐ | A.5.24 | Incident Management Planning & Preparation | Incident response plan not tested in the last year. | — |
| ☐ | A.5.25 | Assessment & Decision on Information Security Events | No formal process to categorize security events by impact. | — |
| ☐ | A.5.26 | Response to Information Security Incidents | Incident response delayed due to unclear escalation procedures. | — |
| ☐ | A.5.27 | Learning from Information Security Incidents | No formal post-incident review process in place. | — |
| ☐ | A.5.28 | Collection of Evidence | Evidence collection procedures not followed, affecting forensics. | — |
| ☐ | A.5.29 | Information Security During Disruption | No security controls tested during last BCP exercise. | — |
| ☐ | A.5.30 | ICT Readiness for Business Continuity | Last DR test failed due to outdated backup configurations. | — |
| ☐ | A.5.31 | Legal, Statutory, Regulatory & Contractual Requirements | No documented process to monitor compliance with data laws. | — |
| ☐ | A.5.32 | Intellectual Property Rights (IPR) | Software licenses not actively monitored. | — |
| ☐ | A.5.33 | Protection of Records | Financial records inadequately protected per regulatory requirements. | — |
| ☐ | A.5.34 | Privacy & Protection of PII | Sensitive PII stored without encryption. | — |
| ☐ | A.5.35 | Independent Review of Information Security | Last independent security review conducted over two years ago. | — |
| ☐ | A.5.36 | Compliance with Policies, Rules & Standards | Employees not regularly tested for policy adherence. | — |
| ☐ | A.5.37 | Documented Operating Procedures | Critical operating procedures are outdated and unavailable to staff. | — |
| A.6 | People Controls (A.6.1 – A.6.8) |
| ✓ | Control | Description | Sample Finding | Status |
| ☐ | A.6.1 | Screening | No formal background screening for contract employees. | — |
| ☐ | A.6.2 | Terms & Conditions of Employment | Employment contracts do not specify security obligations. | — |
| ☐ | A.6.3 | Information Security Awareness, Education & Training | 40% of employees did not complete annual security training. | — |
| ☐ | A.6.4 | Disciplinary Process | No disciplinary actions taken for repeated password-sharing. | — |
| ☐ | A.6.5 | Responsibilities After Termination or Change of Employment | Some former employees retain access to applications post-exit. | — |
| ☐ | A.6.6 | Confidentiality / Non-Disclosure Agreements (NDAs) | NDAs not consistently reviewed or renewed for sensitive roles. | — |
| ☐ | A.6.7 | Remote Working | 20% of remote employees not using an approved VPN. | — |
| ☐ | A.6.8 | Information Security Event Reporting | Employees unaware of reporting process; delays in breach detection. | — |
| A.7 | Physical Controls (A.7.1 – A.7.14) |
| ✓ | Control | Description | Sample Finding | Status |
| ☐ | A.7.1 | Physical Security Perimeters | Perimeters not well-defined; unauthorized access to sensitive areas. | — |
| ☐ | A.7.2 | Physical Entry | Visitors granted access to critical areas without authorization. | — |
| ☐ | A.7.3 | Securing Offices, Rooms & Facilities | Secure room doors left unlocked during non-business hours. | — |
| ☐ | A.7.4 | Physical Security Monitoring | Security cameras covering key areas non-functional for weeks. | — |
| ☐ | A.7.5 | Protecting Against Physical & Environmental Threats | No fire suppression system installed in the data center. | — |
| ☐ | A.7.6 | Working in Secure Areas | Staff not consistently following badge identification policies. | — |
| ☐ | A.7.7 | Clear Desk & Clear Screen | Sensitive documents left visible on desks after business hours. | — |
| ☐ | A.7.8 | Equipment Siting & Protection | Server racks lack adequate physical security measures. | — |
| ☐ | A.7.9 | Security of Assets Off-Premises | Laptops taken off-site without encryption enabled. | — |
| ☐ | A.7.10 | Storage Media | Old hard drives not securely wiped before disposal. | — |
| ☐ | A.7.11 | Supporting Utilities | No backup power system for critical processing facilities. | — |
| ☐ | A.7.12 | Cabling Security | Exposed network cables increase risk of interception. | — |
| ☐ | A.7.13 | Equipment Maintenance | Biometric access controls not serviced in over a year. | — |
| ☐ | A.7.14 | Secure Disposal or Re-Use of Equipment | Sensitive data not erased from devices before disposal. | — |
| A.8 | Technological Controls (A.8.1 – A.8.34) |
| ✓ | Control | Description | Sample Finding | Status |
| ☐ | A.8.1 | User Endpoint Devices | Many endpoint devices lack full disk encryption. | — |
| ☐ | A.8.2 | Privileged Access Rights | Privileged accounts not reviewed in over six months. | — |
| ☐ | A.8.3 | Information Access Restriction | Employees retain access to sensitive data after role changes. | — |
| ☐ | A.8.4 | Access to Source Code | Developers have direct write access to production repositories. | — |
| ☐ | A.8.5 | Secure Authentication | MFA not enabled for all privileged accounts. | — |
| ☐ | A.8.6 | Capacity Management | Critical applications running at 90% capacity; availability at risk. | — |
| ☐ | A.8.7 | Protection Against Malware | Many workstations running outdated anti-malware software. | — |
| ☐ | A.8.8 | Management of Technical Vulnerabilities | Critical vulnerabilities unpatched for over 90 days. | — |
| ☐ | A.8.9 | Configuration Management | Production server configurations do not comply with baselines. | — |
| ☐ | A.8.10 | Information Deletion | Sensitive data not fully erased before decommissioning devices. | — |
| ☐ | A.8.11 | Data Masking | Production data used in test environments without anonymization. | — |
| ☐ | A.8.12 | Data Leakage Prevention | DLP rules for email exfiltration are not enforced. | — |
| ☐ | A.8.13 | Information Backup | Backups not regularly tested for recoverability. | — |
| ☐ | A.8.14 | Redundancy of Information Processing Facilities | No secondary data center exists for critical redundancy. | — |
| ☐ | A.8.15 | Logging | Security logging not enabled for some critical systems. | — |
| ☐ | A.8.16 | Monitoring Activities | No centralized logging system to detect security anomalies. | — |
| ☐ | A.8.17 | Clock Synchronization | Several systems show time discrepancies greater than five minutes. | — |
| ☐ | A.8.18 | Use of Privileged Utility Programs | Privileged users executed system commands without logging. | — |
| ☐ | A.8.19 | Installation of Software on Operational Systems | Unauthorized software found running on production systems. | — |
| ☐ | A.8.20 | Network Security | Network firewalls have outdated firmware exposing them to threats. | — |
| ☐ | A.8.21 | Security of Network Services | Third-party network services not assessed for security compliance. | — |
| ☐ | A.8.22 | Segregation of Networks | Payment processing systems not isolated from general user networks. | — |
| ☐ | A.8.23 | Web Filtering | Unrestricted access to social media and file-sharing sites. | — |
| ☐ | A.8.24 | Use of Cryptography | Encryption keys not rotated regularly. | — |
| ☐ | A.8.25 | Secure Development Lifecycle | Developers not trained on secure coding practices. | — |
| ☐ | A.8.26 | Application Security Requirements | Security requirements not considered before purchasing third-party software. | — |
| ☐ | A.8.27 | Secure System Architecture & Engineering Principles | Architecture does not follow least-privilege principle. | — |
| ☐ | A.8.28 | Secure Coding | Developers not consistently following secure coding standards. | — |
| ☐ | A.8.29 | Security Testing in Development & Acceptance | Critical applications deployed without undergoing security testing. | — |
| ☐ | A.8.30 | Outsourced Development | Outsourced development lacks security oversight. | — |
| ☐ | A.8.31 | Separation of Dev, Test & Production Environments | Testing and production environments not properly isolated. | — |
| ☐ | A.8.32 | Change Management | Unauthorized system changes made without formal approval. | — |
| ☐ | A.8.33 | Test Information | Sensitive production data used in testing without anonymization. | — |
| ☐ | A.8.34 | Protection of IS During Audit Testing | Audit testing performed on live production systems without safeguards. | — |
| Audit Summary Score Total Controls: 93 | Compliant: ___ | Partial: ___ | Non-Compliant: ___ | N/A: ___ Compliance Score: ____% | Audit Date: ____________ | Auditor: ______________________ |
Jackson Technology | Cybersecurity & Data Protection Consulting | Abuja, Nigeria
This checklist is provided for informational and audit preparation purposes only. For certification audits, engage an accredited ISO 27001 certification body.