Back to Details

isms-audit-expert

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

ISMS Audit Expert

ISMS审计专家

Internal and external ISMS audit management for ISO 27001 compliance verification, security control assessment, and certification support.
用于ISO 27001合规性验证、安全控制评估及认证支持的内部与外部ISMS审计管理。

Table of Contents

目录

Audit Program Management

审计计划管理

Risk-Based Audit Schedule

基于风险的审计计划

Risk LevelAudit FrequencyExamples
CriticalQuarterlyPrivileged access, vulnerability management, logging
HighSemi-annualAccess control, incident response, encryption
MediumAnnualPolicies, awareness training, physical security
LowAnnualDocumentation, asset inventory
风险等级审计频率示例
关键季度特权访问、漏洞管理、日志记录
高半年访问控制、事件响应、加密
中年度政策、意识培训、物理安全
低年度文档、资产清单

Annual Audit Planning Workflow

年度审计规划流程

  1. Review previous audit findings and risk assessment results
  2. Identify high-risk controls and recent security incidents
  3. Determine audit scope based on ISMS boundaries
  4. Assign auditors ensuring independence from audited areas
  5. Create audit schedule with resource allocation
  6. Obtain management approval for audit plan
  7. Validation: Audit plan covers all Annex A controls within certification cycle
  1. 回顾以往审计发现和风险评估结果
  2. 识别高风险控制措施和近期安全事件
  3. 根据ISMS边界确定审计范围
  4. 分配审计人员，确保其与被审计领域独立
  5. 创建包含资源分配的审计计划
  6. 获取管理层对审计计划的批准
  7. 验证： 审计计划覆盖认证周期内的所有Annex A控制措施

Auditor Competency Requirements

审计人员能力要求

  • ISO 27001 Lead Auditor certification (preferred)
  • No operational responsibility for audited processes
  • Understanding of technical security controls
  • Knowledge of applicable regulations (GDPR, HIPAA)
  • 具备ISO 27001主任审计师认证（优先）
  • 对被审计流程无运营职责
  • 了解技术安全控制措施
  • 熟悉适用法规（GDPR、HIPAA）

Audit Execution

审计执行

Pre-Audit Preparation

审计前准备

  1. Review ISMS documentation (policies, SoA, risk assessment)
  2. Analyze previous audit reports and open findings
  3. Prepare audit plan with interview schedule
  4. Notify auditees of audit scope and timing
  5. Prepare checklists for controls in scope
  6. Validation: All documentation received and reviewed before opening meeting
  1. 审阅ISMS文档（政策、SoA、风险评估报告）
  2. 分析以往审计报告和未闭环的问题
  3. 制定包含访谈日程的审计计划
  4. 通知被审计方审计范围和时间安排
  5. 为范围内的控制措施准备检查清单
  6. 验证： 首次会议前已接收并审阅所有文档

Audit Conduct Steps

审计执行步骤

  1. Opening Meeting
    • Confirm audit scope and objectives
    • Introduce audit team and methodology
    • Agree on communication channels and logistics
  2. Evidence Collection
    • Interview control owners and operators
    • Review documentation and records
    • Observe processes in operation
    • Inspect technical configurations
  3. Control Verification
    • Test control design (does it address the risk?)
    • Test control operation (is it working as intended?)
    • Sample transactions and records
    • Document all evidence collected
  4. Closing Meeting
    • Present preliminary findings
    • Clarify any factual inaccuracies
    • Agree on finding classification
    • Confirm corrective action timelines
  5. Validation: All controls in scope assessed with documented evidence
  1. 首次会议
    • 确认审计范围和目标
    • 介绍审计团队和方法
    • 商定沟通渠道和后勤安排
  2. 证据收集
    • 访谈控制措施负责人和操作人员
    • 审阅文档和记录
    • 观察流程运行情况
    • 检查技术配置
  3. 控制措施验证
    • 测试控制设计（是否能应对风险？）
    • 测试控制运行（是否按预期工作？）
    • 抽样检查交易和记录
    • 记录所有收集到的证据
  4. 末次会议
    • 展示初步审计发现
    • 澄清任何事实不准确之处
    • 商定问题分类
    • 确认纠正措施时间线
  5. 验证： 范围内的所有控制措施均已通过记录的证据进行评估

Evidence Collection Methods

证据收集方法

MethodUse CaseExample
InquiryProcess understandingInterview Security Manager about incident response
ObservationOperational verificationWatch visitor sign-in process
InspectionDocumentation reviewCheck access approval records
Re-performanceControl testingAttempt login with weak password
方法使用场景示例
询问流程理解访谈安全经理了解事件响应流程
观察运行验证查看访客登记流程
检查文档审阅检查访问审批记录
重新执行控制测试尝试使用弱密码登录

Control Assessment

控制评估

ISO 27002 Control Categories

ISO 27002控制类别

Organizational Controls (A.5):
  • Information security policies
  • Roles and responsibilities
  • Segregation of duties
  • Contact with authorities
  • Threat intelligence
  • Information security in projects
People Controls (A.6):
  • Screening and background checks
  • Employment terms and conditions
  • Security awareness and training
  • Disciplinary process
  • Remote working security
Physical Controls (A.7):
  • Physical security perimeters
  • Physical entry controls
  • Securing offices and facilities
  • Physical security monitoring
  • Equipment protection
Technological Controls (A.8):
  • User endpoint devices
  • Privileged access rights
  • Access restriction
  • Secure authentication
  • Malware protection
  • Vulnerability management
  • Backup and recovery
  • Logging and monitoring
  • Network security
  • Cryptography
组织控制（A.5）：
  • 信息安全政策
  • 角色与职责
  • 职责分离
  • 与主管部门的联系
  • 威胁情报
  • 项目中的信息安全
人员控制（A.6）：
  • 筛选与背景调查
  • 雇佣条款与条件
  • 安全意识与培训
  • 纪律流程
  • 远程办公安全
物理控制（A.7）：
  • 物理安全边界
  • 物理进入控制
  • 办公场所与设施安全
  • 物理安全监控
  • 设备保护
技术控制（A.8）：
  • 用户终端设备
  • 特权访问权限
  • 访问限制
  • 安全认证
  • 恶意软件防护
  • 漏洞管理
  • 备份与恢复
  • 日志与监控
  • 网络安全
  • 加密技术

Control Testing Approach

控制测试方法

  1. Identify control objective from ISO 27002
  2. Determine testing method (inquiry, observation, inspection, re-performance)
  3. Define sample size based on population and risk
  4. Execute test and document results
  5. Evaluate control effectiveness
  6. Validation: Evidence supports conclusion about control status
  1. 从ISO 27002中识别控制目标
  2. 确定测试方法（询问、观察、检查、重新执行）
  3. 根据总体数量和风险定义样本量
  4. 执行测试并记录结果
  5. 评估控制措施有效性
  6. 验证： 证据支持关于控制状态的结论

Finding Management

问题管理

Finding Classification

问题分类

SeverityDefinitionResponse Time
Major NonconformityControl failure creating significant risk30 days
Minor NonconformityIsolated deviation with limited impact90 days
ObservationImprovement opportunityNext audit cycle
严重程度定义响应时间
重大不符合项控制措施失效，带来重大风险30天
轻微不符合项孤立偏差，影响有限90天
观察项改进机会下一审计周期

Finding Documentation Template

问题文档模板

Finding ID: ISMS-[YEAR]-[NUMBER]
Control Reference: A.X.X - [Control Name]
Severity: [Major/Minor/Observation]

Evidence:
- [Specific evidence observed]
- [Records reviewed]
- [Interview statements]

Risk Impact:
- [Potential consequences if not addressed]

Root Cause:
- [Why the nonconformity occurred]

Recommendation:
- [Specific corrective action steps]
Finding ID: ISMS-[YEAR]-[NUMBER]
Control Reference: A.X.X - [Control Name]
Severity: [Major/Minor/Observation]

Evidence:
- [Specific evidence observed]
- [Records reviewed]
- [Interview statements]

Risk Impact:
- [Potential consequences if not addressed]

Root Cause:
- [Why the nonconformity occurred]

Recommendation:
- [Specific corrective action steps]

Corrective Action Workflow

纠正措施流程

  1. Auditee acknowledges finding and severity
  2. Root cause analysis completed within 10 days
  3. Corrective action plan submitted with target dates
  4. Actions implemented by responsible parties
  5. Auditor verifies effectiveness of corrections
  6. Finding closed with evidence of resolution
  7. Validation: Root cause addressed, recurrence prevented
  1. 被审计方确认问题及其严重程度
  2. 10天内完成根本原因分析
  3. 提交包含目标日期的纠正行动计划
  4. 责任方实施措施
  5. 审计人员验证纠正措施的有效性
  6. 问题通过解决证据闭环
  7. 验证： 根本原因已解决，防止复发

Certification Support

认证支持

Stage 1 Audit Preparation

第一阶段审计准备

Ensure documentation is complete:
  • ISMS scope statement
  • Information security policy (management signed)
  • Statement of Applicability
  • Risk assessment methodology and results
  • Risk treatment plan
  • Internal audit results (past 12 months)
  • Management review minutes
确保文档完整：
  • ISMS范围声明
  • 信息安全政策（管理层签署）
  • 适用性声明（SoA）
  • 风险评估方法及结果
  • 风险处理计划
  • 内部审计结果（过去12个月）
  • 管理层评审会议纪要

Stage 2 Audit Preparation

第二阶段审计准备

Verify operational readiness:
  • All Stage 1 findings addressed
  • ISMS operational for minimum 3 months
  • Evidence of control implementation
  • Security awareness training records
  • Incident response evidence (if applicable)
  • Access review documentation
验证运营就绪情况：
  • 所有第一阶段问题已解决
  • ISMS已运行至少3个月
  • 控制措施实施的证据
  • 安全意识培训记录
  • 事件响应证据（如适用）
  • 访问审阅文档

Surveillance Audit Cycle

监督审计周期

PeriodFocus
Year 1, Q2High-risk controls, Stage 2 findings follow-up
Year 1, Q4Continual improvement, control sample
Year 2, Q2Full surveillance
Year 2, Q4Re-certification preparation
Validation: No major nonconformities at surveillance audits.
周期重点
第1年第2季度高风险控制措施、第二阶段问题跟进
第1年第4季度持续改进、控制措施抽样
第2年第2季度全面监督审计
第2年第4季度重新认证准备
验证： 监督审计中无重大不符合项。

Tools

工具

scripts/

scripts/

ScriptPurposeUsage
isms_audit_scheduler.py
Generate risk-based audit plans
python scripts/isms_audit_scheduler.py --year 2025 --format markdown
脚本用途使用方法
isms_audit_scheduler.py
生成基于风险的审计计划
python scripts/isms_audit_scheduler.py --year 2025 --format markdown

Audit Planning Example

审计计划示例

bash
undefined
bash
undefined

Generate annual audit plan

Generate annual audit plan

python scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json
python scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json

With custom control risk ratings

With custom control risk ratings

python scripts/isms_audit_scheduler.py --controls controls.csv --format markdown

---
python scripts/isms_audit_scheduler.py --controls controls.csv --format markdown

---

References

参考资料

FileContent
iso27001-audit-methodology.mdAudit program structure, pre-audit phase, certification support
security-control-testing.mdTechnical verification procedures for ISO 27002 controls
cloud-security-audit.mdCloud provider assessment, configuration security, IAM review
文件内容
iso27001-audit-methodology.md审计计划结构、审计前阶段、认证支持
security-control-testing.mdISO 27002控制措施的技术验证流程
cloud-security-audit.md云服务商评估、配置安全、IAM审阅

Audit Performance Metrics

审计绩效指标

KPITargetMeasurement
Audit plan completion100%Audits completed vs. planned
Finding closure rate>90% within SLAClosed on time vs. total
Major nonconformities0 at certificationCount per certification cycle
Audit effectivenessIncidents preventedSecurity improvements implemented
KPI目标衡量方式
审计计划完成率100%已完成审计数 vs 计划审计数
问题闭环率SLA内>90%按时闭环数 vs 总数
重大不符合项数认证时为0每认证周期的数量
审计有效性预防事件发生已实施的安全改进措施

Compliance Framework Integration

合规框架整合

FrameworkISMS Audit Relevance
GDPRA.5.34 Privacy, A.8.10 Information deletion
HIPAAAccess controls, audit logging, encryption
PCI DSSNetwork security, access control, monitoring
SOC 2Trust Services Criteria mapped to ISO 27002
框架ISMS审计相关性
GDPRA.5.34隐私、A.8.10信息删除
HIPAA访问控制、审计日志、加密
PCI DSS网络安全、访问控制、监控
SOC 2映射至ISO 27002的信任服务准则