Auditing ISO 27001 Clause 7: Competence and Documents
How to audit ISO 27001 Clause 7: competence evidence, why awareness is not training, the document control tests that find things, and worked nonconformities.
ISO 27001 Clause 6.3: Planning of Changes Explained
Clause 6.3 was added in the 2022 revision and is one sentence long. What it requires, how it differs from A.8.32 change management, and how it is audited.
Auditing ISO 27001 Clause 6: Risk and Objectives
How to audit ISO 27001 Clause 6: the seven-step risk trail, which sub-clause letter each break belongs to, sampling strategy and worked nonconformities.
Auditing ISO 27001 Clause 5: Leadership and Policy
How to audit ISO 27001 Clause 5: evidencing top management commitment through other clauses, the seven things a policy must do, and worked findings.
Auditing ISO 27001 Clause 4: Context and Scope
How to audit ISO 27001 Clause 4: the trail through 4.1 to 4.4, what evidence to ask for, worked nonconformities, and how scope findings are graded.
Six ISO 27001 Myths That Cost Candidates Marks
Six misconceptions that reliably produce wrong answers in the ISO 27001 Lead Auditor exam, what the standard actually says, and how each one shows up.
Threat, Vulnerability, Asset and Control Explained
Asset, threat, vulnerability, risk, control: the chain an ISMS auditor follows, what each word means precisely, and what a break anywhere in it tells you.
CIA Triad in an ISMS Audit: What Each One Means
Confidentiality, integrity and availability are the definition of information security. What each means, why they conflict, and how an auditor uses them.
