ISO 27001 for Auditors: What to Ask, Clause by Clause
Every ISO 27001 explainer is written for implementers. This one is written for auditors: what to ask at each clause, and what a broken answer looks like.
What Is an ISMS? Information Security Management System
An ISMS is the management system for information security risk, not a set of controls. What it contains, what makes one real, and how an auditor tests it.
ISO 27001 Audit Evidence: Which Record for Which Clause
What evidence to ask for at each ISO 27001 clause, who holds it, and what the record has to show. Plus why the best evidence is rarely the document offered.
ISO 27001 Clause Map: Which Clause Do You Cite?
One page mapping every ISO 27001 sub-clause to what it requires and the failure that belongs to it, plus the clause pairs candidates most often confuse.
Auditing ISO 27001 Clause 10: Corrective Action
How to audit ISO 27001 Clause 10: what 10.2 actually requires, why corrective action is not mandatory in every case, and what closes a nonconformity.
Auditing ISO 27001 Clause 9: Performance Evaluation
How to audit ISO 27001 Clause 9: what monitoring must produce, the internal audit programme requirements, the management review inputs, and worked findings.
Auditing ISO 27001 Clause 8: Operation in Practice
How to audit ISO 27001 Clause 8: process criteria, externally provided services, and the 6-versus-8 distinction that decides which clause a finding belongs to.
The ISO 27000 Family: Which Standard Does What
ISO 27001, 27002, 27005, 27006-1, 27007 and the rest: which are requirements, which are guidance, which an auditor needs, and which you would ever buy.
