0ab2f8ef85
- Rewrite SKILL.md with proper structure (288 lines)
- Add trigger phrases to frontmatter
- Add Table of Contents
- Remove ASCII art tree structures, use bullet lists
- Standardize terminology to "ISMS audit" as primary term
- Remove marketing language ("expert-level", "comprehensive", "proven")
- Add validation steps after workflows
- Create real reference files:
- iso27001-audit-methodology.md - Audit program, pre-audit, certification
- security-control-testing.md - ISO 27002 control verification procedures
- cloud-security-audit.md - Cloud provider and configuration assessment
- Create real Python script:
- isms_audit_scheduler.py - Risk-based audit planning tool
- Delete placeholder files (example.py, api_reference.md, example_asset.txt)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
7.0 KiB
7.0 KiB
Security Control Testing Guide
Technical verification procedures for ISO 27002 control assessment.
Table of Contents
- Control Testing Approach
- Organizational Controls (A.5)
- People Controls (A.6)
- Physical Controls (A.7)
- Technological Controls (A.8)
Control Testing Approach
Testing Methods
| Method | Description | When to Use |
|---|---|---|
| Inquiry | Interview control owners | All controls |
| Observation | Watch process execution | Operational controls |
| Inspection | Review documentation/config | Policy controls |
| Re-performance | Execute control procedure | Critical controls |
Sampling Guidelines
| Population Size | Sample Size |
|---|---|
| 1-10 | All items |
| 11-50 | 10 items |
| 51-250 | 15 items |
| 251+ | 25 items |
Organizational Controls (A.5)
A.5.1 - Policies for Information Security
Test Procedure:
- Obtain current information security policy
- Verify management signature and approval date
- Check policy is accessible to all employees
- Confirm review within past 12 months
- Sample 5 employees: verify awareness of policy location
Evidence Required:
- Signed policy document
- Intranet/portal screenshot showing policy access
- Policy review meeting minutes
- Employee acknowledgment records
A.5.15 - Access Control
Test Procedure:
- Obtain access control policy
- Select sample of 10 user accounts
- Verify access rights match job descriptions
- Check for segregation of duties violations
- Verify access provisioning follows documented process
Evidence Required:
- Access control policy
- User access matrix
- Access request forms with approvals
- Role definitions
A.5.24 - Information Security Incident Management
Test Procedure:
- Review incident management procedure
- Select 3 recent incidents from log
- Verify incidents followed documented process
- Check escalation thresholds were respected
- Confirm lessons learned were documented
Evidence Required:
- Incident response procedure
- Incident tickets with timeline
- Escalation records
- Post-incident review reports
People Controls (A.6)
A.6.1 - Screening
Test Procedure:
- Review background check policy
- Select 10 recent hires
- Verify background checks completed before start
- Check checks match role sensitivity level
- Confirm records are securely stored
Evidence Required:
- Screening policy
- Background check completion records
- Role risk classification matrix
A.6.3 - Information Security Awareness
Test Procedure:
- Obtain training program documentation
- Select sample of 15 employees
- Verify training completion records
- Review training content for currency
- Check phishing simulation results
Evidence Required:
- Training materials and schedule
- LMS completion reports
- Phishing test results
- Training effectiveness metrics
A.6.7 - Remote Working
Test Procedure:
- Review remote working policy
- Verify VPN is required for remote access
- Sample 5 remote worker devices for compliance
- Check endpoint protection is active
- Verify secure data handling requirements
Evidence Required:
- Remote working policy
- VPN connection logs
- Endpoint compliance reports
- Remote access agreement signatures
Physical Controls (A.7)
A.7.1 - Physical Security Perimeters
Test Procedure:
- Walk perimeter of secure areas
- Verify access controls at all entry points
- Check visitor management process
- Review after-hours access logs
- Confirm emergency exits are secure
Evidence Required:
- Site security plan
- Access control system configuration
- Visitor logs
- Guard tour records
A.7.4 - Physical Security Monitoring
Test Procedure:
- Verify CCTV coverage of critical areas
- Check recording retention period
- Review sample of recent alert responses
- Confirm monitoring is 24/7 or as required
- Verify footage protection and access controls
Evidence Required:
- CCTV coverage map
- Retention policy and settings
- Alert response records
- Access logs for footage viewing
Technological Controls (A.8)
A.8.2 - Privileged Access Rights
Test Procedure:
- Obtain list of privileged accounts
- Verify each has documented justification
- Check separation of admin and user accounts
- Confirm MFA is required for privileged access
- Review privileged activity logs
Evidence Required:
- Privileged account inventory
- Access justification records
- PAM solution configuration
- Activity audit logs
A.8.5 - Secure Authentication
Test Procedure:
- Review password policy configuration
- Verify MFA enrollment rates
- Test account lockout after failed attempts
- Check authentication logging
- Verify secure authentication protocols (no plaintext)
Evidence Required:
- Password policy settings screenshot
- MFA enrollment report
- Account lockout configuration
- Authentication audit logs
A.8.7 - Protection Against Malware
Test Procedure:
- Verify endpoint protection coverage
- Check definition update frequency
- Review quarantine/detection logs
- Confirm central management console
- Test sample detection (EICAR)
Evidence Required:
- Endpoint protection deployment report
- Update status dashboard
- Detection/quarantine logs
- EICAR test results
A.8.8 - Management of Technical Vulnerabilities
Test Procedure:
- Obtain vulnerability scanning schedule
- Review recent scan results
- Verify critical vulnerabilities patched within SLA
- Check vulnerability tracking system
- Sample 5 critical findings for remediation evidence
Evidence Required:
- Scanning schedule and scope
- Scan reports with severity breakdown
- Patch deployment records
- Remediation tracking tickets
A.8.13 - Information Backup
Test Procedure:
- Review backup policy and schedule
- Verify backup completion logs
- Check encryption of backup data
- Request recent restoration test results
- Verify offsite/cloud backup location
Evidence Required:
- Backup policy
- Backup job completion logs
- Encryption configuration
- Restoration test records
A.8.15 - Logging
Test Procedure:
- Identify systems requiring logging
- Verify logging is enabled and configured
- Check log retention meets requirements
- Confirm log integrity protection
- Verify SIEM integration and alerting
Evidence Required:
- Logging requirements matrix
- Log configuration screenshots
- Retention settings
- SIEM alert rules
A.8.24 - Use of Cryptography
Test Procedure:
- Review cryptography policy
- Verify encryption at rest configuration
- Check TLS configuration (version, ciphers)
- Review key management procedures
- Verify certificate inventory and expiration tracking
Evidence Required:
- Cryptography policy
- Encryption configuration settings
- SSL/TLS scan results
- Key management procedures
- Certificate inventory