ISO 27001 Annex A 5.27 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 5.27 Learning from information security incidents

1. Post-Incident Review (PIR) Methodology Formalised

Verification Criteria: A documented procedure defines the requirement for a formal review following any significant security incident, specifying participants and reporting formats.

Required Evidence: Approved Incident Management Policy or a dedicated Post-Incident Review Procedure.

Pass/Fail Test: If the organisation cannot produce a documented requirement to conduct a PIR for “Major” incidents, mark as Non-Compliant.

2. Root Cause Analysis (RCA) Execution Verified

Verification Criteria: Closed incident records demonstrate that a technical or organisational root cause was identified, moving beyond immediate symptoms.

Required Evidence: Sample of three Post-Incident Review reports showing “Root Cause” findings (e.g., 5 Whys, Fishbone diagram).

Pass/Fail Test: If incident tickets are closed with only “Resolved” status without a recorded root cause, mark as Non-Compliant.

3. Corrective Action Tracking Integrity Confirmed

Verification Criteria: Identified improvements from incident reviews are assigned to owners with specific deadlines and tracked to completion.

Required Evidence: CAPA (Corrective and Preventive Action) log or a Jira/ServiceNow board showing PIR-linked tasks.

Pass/Fail Test: If corrective actions from the last six months remain “In Progress” without an authorised extension or justification, mark as Non-Compliant.

4. Cross-Incident Trend Analysis Records Identified

Verification Criteria: Periodic analysis of incident data is performed to identify recurring patterns, such as repeated human error or specific technical vulnerabilities.

Required Evidence: Quarterly Security Performance reports or Management Review Meeting (MRM) minutes showing trend analysis data.

Pass/Fail Test: If the organisation only manages incidents in isolation and lacks an aggregated “Trend Report,” mark as Non-Compliant.

5. Knowledge Sharing and Awareness Integration Verified

Verification Criteria: Lessons learned from past incidents are anonymised and integrated into the security awareness programme to prevent recurrence.

Required Evidence: Updated training slides, internal security newsletters, or briefing notes citing “Lessons Learned.”

Pass/Fail Test: If staff training material has not been updated in response to a major internal security incident, mark as Non-Compliant.

6. ISMS Policy and Procedure Revision Confirmed

Verification Criteria: Evidence exists that security policies or technical procedures were modified specifically as a result of an incident review.

Required Evidence: Policy version history (changelogs) showing updates triggered by a specific Incident ID or PIR finding.

Pass/Fail Test: If a root cause was identified as “Policy Ambiguity” but the relevant policy remains unchanged, mark as Non-Compliant.

7. Management Review of Incident Learning Validated

Verification Criteria: Top management reviews the outcomes of incident analyses and approves the necessary resources for significant ISMS improvements.

Required Evidence: Board-level minutes or Management Review records confirming discussion of incident “Lessons Learned.”

Pass/Fail Test: If Top Management is only informed of incident counts and not the qualitative learnings/improvements, mark as Non-Compliant.

8. Internal Knowledge Base Population Confirmed

Verification Criteria: A centralised repository of historical incident data and remediation steps is available to the technical response team.

Required Evidence: Access to a “Security Knowledge Base,” Wiki, or a structured historical incident database.

Pass/Fail Test: If the technical response to an incident relies entirely on the memory of senior staff without a formal knowledge base, mark as Non-Compliant.

9. Incident Response Playbook Updating Verified

Verification Criteria: Technical incident response playbooks are adjusted based on the effectiveness of the response actions during previous events.

Required Evidence: Updated Incident Response Playbooks (e.g., Malware Playbook, Ransomware Playbook) with revision notes.

Pass/Fail Test: If a response action was found to be ineffective during a live incident but the Playbook still recommends that action, mark as Non-Compliant.

10. Resource Adequacy Post-Incident Review Confirmed

Verification Criteria: The organisation evaluates whether the available resources (budget, tools, personnel) were sufficient to manage the incident effectively.

Required Evidence: PIR report section titled “Resource Adequacy” or subsequent budget requests for security tooling upgrades.

Pass/Fail Test: If an incident failed to be contained due to a lack of tooling, but no subsequent resource request was formally submitted, mark as Non-Compliant.

About the author