ISO/IEC 27001

⌘K
  2. Home
  4. Docs
  6. ISO/IEC 27001
  8. Other Doc
  10. Security Compliance Checklist

Security Compliance Checklist

1. Purpose

The Information Security Compliance Checklist provides a structured method for reviewing whether the organization’s information-security requirements, controls, policies, and operational practices are implemented and supported by appropriate evidence.

It can be used for:

  • Periodic compliance reviews
  • ISO/IEC 27001 readiness
  • Internal assessments
  • Control monitoring
  • Customer security reviews
  • Supplier assessments
  • Security governance reviews
  • Audit preparation
  • Management reporting

Core Principle

Requirement → Control → Implementation → Evidence → Test → Finding → Corrective Action → Verification

2. Assessment Information

FieldDetails
Assessment ID
Organization
Assessment Period
ISMS Scope
Reviewer
Business Owner
Security Owner
Assessment Date
Framework/Standard
Previous Assessment
Overall Status
Next Review Date

3. Assessment Status

Use the following status for each checklist item:

☐ Compliant
☐ Partially Compliant
☐ Non-Compliant
☐ Not Applicable
☐ Evidence Required
☐ Under Remediation

Evidence Status

☐ Evidence Available
☐ Evidence Incomplete
☐ Evidence Not Available
☐ Evidence Requires Validation

4. Governance and Security Management

CheckStatusEvidence / Comments
Information-security policy approved☐
Policy is current☐
Security responsibilities defined☐
Security roles assigned☐
ISMS scope documented☐
ISMS objectives defined☐
Security responsibilities communicated☐
Security governance meetings conducted☐
Security performance monitored☐
Management oversight established☐
Security improvement activities tracked☐

5. ISMS Scope

Verify:

☐ Organizational boundaries defined
☐ Locations identified
☐ Business processes identified
☐ Systems identified
☐ Technology environment identified
☐ Relevant interfaces identified
☐ Suppliers considered
☐ Cloud services considered
☐ Exclusions documented where applicable
☐ Scope remains appropriate after organizational changes

Evidence

6. Information Security Risk Management

☐ Risk-management methodology approved
☐ Risk criteria defined
☐ Assets/processes considered
☐ Threats considered
☐ Vulnerabilities considered
☐ Business impact assessed
☐ Likelihood assessed
☐ Risk levels determined
☐ Risk owners assigned
☐ Risk treatment documented
☐ Residual risk assessed
☐ Risk acceptance documented where applicable
☐ Risk register current
☐ Significant changes trigger reassessment

Evidence

7. Statement of Applicability

Verify:

☐ SoA exists
☐ Applicable controls identified
☐ Control applicability justified
☐ Control implementation status recorded
☐ Necessary controls outside Annex A considered
☐ Risk-treatment controls reflected
☐ Control owners identified where appropriate
☐ SoA is current
☐ Changes to risks are reflected

8. Asset Management

☐ Information assets identified
☐ Systems identified
☐ Applications identified
☐ Cloud resources identified
☐ Devices identified
☐ Data repositories identified
☐ Asset owners assigned
☐ Critical assets identified
☐ Asset inventory maintained
☐ Asset changes reflected
☐ Unsupported/obsolete assets identified

9. Information Classification

☐ Classification scheme defined
☐ Information owners identified
☐ Sensitive information identified
☐ Confidential information identified
☐ Restricted information identified
☐ Classification rules communicated
☐ Handling requirements defined
☐ Access aligned with classification
☐ Transfer requirements defined
☐ Retention requirements defined
☐ Disposal requirements defined

10. Access Control

☐ Access-control policy approved
☐ User accounts uniquely assigned
☐ Access based on business need
☐ Least privilege applied
☐ Access approval documented
☐ Access changes controlled
☐ Terminated users removed promptly
☐ Dormant accounts reviewed
☐ Shared accounts controlled
☐ Service accounts controlled
☐ Periodic access reviews completed
☐ Supplier access reviewed

11. Privileged Access

☐ Privileged accounts identified
☐ Business justification documented
☐ Named administrator accounts used
☐ MFA enabled
☐ Privileged access limited
☐ Administrative activity logged where appropriate
☐ Privileged access reviewed
☐ Temporary privileged access controlled
☐ Emergency access controlled
☐ Privileged access revoked when no longer required

12. Authentication and MFA

☐ Authentication requirements defined
☐ MFA implemented where required
☐ Strong authentication used
☐ Password requirements defined where passwords are used
☐ Default credentials removed
☐ Authentication events logged where appropriate
☐ SSO used where appropriate
☐ Recovery mechanisms protected
☐ Authentication secrets protected
☐ Service credentials controlled

13. Joiner, Mover and Leaver Controls

Joiner

☐ Access approval completed
☐ Required accounts created
☐ Appropriate access assigned
☐ Security training completed

Mover

☐ Previous access reviewed
☐ New access approved
☐ Unnecessary access removed

Leaver

☐ Accounts disabled
☐ Privileged access revoked
☐ VPN access removed
☐ Cloud access removed
☐ SaaS access removed
☐ Assets returned
☐ Secrets addressed where necessary

14. Remote Access

☐ Remote-access policy defined
☐ MFA enabled
☐ VPN/secure access used where appropriate
☐ Device security requirements defined
☐ Access limited to business need
☐ Privileged remote access controlled
☐ Remote access logged where appropriate
☐ Supplier remote access controlled

15. Cloud Security

☐ Cloud services identified
☐ Cloud providers assessed
☐ Cloud responsibilities defined
☐ Cloud accounts/subscriptions inventoried
☐ IAM reviewed
☐ MFA enabled
☐ Privileged access controlled
☐ Network security configured
☐ Encryption implemented where appropriate
☐ Logging enabled
☐ Monitoring enabled
☐ Backup configured
☐ Public exposure reviewed
☐ Cloud configuration reviewed
☐ Cloud exit arrangements considered

16. Network Security

☐ Network architecture documented
☐ Network segmentation implemented where appropriate
☐ Firewalls configured
☐ Security groups reviewed
☐ Internet exposure assessed
☐ Administrative access restricted
☐ Remote access secured
☐ Network monitoring implemented
☐ Unnecessary services disabled
☐ Network changes controlled

17. Endpoint Security

☐ Corporate devices identified
☐ Device security baseline defined
☐ Supported operating systems used
☐ Security updates applied
☐ Endpoint protection implemented where appropriate
☐ Disk encryption implemented where required
☐ Device management implemented where appropriate
☐ Local administrator access controlled
☐ Lost/stolen devices addressed
☐ Device disposal controlled

18. Application Security

☐ Secure development requirements defined
☐ Security requirements identified
☐ Code review performed where appropriate
☐ Security testing performed
☐ Vulnerability testing performed
☐ Dependencies reviewed
☐ Secrets protected
☐ Production changes controlled
☐ Security defects tracked
☐ Application releases controlled

19. Source Code Security

☐ Source-code repositories identified
☐ Repository access restricted
☐ MFA enabled
☐ Branch protection implemented where appropriate
☐ Code review required
☐ Production deployment controlled
☐ Secrets scanning implemented where appropriate
☐ Repository activity logged
☐ Former employee access removed
☐ Third-party developer access reviewed

20. Vulnerability Management

☐ Vulnerability-management process defined
☐ Vulnerability scanning performed
☐ Critical vulnerabilities identified
☐ High-risk vulnerabilities identified
☐ Vulnerabilities prioritized
☐ Remediation deadlines defined
☐ Exceptions documented
☐ Remediation tracked
☐ Retesting performed
☐ Vulnerability trends reviewed

Metrics

MetricResult
Critical vulnerabilities
High vulnerabilities
Overdue vulnerabilities
Average remediation time
Patch compliance

21. Patch Management

☐ Patch requirements defined
☐ Operating-system patches monitored
☐ Application patches monitored
☐ Critical patches prioritized
☐ Emergency patching process defined
☐ Patch exceptions documented
☐ Patch status reported
☐ Unsupported software identified

22. Malware Protection

☐ Malware protection implemented where appropriate
☐ Endpoint security monitored
☐ Malware alerts investigated
☐ Malware incidents recorded
☐ Security updates maintained
☐ Suspicious files/processes investigated
☐ Removable-media controls considered

23. Logging and Monitoring

☐ Security logging requirements defined
☐ Authentication events monitored
☐ Privileged activity monitored where appropriate
☐ Administrative events monitored
☐ Security alerts configured
☐ Cloud activity monitored
☐ Critical application events monitored
☐ Logs protected from unauthorized modification
☐ Log retention defined
☐ Monitoring responsibilities assigned
☐ Significant alerts investigated

24. Security Incident Management

☐ Incident-management policy approved
☐ Incident response procedure documented
☐ Reporting mechanism available
☐ Incident severity defined
☐ Escalation process defined
☐ Security contacts identified
☐ Evidence preservation process defined
☐ Incident records maintained
☐ Corrective actions tracked
☐ Lessons learned performed
☐ Incident trends reviewed

25. Data Breach Management

Where personal or customer data is involved:

☐ Breach response process defined
☐ Breach detection process defined
☐ Breach assessment process defined
☐ Notification responsibilities defined
☐ Regulatory requirements identified
☐ Customer notification requirements identified
☐ Evidence preservation defined
☐ Investigation process defined
☐ Post-breach review performed where applicable

26. Backup

☐ Backup requirements defined
☐ Critical information identified
☐ Backup frequency defined
☐ Backup success monitored
☐ Backup protection implemented
☐ Backup access restricted
☐ Backup encryption considered
☐ Backup retention defined
☐ Restore testing performed
☐ Backup failures investigated

27. Disaster Recovery

☐ Disaster Recovery Plan exists
☐ Critical systems identified
☐ Recovery priorities defined
☐ RTO defined
☐ RPO defined
☐ Recovery procedures documented
☐ Recovery dependencies identified
☐ Recovery testing performed
☐ Test findings addressed
☐ DR plan updated after significant changes

28. Business Continuity

☐ Business Impact Analysis completed
☐ Critical business processes identified
☐ Critical dependencies identified
☐ Continuity requirements defined
☐ Alternative arrangements considered
☐ Communication arrangements defined
☐ Business continuity tested
☐ Lessons learned documented
☐ Continuity plans reviewed

29. Supplier and Third-Party Security

☐ Supplier register maintained
☐ Critical suppliers identified
☐ Supplier risk assessed
☐ Due diligence completed
☐ Security requirements defined
☐ Contractual security requirements included
☐ Supplier access controlled
☐ Supplier reviews performed
☐ Security assurance reviewed
☐ Subprocessors assessed
☐ Supplier incidents monitored
☐ Supplier exit requirements defined

30. Information Transfer

☐ Information-transfer requirements defined
☐ Approved transfer channels identified
☐ Sensitive data encrypted in transit
☐ Recipient verification performed
☐ Access restrictions implemented
☐ Secure file-sharing methods used
☐ API security requirements defined
☐ Transfer logging implemented where appropriate
☐ Data minimization applied

31. Data Protection and Privacy

☐ Personal data identified
☐ Processing activities identified
☐ Data owners/responsible roles identified
☐ Data-processing requirements documented
☐ Privacy requirements assessed
☐ Retention requirements defined
☐ Data deletion requirements defined
☐ Data-subject requirements addressed where applicable
☐ Subprocessors identified
☐ International transfers assessed where applicable
☐ Privacy incidents handled

32. Security Awareness

☐ Security-awareness program established
☐ New employee training completed
☐ Periodic security training completed
☐ Role-specific training provided where required
☐ Training records maintained
☐ Policy acknowledgement completed where required
☐ Phishing awareness activities performed where appropriate
☐ Overdue training tracked

33. Personnel Security

☐ Security responsibilities defined
☐ Confidentiality obligations established
☐ Background checks performed where appropriate and lawful
☐ Security training provided
☐ Access based on role
☐ Personnel changes communicated
☐ Offboarding process implemented
☐ Confidentiality obligations continue after termination where applicable

34. Physical Security

Where applicable:

☐ Physical access controls
☐ Visitor management
☐ Secure areas
☐ CCTV/security monitoring
☐ Equipment protection
☐ Environmental controls
☐ Fire protection
☐ Power protection
☐ Media protection
☐ Secure disposal

35. Change Management

☐ Change-management procedure defined
☐ Changes categorized
☐ Security impact assessed
☐ Changes approved
☐ Testing performed where appropriate
☐ Emergency changes controlled
☐ Changes documented
☐ Rollback arrangements considered
☐ Security configuration changes reviewed

36. Configuration Management

☐ Security baselines defined
☐ Critical systems identified
☐ Configurations monitored
☐ Unauthorized changes investigated
☐ Default configurations reviewed
☐ Unnecessary services disabled
☐ Cloud configurations reviewed
☐ Configuration changes documented
☐ Configuration deviations tracked

37. Cryptography

☐ Encryption requirements defined
☐ Data-in-transit protection implemented
☐ Data-at-rest protection implemented where required
☐ Cryptographic mechanisms reviewed
☐ Key management defined
☐ Key access restricted
☐ Key rotation performed where required
☐ Certificates monitored
☐ Expired certificates addressed

38. Secrets and Credential Management

☐ Secrets-management process defined
☐ API keys protected
☐ Tokens protected
☐ Cloud credentials protected
☐ Database credentials protected
☐ SSH keys controlled
☐ Secrets not stored in source code
☐ Secret rotation implemented where appropriate
☐ Compromised credentials can be revoked
☐ Access to secrets monitored where appropriate

39. Information Retention and Disposal

☐ Retention requirements defined
☐ Legal retention requirements considered
☐ Customer requirements considered
☐ Data retention periods defined
☐ Unnecessary data identified
☐ Secure deletion implemented
☐ Media disposal controlled
☐ Disposal evidence maintained where required

40. Intellectual Property

☐ Organizational IP identified
☐ Source code protected
☐ Confidential business information protected
☐ Ownership requirements defined
☐ Employee IP obligations addressed
☐ Contractor IP obligations addressed
☐ Third-party IP requirements assessed
☐ Unauthorized disclosure controls implemented

41. Software Licensing

☐ Software inventory maintained
☐ License requirements identified
☐ Commercial licenses tracked
☐ Open-source licenses reviewed
☐ License restrictions understood
☐ Unauthorized software identified
☐ License renewal dates monitored
☐ Compliance evidence maintained

42. AI Security

Where AI systems are used:

☐ AI systems identified
☐ AI use cases documented
☐ Data provided to AI systems identified
☐ Sensitive-data restrictions defined
☐ Personal-data considerations assessed
☐ AI providers assessed
☐ Model/provider changes monitored
☐ AI access controlled
☐ AI outputs reviewed where appropriate
☐ Security risks assessed
☐ AI subprocessors identified
☐ AI contractual requirements reviewed

43. Security Testing

☐ Security-testing program defined
☐ Vulnerability assessments performed
☐ Penetration testing performed where appropriate
☐ Application security testing performed
☐ Cloud security testing performed where appropriate
☐ Findings recorded
☐ Remediation tracked
☐ Retesting performed
☐ Test evidence retained

44. Legal and Regulatory Compliance

☐ Applicable laws identified
☐ Regulatory requirements identified
☐ Requirements register maintained
☐ Responsibility assigned
☐ Compliance obligations mapped to controls
☐ Regulatory changes monitored
☐ Compliance assessments performed
☐ Significant compliance gaps escalated

45. Contractual Security Requirements

☐ Customer security requirements identified
☐ Supplier requirements identified
☐ Security clauses reviewed
☐ Confidentiality requirements addressed
☐ Incident requirements addressed
☐ Data-protection requirements addressed
☐ Security assurance requirements addressed
☐ Data deletion/return requirements addressed
☐ Termination requirements addressed

46. Compliance Monitoring

☐ Compliance monitoring procedure approved
☐ Monitoring plan established
☐ Requirements mapped to controls
☐ Monitoring frequency defined
☐ Evidence collected
☐ Compliance status assessed
☐ Findings recorded
☐ Corrective actions tracked
☐ Effectiveness verified
☐ Management reporting performed

47. Security Control Effectiveness

For significant controls, assess:

Design

☐ Control addresses the identified requirement/risk

Implementation

☐ Control has been implemented

Operation

☐ Control operates as intended

Evidence

☐ Evidence demonstrates operation

Effectiveness

☐ Effective
☐ Partially Effective
☐ Ineffective
☐ Not Tested

48. Security Exceptions

☐ Exceptions identified
☐ Business justification documented
☐ Security risk assessed
☐ Compensating controls identified
☐ Approval obtained
☐ Expiry/review date defined
☐ Exceptions periodically reviewed

49. Previous Findings

Review previous findings:

☐ Finding status reviewed
☐ Corrective actions implemented
☐ Evidence collected
☐ Effectiveness verified
☐ Residual risk assessed
☐ Recurring findings identified
☐ Overdue findings escalated

FindingActionOwnerDue DateStatusVerified

50. Security Findings

Record identified compliance gaps.

Finding IDAreaRequirementConditionEvidenceRiskOwnerDue Date

51. Risk Assessment of Findings

For significant findings, assess:

☐ Confidentiality impact
☐ Integrity impact
☐ Availability impact
☐ Privacy impact
☐ Customer impact
☐ Regulatory impact
☐ Contractual impact
☐ Financial impact
☐ Operational impact

Risk Treatment

☐ Reduce
☐ Avoid
☐ Share/Transfer
☐ Accept

52. Corrective Action

☐ Immediate correction identified
☐ Root cause identified
☐ Corrective action defined
☐ Action owner assigned
☐ Target date established
☐ Remediation evidence collected
☐ Effectiveness verified
☐ Residual risk reviewed
☐ Finding closed or escalated

53. Evidence Checklist

Collect appropriate evidence such as:

☐ Policies
☐ Procedures
☐ Risk assessments
☐ Statement of Applicability
☐ Access reviews
☐ MFA evidence
☐ Cloud configuration
☐ Security logs
☐ Vulnerability reports
☐ Penetration-test reports
☐ Incident records
☐ Backup evidence
☐ DR test results
☐ BCP test results
☐ Supplier assessments
☐ Contracts
☐ Security agreements
☐ Training records
☐ Security-monitoring reports
☐ Corrective-action evidence

Do not retain unnecessary:

  • Passwords
  • API keys
  • Private keys
  • Authentication secrets
  • Production credentials

54. Compliance Summary

AreaCompliantPartialNon-CompliantN/AFindings
Governance
Risk Management
Access Control
Cloud Security
Application Security
Vulnerability Management
Incident Management
Backup/DR
Supplier Security
Data Protection
Awareness
Legal/Regulatory
Contractual
AI Security

55. Overall Assessment

Assessment Result

☐ Satisfactory
☐ Satisfactory with Improvement Actions
☐ Significant Improvements Required
☐ Further Assessment Required

Summary

Significant Risks

Key Improvements

56. Management Review

Management should be informed of significant:

  • Compliance gaps
  • Security risks
  • Control failures
  • Regulatory issues
  • Customer commitments at risk
  • Overdue corrective actions
  • Repeated findings
  • Significant exceptions
  • Security incidents

Management Comments

57. Review Approval

Reviewer: ______________________________

Role: _________________________________

Date: _________________________________

Security Owner: ________________________

Risk Owner: ____________________________

Management Approver: ___________________

Approval Date: _________________________

58. Review Frequency

The checklist should be reviewed according to risk.

Suggested Model

Monthly

  • Privileged access
  • MFA
  • Critical vulnerabilities
  • Security incidents
  • Critical cloud configurations

Quarterly

  • User access
  • Suppliers
  • Security controls
  • Compliance requirements
  • Corrective actions

Semiannual

  • BCP/DR
  • Security awareness
  • Application security
  • Contractual requirements

Annual

  • Complete security compliance assessment
  • ISMS review
  • Legal/regulatory review
  • Internal audit
  • Management review
  • Compliance improvement plan

These frequencies should be adjusted based on the organization’s risk profile and requirements.

59. AWS SaaS Startup Example

A SaaS startup uses AWS, GitHub, a CI/CD platform, HR SaaS, CRM, and several third-party providers.

A periodic security compliance review may verify:

AWS

☐ MFA
☐ IAM
☐ Privileged accounts
☐ CloudTrail
☐ Encryption
☐ Security groups
☐ Backup
☐ Public exposure

GitHub

☐ MFA
☐ Repository access
☐ Branch protection
☐ Code review
☐ Former employee access
☐ Secrets scanning

Application

☐ Vulnerability management
☐ Dependency security
☐ Security testing
☐ Production access
☐ Secure deployment

People

☐ Security training
☐ Joiner/mover/leaver
☐ Access review

Suppliers

☐ Critical suppliers reviewed
☐ Security assurance reviewed
☐ Subprocessors assessed

Evidence

The organization retains sufficient evidence to demonstrate that these controls are actually operating.

60. Startup-Friendly Compliance Model

A startup can maintain a practical compliance program without creating excessive administrative work.

Core Monthly Checks

  • MFA
  • Privileged access
  • Critical vulnerabilities
  • Security incidents
  • Backup status
  • Critical cloud configurations

Quarterly Checks

  • User access
  • Suppliers
  • Security policies
  • Risk register
  • Compliance requirements
  • Corrective actions

Annual Checks

  • Full compliance assessment
  • Internal audit
  • Management review
  • Risk reassessment
  • Legal/regulatory review
  • Security improvement planning

Automation should be used wherever practical to generate evidence continuously.

61. Common Mistakes

Avoid:

  • Treating the checklist as proof of compliance.
  • Marking controls compliant without evidence.
  • Checking only policies and not actual operations.
  • Ignoring cloud configurations.
  • Ignoring supplier security.
  • Ignoring customer contractual requirements.
  • Failing to review privileged access.
  • Closing findings without verification.
  • Ignoring recurring findings.
  • Using the same review frequency for every control.
  • Collecting excessive sensitive evidence.
  • Performing compliance reviews only immediately before certification audits.

62. Relationship With Other ISMS Documents

DocumentRelationship
Information Security PolicyDefines security requirements
Risk AssessmentIdentifies security risks
Risk Treatment PlanDefines treatment
Statement of ApplicabilityDocuments applicable controls
Compliance Monitoring ProcedureDefines monitoring approach
Control Testing ProcedureDefines control testing
Internal Audit ProcedureProvides independent audit assessment
Security Findings RegisterRecords findings
Corrective Action TrackerTracks remediation
Legal & Regulatory Requirements RegisterRecords external obligations
Contractual Security Requirements RegisterRecords contractual obligations
Supplier Security ReviewReviews third-party controls
Management ReviewProvides management oversight

63. ISO/IEC 27001 Connection

This checklist can support the organization’s monitoring, measurement, control assessment, internal audit, corrective action, and continual-improvement activities.

However, the Security Compliance Checklist is not itself a universally prescribed ISO/IEC 27001 form.

The organization should determine:

  • What must be monitored
  • What must be measured
  • How it will be assessed
  • Who performs the assessment
  • How frequently it is performed
  • What evidence is required
  • How findings are handled

based on its ISMS scope, risks, objectives, controls, legal requirements, contractual commitments, customer requirements, and business context.

64. Final Security Compliance Audit Trail

For every significant checklist item, the organization should be able to demonstrate:

What requirement applies?
Which control addresses it?
Who owns the control?
Is it implemented?
Is it operating?
What evidence supports it?
Was it tested or reviewed?
Were gaps identified?
What risk do the gaps create?
Who owns remediation?
Was remediation verified?
What residual risk remains?

Final Principle

A security compliance checklist is useful only when every “Yes” can be supported by evidence. Compliance is demonstrated through operating controls, not completed checkboxes.