ISO 27001 Annex A control audit
Internal audit across the ISO 27001:2022 Annex A control themes, structured the way a certification auditor will sample them.
ISO 27001
24 questions~90 minannual
Typically run by ISMS Manager / Internal Auditor
Loading AuditFlow…
Tech
Software companies, IT services, cloud providers and digital platforms.
The job you're hiring this for
Getting through a SOC 2 or ISO 27001 audit without derailing engineering for a month, and keeping evidence fresh between annual surveillance audits.
Weighted questions with auditor guidance, and on most of them the clause each question evidences — ready to run, or to edit into your own house standard.
Internal audit across the ISO 27001:2022 Annex A control themes, structured the way a certification auditor will sample them.
Typically run by ISMS Manager / Internal Auditor
Trust Services Criteria readiness check focused on whether controls will survive an operating-effectiveness test over the observation period.
Typically run by Compliance Lead / vCISO
Entitlement recertification across in-scope systems, with evidence of reviewer challenge and remediation of revoked access.
Typically run by IT Security / Application Owner
Samples production changes end-to-end from ticket to deployment, testing approval, testing evidence and separation of duties.
Typically run by IT Audit / Engineering Manager
Dual-framework privacy audit covering lawful basis, consent, data subject rights, retention and breach readiness under both GDPR and India's DPDP Act.
Typically run by DPO / Privacy Lead
Risk-tiered vendor assessment covering security posture, contractual protections, data flows and offboarding.
Typically run by Security / Procurement
Structured tabletop testing detection, escalation, decision-making and communication under a realistic scenario.
Typically run by Security Lead / BCM Coordinator
Proves recoverability by actually restoring — the control that is universally claimed and rarely tested.
Typically run by Infrastructure Lead
Tests the identity lifecycle end to end — access provisioned on approval, adjusted on transfer, removed on exit, and assets returned.
Typically run by IT Security / HR Systems Owner
Reviews who holds administrative rights across every layer, whether that access is time-bound, vaulted, monitored and recertified.
Typically run by IT Security Manager
Audits whether security is built into development — peer review enforcement, pipeline scanning, dependency hygiene and environment separation.
Typically run by Application Security Lead
Tests scan coverage against the real asset estate and whether remediation actually lands inside the stated SLA.
Typically run by Infrastructure Security Lead
Reviews a penetration test from scope through to verified closure, with particular attention to findings that repeat across reports.
Typically run by Security Manager / Internal Audit
Checks what is actually being logged and detected against what the estate contains — the gap between the two is the blind spot.
Typically run by SOC Lead / Security Engineer
Reviews the live configuration of cloud accounts against a hardening baseline, covering exposure, identity, encryption and audit logging.
Typically run by Cloud Security Engineer
Endpoint-level review of authentication, authorisation, data exposure and logging across public, partner and internal APIs.
Typically run by Application Security Engineer
Verifies that every corporate device is enrolled, encrypted, patched, monitored and recoverable through to secure disposal.
Typically run by IT Operations / Security
Reviews cryptographic policy against live practice — where keys live, who can reach them, whether rotation actually happens.
Typically run by Security Architect
Hunts for credentials in source control, pipelines and configuration, and tests whether discovered secrets are rotated rather than deleted.
Typically run by Platform Engineering / Security
Tests whether the retention schedule is executed in live systems, backups and processors — not merely written down.
Typically run by DPO / Data Governance Lead
Internal audit of the AI management system against ISO/IEC 42001:2023 — the Annex A controls and the clause 4–10 management system, in the order a certification auditor samples them.
Typically run by AI Governance Lead / Internal Auditor
Internal audit of the PIMS against ISO/IEC 27701:2019 — the Annex A controller duties, the Annex B processor duties where you process on behalf of a customer, and the management-system clauses.
Typically run by Data Protection Officer / Internal Auditor
Internal audit of the cybersecurity risk-management measures in Article 21, the governance duties in Article 20 and the incident-reporting clock in Article 23.
Typically run by CISO / Internal Auditor
Internal audit across the six CSF 2.0 functions — Govern, Identify, Protect, Detect, Respond, Recover — asking for the record behind each outcome, so the answers become the organisation's current profile rather than a self-rating.
Typically run by CISO / Internal Auditor
Internal audit of the eighteen CIS Controls, one or two safeguards per Control, asking for the artefact — the inventory, the scan, the restore test, the MFA enforcement — rather than the policy that describes it.
Typically run by IT Security Lead / Internal Auditor
Internal audit of the SMS against ISO/IEC 20000-1:2018 — the clause 8 service management processes a certification audit is spent on, plus the clause 4–10 management system.
Typically run by Service Delivery Manager / Internal Auditor
Internal audit of the information security management system against clauses 4 to 10 of ISO/IEC 27001:2022 — context, leadership, risk, support, operation, performance evaluation and improvement — sampled the way a certification body opens a stage 2 audit.
Typically run by ISMS Lead Auditor / Internal Auditor
Internal audit of all 37 organisational controls in Annex A.5 of ISO/IEC 27001:2022 — policy, roles, assets, access, suppliers, incidents, continuity and compliance — with the records to sample for each.
Typically run by ISMS Lead Auditor / Internal Auditor
Internal audit of the 8 people controls and 14 physical controls in Annex A.6 and A.7 of ISO/IEC 27001:2022 — screening through termination, and a walk of the perimeter, secure areas, equipment and disposal.
Typically run by ISMS Lead Auditor / Internal Auditor
Internal audit of all 34 technological controls in Annex A.8 of ISO/IEC 27001:2022 — endpoints, privileged access, vulnerabilities, backup, logging, networks, cryptography and the secure development lifecycle — sampled from system configuration and records.
Typically run by ISMS Lead Auditor / Technical Auditor
Readiness audit of the entity-level Common Criteria — CC1 control environment, CC2 communication, CC3 risk assessment, CC4 monitoring and CC5 control activities — sampled the way a Type II service auditor tests them across the review period.
Typically run by Compliance Lead / Internal Auditor
Readiness audit of the operational Common Criteria — CC6 logical and physical access, CC7 system operations and incident response, CC8 change management, CC9 business disruption and vendor risk — with the populations a Type II auditor samples.
Typically run by Security Engineer / Internal Auditor
Readiness audit of the four optional Trust Services categories — A1 availability, C1 confidentiality, PI1 processing integrity and P1–P8 privacy — for an entity that has put them in scope of its SOC 2 report.
Typically run by Compliance Lead / Privacy Officer
Article-by-article internal audit of the GDPR accountability programme — lawful bases, consent, special categories, every data-subject right, processors, records of processing, security, breach handling, DPIA, the DPO and international transfers.
Typically run by Data Protection Officer / Privacy Lead
Internal audit of the privacy information management system clauses (5.2–5.8) and the controller and processor controls not covered by the core PIMS audit — minimisation, temporary files, processor obligations, transmission and cross-border transfers.
Typically run by Privacy Officer / Internal Auditor
Internal audit of the ISO/IEC 42001:2023 management-system clauses — context, policy, roles, AI risk assessment and treatment, impact assessment, support, operation, monitoring and improvement — plus responsible-use objectives and information for interested parties.
Typically run by AI Governance Lead / Internal Auditor
Internal audit of the NIS2 obligations beyond Article 21 — management-body liability, incident notification and follow-up reports, certification schemes, information sharing, and readiness for supervision. Questions ask what the entity has determined under its national transposition.
Typically run by CISO / Compliance Officer
Audit of the NIST CSF 2.0 outcomes the core assessment leaves open — organisational context, risk strategy, roles and oversight, supply-chain risk, asset life cycle, protection, detection, incident management and recovery.
Typically run by CISO / Internal Auditor
Safeguard-level audit of the CIS Controls v8.1 Implementation Group 2 and 3 safeguards — automated discovery, allowlisting, data protection, hardening, account and access centralisation, logging, network defence, training, service providers, application security, incident response and penetration testing.
Typically run by Security Engineer / Internal Auditor
Internal audit of readiness for the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 — every section and rule a Data Fiduciary answers for, cited by its own number, with the commencement date stated where the duty is not yet enforceable.
Typically run by Data Protection Officer / Internal Auditor
Each of these has a real control library in the product — questions map to specific clauses, so gap analysis shows you what is genuinely unevidenced.
The international standard for information security management systems.
118 controls mapped
Business continuity management — impact analysis, strategies and tested plans.
31 controls mapped
Card-brand mandated controls for anyone storing, processing or transmitting card data.
248 controls mapped
AICPA trust services criteria attestation, expected by US enterprise buyers.
61 controls mapped
EU privacy regulation applying to any organisation processing EU residents' data.
61 controls mapped
India's personal data protection law, with consent and breach-notice obligations.
39 controls mapped
Not hypotheticals. These are the findings that recur in technology & saas, and every one of them is a question in at least one of the 40 templates above.
Templates, findings and AI prompts use your sector's terms, not generic audit language.
Pick one of the 40 templates above, walk the site with your phone, and see the finished report before you get back to your desk.