Module 11

Question 1

what are the mandatory documents in an audit according to ISO27001?

Answer 1

1. Scope of the ISMS
2. Infosec Policy
3. Risk assessment and treatment methodology
4. SoA
5. Risk Treatment plan
6. Risk ASsessment report
7. Definition of security roles and responsibilties
8. Inventory of assets

Question 2

when do audit findings have to be fixed?

Answer 2

criticial: immediately
prio 1: within 2 weeks
prio 2: within 3 months