ISMS Audit Toolkit

Complete Master Mapping

The Complete Enterprise ISMS Audit Toolkit

The full end-to-end transformation of legacy QMS tracking into a modern, cloud-native Information Security Management System (ISMS) framework.

Domain 1: Security Governance & Scope (Mapped from Ref 1.01 - 1.03)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
1.01	Are Information Security requirements, data privacy mandates (GDPR/CCPA), and compliance obligations clearly documented in the Contract, NDA, or MSA?	Signed MSA/SOW with Data Processing Agreements (DPA).
1.02	Is the security architecture scope elaborated using a high-level WBS that identifies physical, logical, and cloud boundaries?	Cloud Tenancy Architecture Diagrams, Network Boundary maps.
1.03	Has the Information Security Officer (or equivalent) been formally assigned and introduced during the project kick-off?	Kick-off MoM, Security RACI Matrix.

Domain 2: Security Planning & Risk Management (Mapped from Ref 2.01 - 2.11)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
2.01 - 2.03	Are security testing efforts (VAPT, SAST/DAST tuning) estimated and budgeted for using organizational historical baselines?	Security Tooling Budget, Pen-test effort estimates.
2.06	Does the Risk Management Plan include threat modeling, vulnerability thresholds, and explicit incident response strategies?	Documented Threat Models (e.g., STRIDE), Risk Treatment Plan (RTP).
2.07	Is a Data Classification and Handling policy active, defining how sensitive data (PII, PHI) is encrypted at rest and in transit?	Data Management Plan, Key Management Logs.

Domain 3: Security Monitoring & Incident Tracking (Mapped from Ref 3.01 - 3.14)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
3.01 - 3.02	Are security metrics (e.g., number of unauthorized access attempts, patch latency) collected, analyzed via SIEM, and reported in status dashboards?	SIEM Dashboards, SOC Monthly Reports.
3.04	Are Identity and Access Management (IAM) controls active, and is hardware/network redundancy tested per Business Continuity (BC/DR) plans?	IAM Provisioning Logs, BC/DR Restoration Drill results.
3.07 - 3.08	Are security incidents and vulnerabilities tracked to closure using Root Cause Analysis (RCA), preventing recurrence?	Incident Post-Mortems, JIRA Security Bug tracking.

Domain 4: Secure SDLC & DevSecOps (Mapped from Ref 4.01 - 4.22)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
4.02 - 4.09	Are Non-Functional Security Requirements (e.g., OAuth 2.0, TLS 1.3 enforcement) explicitly documented in the SRS and traced via the RTM?	Security Requirements Specification, RTM.
4.10 - 4.13	Does the High-Level Design (HLD) include secure architecture reviews and evaluations of third-party/COTS components for supply chain risks?	Architecture Review Board (ARB) approvals, SBOMs.
4.14 - 4.21	Is secure coding practiced, and does the CI/CD pipeline enforce automated security gates (SAST/DAST) before deployment to production environments?	SonarQube/Veracode pipeline logs, Penetration Test Reports.
4.22	Is Infrastructure as Code (IaC) placed under strict version control, with separation of duties enforced to prevent unauthorized infrastructure modifications?	Git repository access logs, Terraform/Ansible scripts, CCB approvals.

Domain 5: Security Audits & Compliance (Mapped from Ref 5.01 - 5.03)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
5.01 - 5.02	Are Internal ISMS audits conducted per the QA plan, and are Non-Conformances (NCs) regarding security controls tracked to closure effectively?	Internal ISMS Audit Reports, CAPA registry.
5.03	Does the Final Inspection (Go-Live Gate) verify that all critical vulnerabilities have been patched and release notes document the final security posture?	Go-Live Sign-off, Final VAPT clearance, Release Notes.

Domain 6 & 7: Security Training & Threat Intelligence (Mapped from Ref 6.xx - 7.xx)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
6.01 - 6.02	Is mandatory security awareness training provided to all staff, and are Threat Intelligence learnings (e.g., zero-day alerts) shared via Knowledge Management repositories?	Training completion certificates, Knowledge Base updates.
7.01 - 7.02	Are customer security complaints or data subject access requests handled promptly, and is value creation through enhanced security posture communicated to the client?	Customer Satisfaction Surveys (CSAT), Service Level reports.

Domain 8: Predictive Security & Optimization (Mapped from Ref 8.01 - 8.02)

QMS Ref	Modern ISMS Audit Question	Evidence / Reference Artifacts
8.01	Are predictive threat models (e.g., MITRE ATT&CK mappings) and SIEM analytics used to statistically anticipate possible security incidents and implement proactive defenses?	Predictive anomaly alerts, SIEM analytics tuning logs.
8.02	Are infrastructural and code vulnerabilities continuously estimated via automated scanning, with RCA performed to eliminate recurring zero-day exposures?	Blameless RCA logs, automated vulnerability remediation charts.