ISMS Certification Audit Kit

Learning guide: accreditation, choosing a CB, audit time, Stage 1 and 2, findings, decision, surveillance, recertification, transfers, remote audits

CB selection for ISO/IEC 27001: accreditation check, impartiality, audit time, multi-site, remote audit, 3-year cost, transfer, RFQ, scoring, decision

Readiness assessment (DOC-ISMS-098): required documented information check, clause 4 to 10 scores, Annex A by theme, gap register, readiness decision, roadmap, size tiers

Stage 1 audit prep: what Stage 1 reviews, document pack mapped to required documented information, records, go or no-go, logistics, typical findings

Master list of ISMS documents and records: mandatory items flagged, owner, version, classification, location, retention, external documents, disposal

Stage 2 audit workbook: evidence index per clause and Annex A theme, sampling populations, interview schedule, evidence rules, debrief log, closing notes

Evidence register for clauses 4 to 10 and all 93 Annex A controls: owner, record, location, frequency, last collected, status, Stage 2 and surveillance use

CB audit findings log, correction, extent check, root cause, corrective action, CB deadlines, submission log, verification and closure

3-year certificate cycle, timing rules, Gantt timeline, audit coverage, change notifications, suspension and withdrawal, recertification, transfers, budget

Pre-surveillance self-check: changes since last audit, previous findings, required records, internal audit, management review, KPIs, controls, scope and claims

Scope change classification, ISMS impact by clause, multi-site eligibility, site register and sampling groups, site readiness checklist, CB notification log, timeline

Certificate and CB mark use: rule sources, licensed marks, scope-limited claims, prohibited uses, channels, wording examples, approval log