Akasia

ISO 27001 Readiness Assessment

Evaluate your organization's readiness for ISO 27001 certification with our comprehensive assessment tool. Get instant insights and recommendations tailored to your needs.

1. Threat Intelligence

Does your organization utilize threat intelligence sources to detect potential attacks? (Examples: Threat feeds, CERT reports, or cybersecurity vendors).

Yes

In Progress

Is there a process to analyze and act upon information from threat intelligence?

Yes

In Progress

Are the results of threat intelligence analysis used to update information security policies?

Yes

In Progress

2. Information Security for Cloud Services

Have all your cloud services been evaluated for security before use?

Yes

In Progress

Is there a contract or SLA with the cloud provider that outlines security responsibilities?

Yes

In Progress

Do you monitor access to cloud services using logs or audit trails?

Yes

In Progress

Is data stored in the cloud encrypted both at rest and in transit?

Yes

In Progress

3. ICT Readiness for Business Continuity

Does your organization have a Business Continuity Plan (BCP) that includes IT infrastructure?

Yes

In Progress

Is IT readiness (disaster recovery testing) regularly tested?

Yes

In Progress

Are there alternative IT infrastructures available in case of disruptions to the primary system (e.g., failover to cloud or other data centers)?

Yes

In Progress

4. Physical Security Monitoring

Are critical physical locations (e.g., data centers, server rooms) monitored with CCTV or other surveillance systems?

Yes

In Progress

Do you have procedures to detect and respond to physical security breaches?

Yes

In Progress

Is access to sensitive locations restricted only to authorized and recorded staff?

Yes

In Progress

5. Configuration Management

Is there complete documentation for each hardware and software configuration?

Yes

In Progress

Does the configuration management process include approval before changes are implemented?

Yes

In Progress

Is there a security test conducted before applying configuration changes to production systems?

Yes

In Progress

6. Data Masking

Is sensitive data anonymized or masked in development or testing environments?

Yes

In Progress

Are data masking techniques used to protect sensitive data from unauthorized access?

Yes

In Progress

Is there a policy to determine when data masking should be applied?

Yes

In Progress

7. Data Leakage Prevention (DLP)

Do you use DLP solutions to prevent the transmission of sensitive data outside the organization?

Yes

In Progress

Is there a policy to report and handle data leakage incidents?

Yes

In Progress

Is data sent through email or other communication channels automatically checked by the DLP system?

Yes

In Progress

8. Monitoring Activities

Is IT system activity (e.g., access, modifications) monitored in real time?

Yes

In Progress

Do you use a SIEM (Security Information and Event Management) system to detect threats?

Yes

In Progress

Are there procedures to act on anomalies detected during activity monitoring?

Yes

In Progress

9. Web Filtering

Is access to websites irrelevant to your business automatically blocked?

Yes

In Progress

Do you use web filtering solutions to protect users from phishing or malicious websites?

Yes

In Progress

Is the web filtering policy updated regularly to cover emerging threats?

Yes

In Progress

10. Secure Coding

Do your software development teams receive specialized training on secure coding?

Yes

In Progress

Is there a process for conducting code reviews with a focus on security?

Yes

In Progress

Do you use automated tools like SAST (Static Application Security Testing) or DAST (Dynamic Application Security Testing) to identify vulnerabilities in code?

Yes

In Progress

11. Information Deletion

Does your organization have a data retention policy that includes the secure deletion of data after a specific period?

Yes

In Progress

Are data deletion methods (e.g., overwrite, degaussing, or shredding) aligned with security standards?

Yes

In Progress

Is there a process to ensure that deleted data cannot be recovered?

Yes

In Progress

12. Risk Management

Has your organization updated its risk assessment to include new controls from ISO 27001:2022?

Yes

In Progress

Is there a tool or system to document and track information security risks?

Yes

In Progress

Has your risk mitigation plan been updated to address modern threats like ransomware?

Yes

In Progress

13. Audit and Compliance

Did your last internal audit include an evaluation of the new controls in ISO 27001:2022?

Yes

In Progress

Is there evidence that your organization’s policies and procedures address new controls such as Threat Intelligenceand DLP?

Yes

In Progress

Has an external or third-party audit been conducted to validate your readiness for ISO 27001:2022?

Yes

In Progress

14. Awareness and Employee Training

Have all employees been trained on the changes to the controls in ISO 27001:2022?

Yes

In Progress

Are cyberattack simulations, such as phishing, regularly conducted to improve employee awareness?

Yes

In Progress

Is there a mechanism to measure the effectiveness of information security training?

Yes

In Progress

15. General IT Security

Are hardware and software assets inventoried and regularly monitored?

Yes

In Progress

Are your systems updated with security patches on a regular basis?

Yes

In Progress

Is there a policy to restrict the use of BYOD (Bring Your Own Device) in the organization?

Yes

In Progress

ISO 27001 Readiness Assessment

1. Threat Intelligence

2. Information Security for Cloud Services

3. ICT Readiness for Business Continuity

4. Physical Security Monitoring

5. Configuration Management

6. Data Masking

7. Data Leakage Prevention (DLP)

8. Monitoring Activities

9. Web Filtering

10. Secure Coding

11. Information Deletion

12. Risk Management

13. Audit and Compliance

14. Awareness and Employee Training

15. General IT Security

Get Your Results

AKASIA Cyber

Our Services

Articles

Contact Us