iso-27001-中英文對(duì)照-checklist

1、ISO27001ComplianceChecklistVinodKumarvinodjis@Page12019114ReferenceAuditareaobjectivequestion【審計(jì)范圍、目標(biāo)和問(wèn)題】ChecklistStardSection【章節(jié)】AuditQuestion【審計(jì)問(wèn)題】SecurityPolicy【安全方針】1.15.1InfmationSecurityPolicy【信息安全方針】1.1.15.1.1Infm

2、ationsecuritypolicydocument【信息安全策略文檔】WhetherthereexistsanInfmationsecuritypolicy?whichisapprovedbythemanagementpublished?communicatedasappropriatetoallemployees.【是否存在經(jīng)過(guò)管理層批準(zhǔn)的信息安全方針，并發(fā)布和傳達(dá)給所有員工？】Whetherthepolicystatesmana

3、gementcommitment?setsouttheganizationalapproachtomanaging?infmationsecurity.?【安全方針是否陳述了管理層承諾，并設(shè)定了組織信息安全管理的目標(biāo)？】1.1.25.1.2ReviewofInfmationalSecurityPolicy【信息安全策略評(píng)審】WhethertheInfmationSecurityPolicyisreviewedat?plannedinte

4、rvalsifsignificantchangesoccurto?ensureitscontinuingsuitabilityadequacy?effectiveness.【是否按照計(jì)劃的時(shí)間間隔或者發(fā)生重大變化時(shí)評(píng)審信息安全方針，以確保方針的持續(xù)性、有效性和充分性？】WhethertheInfmationSecuritypolicyhasanowner?whohasapprovedmanagementresponsibilityf?d

5、evelopmentreviewevaluationofthesecuritypolicy.?【信息安全方針是否具有所有者，其是否肩負(fù)著起草、評(píng)審和評(píng)估信息安全方針的管理責(zé)任？】WhetheranydefinedInfmationSecurityPolicy?reviewproceduresexistdotheyinclude?requirementsfthemanagementreview.?【是否存在制定好的信息安全方針評(píng)審程序，該

6、程序是否包括管理評(píng)審的要求？】Whethertheresultsofthemanagementreviewaretakenintoaccount.?【有沒(méi)有重視或考慮管理評(píng)審的結(jié)果】Whethermanagementapprovalisobtainedfthe?revisedpolicy.?【修訂的信息安全方針是否得到管理層的批準(zhǔn)】ISO27001ComplianceChecklistVinodKumarvinodjis@Page320

7、191142.1.66.1.6ContactwithAuthities【與政府部門(mén)的聯(lián)系】Whetherthereexistsaprocedurethatdescribeswhenbywhom:relevantauthitiessuchasLawenfcementfiredepartmentetc.shouldbecontactedhowtheincidentshouldberepted【是否存在一個(gè)流程描述了在什么時(shí)間，應(yīng)該由誰(shuí)聯(lián)系哪

8、個(gè)政府部門(mén)，比如公安局、消防局，以及如何上報(bào)事件？】2.1.76.1.7Contactwithspecialinterestgroups【聯(lián)系特殊利益團(tuán)體】Whetherappropriatecontactswithspecialinterestgroupsotherspecialistsecurityfumsprofessionalassociationsaremaintained.【是否與特殊利益團(tuán)體比如安全專(zhuān)家論壇和安全專(zhuān)業(yè)團(tuán)體保

9、持適當(dāng)?shù)穆?lián)系】2.1.86.1.8IndependentreviewofInfmationSecurity【信息安全的獨(dú)立評(píng)審】Whethertheganization’sapproachtomanaginginfmationsecurityitsimplementationisreviewedindependentlyatplannedintervalswhenmajchangestosecurityimplementationocc

10、ur.【有沒(méi)有按照計(jì)劃的時(shí)間間隔，或者在安全實(shí)施發(fā)生重大改變時(shí)，對(duì)組織的信息安全管理目標(biāo)及其實(shí)現(xiàn)進(jìn)行獨(dú)立評(píng)審？】2.26.2ExternalParties【外部組織】2.2.16.2.1Identificationofrisksrelatedtoexternalparties【識(shí)別與外部組織相關(guān)的風(fēng)險(xiǎn)】Whetherriskstotheganization’sinfmationinfmationprocessingfacilityfro

11、maprocessinvolvingexternalpartyaccessisidentifiedappropriatecontrolmeasuresimplementedbefegrantingaccess.【在外部組織需要訪(fǎng)問(wèn)組織內(nèi)的信息和信息處理設(shè)施時(shí)，有沒(méi)有在授予訪(fǎng)問(wèn)權(quán)限前識(shí)別訪(fǎng)問(wèn)導(dǎo)致的風(fēng)險(xiǎn)，并采取適當(dāng)?shù)目刂拼胧?？?.2.26.2.2Addressingsecuritywhiledealingwithcustomers【與客戶(hù)