ISO 27001 self-assessment

Information security policies are approved by management and communicated to all staff. A.5.1

Security roles and owners are defined (who decides, who executes, who responds to an incident). A.5.2

There is an up-to-date inventory of information assets (systems, data, devices) with an owner per asset. A.5.9

Information is classified (public, internal, confidential) and handled according to its level. A.5.12

Contracts with suppliers that access data or systems include security clauses, and suppliers are assessed. A.5.19

There is an incident response procedure the team knows, tested at least once a year. A.5.24

There is a continuity plan for critical systems with defined recovery targets (RTO/RPO). A.5.30

Applicable legal requirements (data protection law, contracts, sector rules) are identified and compliance is verified. A.5.31

Background and reference checks are performed before hiring staff with access to sensitive information. A.6.1

All staff receive security training on joining and at least yearly (phishing, passwords, data handling). A.6.3

When someone leaves, access is revoked the same day and devices and credentials are recovered. A.6.5

Remote work has rules: VPN or secure access, protected devices and no unprotected public networks. A.6.7

Physical access to areas with servers or network equipment is restricted and logged. A.7.2

Media and devices (laptops, disks, USB) are encrypted and securely wiped when retired. A.7.10

Email, VPN and critical systems require multi-factor authentication, and privileged accounts are controlled separately. A.8.5

All devices and servers run active anti-malware and receive security patches within 30 days. A.8.8

There are automatic backups, one of them offline or immutable, and restores are tested periodically. A.8.13

System and access logs are kept, and someone reviews alerts of suspicious activity. A.8.16

The network is segmented (servers, users, guests, IoT) with firewalls between segments and to the internet. A.8.22

Applications and exposed infrastructure undergo security testing (pentest or scanning) at least once a year. A.8.29