ISO 27001:2022 5-Day Internal Audit Schedule

Planning a 5-day internal audit for ISO 27001:2022 that covers all four themes—Organizational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls)—requires a structured schedule to ensure you address the major areas efficiently.

With 93 controls in total, it's impractical to audit every single one in depth in just 5 days, so this schedule prioritizes key controls within each theme, aligns them with IS Governance (your starting point), and ensures a balanced approach.

Audit Schedule Overview

Day Focus Area Key Activities Personnel Needed
Day 1 Clauses 4-10
(Full ISMS Framework)
  • Conduct opening meeting to align on scope and objectives
  • Discuss context, leadership commitment, and risk processes with management
  • Review policies, objectives, and performance metrics together
  • Jointly examine documentation and evidence (e.g., risk registers, minutes)
 Top management, ISMS owner, risk manager, IT lead, HR representative
Day 2 Organizational Controls
(A.5.1–A.5.23)
  • Review security policies and asset management processes collaboratively
  • Discuss risk treatment and supplier oversight with relevant teams
  • Examine documentation (e.g., asset inventories, contracts) together
  • Identify gaps and discuss mitigations
 ISMS owner, risk owners, procurement team, IT staff
Day 3 People Controls (A.6.1–A.6.8) &
Physical Controls (A.7.1–A.7.14)
  • Morning: Discuss HR processes (screening, training) and staff responsibilities
  • Review incident reporting with staff
  • Afternoon: Conduct site walkthrough to assess physical security
  • Jointly verify logs and controls
 HR manager, staff representatives, facilities staff, security team
Day 4 Technological Controls
(A.8.1–A.8.20)
  • Collaborate with IT team to review endpoint, access, and network security
  • Examine malware and vulnerability management processes together
  • Analyze system logs and configurations jointly
  • Discuss findings and immediate concerns
 IT manager, system admins, network engineers
Day 5 Technological Controls (A.8.21–A.8.34) &
Organizational Controls (A.5.24–A.5.37) &
Wrap-Up
  • Morning: Review development security and incident processes with IT and ISMS teams
  • Discuss compliance requirements together
  • Afternoon: Analyze findings collaboratively
  • Conduct closing meeting to present results and next steps
 IT developers, compliance officer, ISMS owner, top management

Assumptions

Detailed Daily Schedule

Day 1: Clauses 4-10 (Full ISMS Framework)

1

Objective: Establish the ISMS foundation by jointly assessing context, leadership, planning, support, operations, performance, and improvement.

Time Allocation: 8 hours (9:00 AM - 5:00 PM)

Coverage:

  • Clause 4: Context of the Organization
  • Clause 5: Leadership
  • Clause 6: Planning
  • Clause 7: Support
  • Clause 8: Operation
  • Clause 9: Performance Evaluation
  • Clause 10: Improvement

Day 2: Organizational Controls (A.5.1–A.5.23)

2

Objective: Collaboratively assess key governance controls, including policies, assets, risks, and suppliers.

Time Allocation: 8 hours (9:00 AM - 5:00 PM)

Coverage:

  • A.5.1: Policies for Information Security
  • A.5.2: Information Security Roles and Responsibilities
  • A.5.3: Segregation of Duties
  • A.5.4: Management Responsibilities
  • A.5.5: Contact with Authorities
  • A.5.6: Contact with Special Interest Groups
  • A.5.7: Threat Intelligence
  • A.5.8: Information Security in Project Management
  • A.5.9: Inventory of Information and Assets
  • A.5.10: Acceptable Use of Information
  • A.5.11: Return of Assets
  • A.5.12: Classification of Information
  • A.5.13: Labelling of Information
  • A.5.14: Information Transfer
  • A.5.15: Access Control
  • A.5.16: Identity Management
  • A.5.17: Authentication Information
  • A.5.18: Access Rights
  • A.5.19: Information Security in Supplier Relationships
  • A.5.20: Addressing Security Within Supplier Agreements
  • A.5.21: Managing Security in the ICT Supply Chain
  • A.5.22: Monitoring of Supplier Services
  • A.5.23: Security for Cloud Services

Day 3: People Controls (A.6.1–A.6.8) & Physical Controls (A.7.1–A.7.14)

3

Objective: Jointly evaluate human-related security and physical protection measures.

Time Allocation: 8 hours (9:00 AM - 5:00 PM)

Coverage:

  • A.6.1: Screening
  • A.6.2: Terms and Conditions of Employment
  • A.6.3: Information Security Awareness, Education, and Training
  • A.6.4: Disciplinary Process
  • A.6.5: Responsibilities After Termination
  • A.6.6: Confidentiality or Non-Disclosure Agreements
  • A.6.7: Remote Working
  • A.6.8: Information Security Event Reporting
  • A.7.1: Physical Security Perimeters
  • A.7.2: Physical Entry Controls
  • A.7.3: Securing Offices, Rooms, and Facilities
  • A.7.4: Physical Security Monitoring
  • A.7.5: Protecting Against Physical and Environmental Threats
  • A.7.6: Working in Secure Areas
  • A.7.7: Clear Desk and Clear Screen
  • A.7.8: Equipment Siting and Protection
  • A.7.9: Security of Assets Off-Premises
  • A.7.10: Storage Media
  • A.7.11: Supporting Utilities
  • A.7.12: Cabling Security
  • A.7.13: Equipment Maintenance
  • A.7.14: Secure Disposal or Reuse of Equipment

Day 4: Technological Controls (A.8.1–A.8.20)

4

Objective: Collaboratively assess core IT security controls with the IT team.

Time Allocation: 8 hours (9:00 AM - 5:00 PM)

Coverage:

  • A.8.1: User Endpoint Devices
  • A.8.2: Privileged Access Rights
  • A.8.3: Information Access Restriction
  • A.8.4: Access to Source Code
  • A.8.5: Secure Authentication
  • A.8.6: Capacity Management
  • A.8.7: Protection Against Malware
  • A.8.8: Management of Technical Vulnerabilities
  • A.8.9: Configuration Management
  • A.8.10: Information Deletion
  • A.8.11: Data Masking
  • A.8.12: Data Leakage Prevention
  • A.8.13: Information Backup
  • A.8.14: Redundancy of Information Processing Facilities
  • A.8.15: Logging
  • A.8.16: Monitoring Activities
  • A.8.17: Clock Synchronization
  • A.8.18: Use of Privileged Utility Programs
  • A.8.19: Installation of Software on Operational Systems
  • A.8.20: Networks Security

Day 5: Technological Controls (A.8.21–A.8.34) & Organizational Controls (A.5.24–A.5.37) & Wrap-Up

5

Objective: Complete technological and organizational controls, then finalize the audit collaboratively.

Time Allocation: 8 hours (9:00 AM - 5:00 PM)

Coverage:

  • A.8.21: Security of Network Services
  • A.8.22: Segregation of Networks
  • A.8.23: Web Filtering
  • A.8.24: Use of Cryptography
  • A.8.25: Secure Development Life Cycle
  • A.8.26: Application Security Requirements
  • A.8.27: Secure System Architecture and Engineering Principles
  • A.8.28: Secure Coding
  • A.8.29: Security Testing in Development and Acceptance
  • A.8.30: Outsourced Development
  • A.8.31: Separation of Development, Test, and Production Environments
  • A.8.32: Change Management
  • A.8.33: Test Information
  • A.8.34: Protection of Information Systems During Audit Tests
  • A.5.24: Information Security Incident Management Planning and Preparation
  • A.5.25: Assessment and Decision on Information Security Events
  • A.5.26: Response to Information Security Incidents
  • A.5.27: Learning from Information Security Incidents
  • A.5.28: Collection of Evidence
  • A.5.29: Information Security During Disruption
  • A.5.30: ICT Readiness for Business Continuity
  • A.5.31: Legal, Statutory, Regulatory, and Contractual Requirements
  • A.5.32: Intellectual Property Rights
  • A.5.33: Protection of Records
  • A.5.34: Privacy and Protection of PII
  • A.5.35: Independent Review of Information Security
  • A.5.36: Compliance with Security Policies and Standards
  • A.5.37: Documented Operating Procedures

Best Practices for Implementation

Summary

This 5-day ISO 27001:2022 internal audit schedule provides a comprehensive approach to auditing all 93 Annex A controls while focusing on the most critical areas. The collaborative approach ensures that the audit is a learning experience for both the auditors and the organization, leading to meaningful improvements in the information security management system.