ISO27001 Assessments Without Tears

CHAPTER 3: WHAT ACTUALLY HAPPENS DURING AN ASSESSMENT?

With respect to each standard your organisation is assessed against, the auditors from the third party accreditation body are ‘assessing’ three things:

• That your policy, manual and procedures satisfy the requirements of ISO 27001 (this is the responsibility of the senior management)

• That you meet the aims of the relevant policy (more on this later);

• That you do what your procedures say you do – this is verified by asking anyone questions.

Before the assessment the auditor agrees with your organisation the scope (area of assessment), timing and size of the assessment, taking a sample of things to look at across the overall operation. So, in assessing your organisation’s information ...