Information Security Management BS ISO IEC 7799:2005 SANS Audit Check List

Table of Contents

Security Policy............................................................................................. 4

Information security policy...................................................................... 4

Organization of information security.......................................................... 5

Internal Organization ............................................................................. 5

External Parties ..................................................................................... 7

Asset Management..................................................................................... 8

Responsibility for assets ........................................................................ 8

Information classification ....................................................................... 8

Human resources security........................................................................... 9

Prior to employment ............................................................................. 9

During employment .............................................................................. 10

Termination or change of employment................................................... 10

Physical and Environmental Security......................................................... 11

Secure Areas ...................................................................................... 11

Equipment Security.............................................................................. 12

Communications and Operations Management ....................................... 14

Operational Procedures and responsibilities.......................................... 14

Third party service delivery management.............................................. 15

System planning and acceptance ......................................................... 16

Protection against malicious and mobile code....................................... 17

Backup .............................................................................................. 17

Network Security Management .......................................................... 18

Media handling .................................................................................. 18

Exchange of Information .................................................................... 19

Electronic Commerce Services .......................................................... 20

Monitoring ........................................................................................ 21

Access Control.......................................................................................... 23

Business Requirement for Access Control ......................................... 23

User Access Management................................................................. 23

User Responsibilities ........................................................................ 24

Network Access Control.................................................................. 25

Operating system access control....................................................... 26

Application and Information Access Control .................................... 28

Mobile Computing and teleworking ................................................. 28

Information systems acquisition, development and maintenance........... 29

Security requirements of information systems ................................... 29

Correct processing in applications ................................................... 29

Cryptographic controls.................................................................... 31

Security of system files.................................................................... 32

Security in development and support processes .............................. 32

Technical Vulnerability Management............................................... 34

Information security incident management ............................................ 34

Reporting information security events and weaknesses .................... 34

Management of information security incidents and improvements...... 35

Business Continuity Management.......................................................... 36

Information security aspects of business continuity management....... 36

Compliance .............................................................................................. 38

Compliance with legal requirements ............................................... 38

Compliance with security policies and standards, and technical compliance ..................................................................................................... 40

Information Systems audit considerations ...................................... 40

References............................................................................................... 41

DOWNLOAD THE CHECKLIST HERE ...