1. Adaptive Processes Consulting Pvt. Ltd. An ISO 9001:2000 Certified Company www.AdaptiveProcesses.com This document is the property of and proprietary to Adaptive Processes Consulting Pvt. Ltd. Contents of this document should not be disclosed to any unauthorized person. This document may not, in whole or in part, be reduced, reproduced, stored in a retrieval system, translated, or transmitted in any form or by any means, electronic or mechanical. www.AdaptiveProcesses.com ISMS Internal Auditors Training

2. Adaptive Processes © Experience World Class Processes! 2 Program Agenda Why and What of ISMS audits Auditor Qualities Audit Process Audit Reporting Exercises and Role Plays Test

3. What are ISMS Audits?

4. Adaptive Processes © Experience World Class Processes! 4 What are ISMS Audits? A systematic and independent examination to determine whether information security activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives of the system. ISO 19011:2002 is the guideline for Auditing

5. Adaptive Processes © Experience World Class Processes! 5 Internal Audits Conducted by the organization itself Purpose to see compliance to the defined system Identify areas of improvement Key input for the external audits

6. Adaptive Processes © Experience World Class Processes! 6 External Audits Stage 1 Audit – Review of documentation and coverage of applicable controls to the organization – Evaluation of risk assessment methodology Stage 2 Audit – Follow audit trails and internal audit activities – Attention towards risk identified and – Responsibilities at all levels in the organisation, communications and controls within and outside the organization, the monitoring of incidents and any resulting actions for continuous improvement Surveillance Audits

7. Why and What of ISMS Audits

8. Adaptive Processes © Experience World Class Processes! 8 Objectives of Audits Provide assurance to management, clients and external auditing firm that the established security practices in the organization are capable of achieving their stated objectives. Mandatory requirement for ISO series of standards

9. Any Questions? Happy Auditing!