Click main image to view in full screen.
ISO 27001/27002 Security Audit Questionnaire (Excel XLSX)
Excel (XLSX)
BENEFITS OF THIS EXCEL DOCUMENT
- Help you assess your compliance with the ISO 27001 Security standard.
- Support you to improve your company.
- Compare your security measures with what may be expected and improve them accordingly.
ISO 27001 EXCEL DESCRIPTION
This spreadsheet contains a set of security questions and an evaluation method, which could be used to support your efforts in assessing whether your company complies with the requirements of ISO Security standard ISO 27001/27002.
It is made up of 2 parts. The first part contains a summary of the questionnaires included in the second part and instructions on using this spreadsheet.
The second part contains 17 questionnaires with 372 questions on all aspects of information security, as defined in the ISO standard.
The questionnaires included in this spreadsheet are:
Q1. General Security Framework Questionnaire (222 questions)
Q2. Information Security Policies (A5) Questionnaire (5 questions)
Q3. Organization of Information Security (A6) Questionnaire (8 questions)
Q4. Human resources security (A7) Questionnaire (8 questions)
Q5. Asset management (A8) Questionnaire (12 questions)
Q6. Access control (Section A9) Questionnaire (15 questions)
Q7. Cryptography (Section A10) Questionnaire (3 questions)
Q8. Physical security (Section A11-part 1) Questionnaire (12 questions)
Q9. Environmental security (Section A11-part 2) Questionnaire (8 questions)
Q10. Data Protection (Section A11-part 3) Questionnaire (6 questions)
Q11. Operations security (Section A12) Questionnaire (10 questions)
Q12. Communications security (Section A13) Questionnaire (8 questions)
Q13. System acquisition, development and maintenance (A14) Questionnaire (16 questions)
Q14. Supplier relationships (A15) Questionnaire (7 questions)
Q15. Information security incident management (A16) Questionnaire (6 questions)
Q16. Information security aspects of business continuity management
(A17) Questionnaire (10 questions)
Q17. Compliance (A18) Questionnaire (9 questions)
This template offers a comprehensive grading system to evaluate your organization's adherence to each questionnaire section. The evaluation grades provide a clear, quantifiable measure of compliance, making it easier to identify areas needing improvement. The tool is designed for ease of use, ensuring that your team can efficiently conduct thorough security audits. This structured approach helps in maintaining robust information security management practices, aligning with ISO standards.
Got a question about the product? Email us at support@flevy.com or ask the author directly by using the "Ask the Author a Question" form. If you cannot view the preview above this document description, go here to view the large preview instead.
TOPIC FAQ
What are the main domains covered by ISO 27001/27002 security assessments?
Typical ISO 27001/27002 assessments cover policy, organization, human resources, asset management, access control, cryptography, physical and environmental protections, operations, communications, system development, supplier relationships, incident management, business continuity, and compliance. The ISO 27001/27002 Security Audit Questionnaire organizes these into 17 questionnaires covering A5–A18 and a general framework, totaling 17 questionnaires.How can an organization use questionnaires to assess ISO 27001 compliance?
Organizations conduct structured interviews or self-assessments using questionnaires to map existing controls to ISO clauses, capture yes/no or graded responses, and apply an evaluation method to quantify maturity and compliance. The ISO 27001/27002 Security Audit Questionnaire includes instructions, a summary, and a grading system to support that process with 372 questions.What topics are typically asked in an access control questionnaire?
An access control questionnaire targets controls mapped to Section A9 of ISO 27001 and focuses on how access rights and authentication are managed and monitored. In the referenced spreadsheet, the access control questionnaire is a discrete section containing 15 questions specific to Section A9.How should I choose a pre-built ISO 27001 audit template for a small IT team on a tight timeline?
Prioritize templates that explicitly map to ISO clauses, include clear usage instructions, provide a grading or evaluation method, and offer sufficient question coverage so you can complete assessments quickly. The ISO 27001/27002 Security Audit Questionnaire provides instructions, an evaluation grading system, and coverage across A5–A18 with 372 questions to review.Are paid ISO 27001 audit templates worth the cost compared to building your own questionnaire?
Paid templates reduce initial scoping and drafting time by providing pre-mapped control sections, standardized questions, and built-in grading so teams can begin assessments faster. The spreadsheet referenced supplies these elements across 17 questionnaires with an evaluation method to quantify compliance.We just completed a merger—how can we quickly assess security gaps across the combined organization?
Use a standardized set of questionnaires mapped to ISO control domains to survey both entities, apply a consistent grading methodology to each response, and aggregate scores to highlight gaps and priority remediation areas. The ISO 27001/27002 Security Audit Questionnaire is structured for this purpose with 17 questionnaires, instructions, and evaluation grades.What level of team or role should lead an internal ISO 27001 questionnaire audit?
Lead the questionnaire audit with an individual or small team responsible for information security and compliance who can access control owners and evidence. The tool is designed for team use and includes a summary and instructions plus an evaluation grading method to support internal auditors or security leads.How does an audit tool separate physical, environmental, and data protection controls?
A compliant tool separates related A11 topics into distinct questionnaires so each control area is assessed individually. In this spreadsheet A11 is split into Physical Security (part 1, 12 questions), Environmental Security (part 2, 8 questions), and Data Protection (part 3, 6 questions).Source: Best Practices in ISO 27001, ISO 27002 Excel: ISO 27001/27002 Security Audit Questionnaire Excel (XLSX) Spreadsheet, John Kyriazoglou
