ISO 27001/27002 (2022) - Security Audit Questionnaires (Tool 1) (Excel XLSX)

BENEFITS OF THIS EXCEL DOCUMENT

1. Provides a framework for assessing the implementation of the information security controls of the new ISO 27K Information Security Controls, 2022 Version
2. Supports IT Consultants in ensuring the best implementation of information security controls according to the new version of ISO 27K-2022 Version

ISO 27001 EXCEL DESCRIPTION

Editor Summary ISO 27001/27002 (2022) - Security Audit Questionnaires (Tool 1) is an XLSX set of spreadsheets by John Kyriazoglou delivering 5 parts with 800 questions and an evaluation method covering over 93 control issues of the ISO 27K 2022 standard. Read more Parts include a README, Mandatory Requirements (Clause 4–10: 27 items, 68 questions), Annex A Organizational (A5: 37 controls, 302 questions), People (A6: 8 controls, 76 questions), Physical (A7: 14 controls, 74 questions), and Technological (A8: 34 controls, 280 questions). Sold as a digital download on Flevy with immediate digital download, it is used to assess ISO 27001/27002:2022 compliance across companies, departments, or business functions.

Use this set of spreadsheets when you need a clause-and-control-level assessment of ISO 27001/27002:2022 — for pre-certification gap analysis, internal audits, or periodic compliance reviews.
  CISOs and security leaders compiling a consolidated compliance snapshot for stakeholders using scored evaluation summaries and grades.
  Internal audit teams executing a full checklist-based readiness assessment across Clauses 4–10 and Annex A using the 800-question set.
  IT risk managers mapping technical controls to Annex A technological controls and recording evaluation grades.
  Compliance officers preparing documented findings and corrective action lists for certification auditors.
The clause-and-control mapping with scored evaluations follows standard compliance assessment practice used in assurance engagements.

This tool (set of spreadsheets) contains 5 parts with 800 questions and an evaluation method, for all control issues and areas (over 93) of the ISO 27K 2022 Version on all aspects of information security, as defined in this ISO standard.

These questionnaires may be used to support your efforts in assessing whether your company, organization or business function or department (herein ‘company') complies with the requirements of ISO Security standard ISO 27001/27002: 2022 version.

Contents
PART 1: README: Description of the spreadsheet and summary of results
PART 2: ISO 27K Mandatory Requirements (Clause 4 to 10): 27 + items, 68 questions
PART 3: ISO 27K Annex A: Organizational Controls (Clause A5): 37 controls, 302 questions
PART 4: This includes:
4.1 ISO 27K Annex A: People Controls (Clause A6): 8 controls, 76 questions
4.2 ISO 27K Annex A: Physical Controls (Clause A7): 14 controls, 74 questions
PART 5: ISO 27K Annex A: Technological Controls (Clause A8): 34 controls, 280 questions

Note: A set of implantation measures (assessment guidance, plans, policies, procedures, etc.) for each information security control is included in another tool. These measures, in a form of a word document, for each set of ISO 27001/27002 information security controls, are included in the tool titled ‘ISO 27K-2022 Version- Security Audit Questionnaires (Tool 2)'. This guidance and the associated policies, plans and procedures may assist you and support you in implementing the required information security controls better.
A Statement of Applicability (SOA) is included in another tool titled ‘ISO 27K-2022 Version- Statement of Applicability (SOA)'.

This comprehensive tool also includes detailed evaluation summaries for each control area, providing a clear snapshot of your organization's compliance status. The structured format allows for easy navigation and quick reference, ensuring that all critical aspects of information security are thoroughly assessed. Tailored for busy executives, this tool simplifies the audit process, enabling you to identify gaps and implement corrective actions efficiently. The inclusion of perfect scores and evaluation grades offers a quantifiable measure of your security posture, making it easier to communicate findings to stakeholders.

TOPIC FAQ

What are the main control areas covered by ISO 27001/27002:2022 assessments?

ISO 27001/27002:2022 assessments cover mandatory requirements (Clauses 4–10) and Annex A controls grouped into Organizational, People, Physical, and Technological areas. Example counts in the referenced tool show 27 mandatory items/68 questions and Annex A split into 37 organizational, 8 people, 14 physical, and 34 technological controls covering over 93 control issues.

How should I structure an audit questionnaire to assess ISO 27001/27002 compliance?

A practical structure separates a README/overview, Mandatory Requirements (Clauses 4–10), and Annex A by control type (Organizational, People, Physical, Technological), pairs each question with an evaluation method, and aggregates results into area-level summaries. A typical implementation is organized into 5 parts totaling 800 questions in XLSX format, as in ISO 27001/27002 (2022) - Security Audit Questionnaires (Tool 1).

What is Annex A in ISO 27002:2022 and how is it organized for assessments?

Annex A in the 2022 guidance is organized into thematic control groups: Organizational Controls (Clause A5), People Controls (A6), Physical Controls (A7), and Technological Controls (A8). An example breakdown shows 37 organizational controls (302 questions), 8 people controls (76 questions), 14 physical controls (74 questions), and 34 technological controls (280 questions).

How do evaluation methods typically present results in ISO 27001 questionnaires?

Evaluation methods present results as scored assessments per control area, producing detailed evaluation summaries, evaluation grades, and perfect-score references to indicate compliance levels. These summaries give a snapshot of status and support communication to stakeholders, typically provided per control area in the questionnaire output.

What should I look for when selecting an ISO 27001 audit questionnaire tool?

Choose a tool that explicitly maps Clauses 4–10 and Annex A controls, provides comprehensive question coverage, includes an evaluation method with area-level summaries and grades, and uses an editable format like spreadsheets. The ISO 27001/27002 (2022) - Security Audit Questionnaires (Tool 1) illustrates these traits with 800 questions and an evaluation method.

How does using a spreadsheet-based questionnaire add value compared with ad-hoc checklists?

Spreadsheet-based questionnaires offer structured navigation, editable records, and built-in aggregation for quantifiable metrics such as evaluation grades and perfect scores, simplifying stakeholder reporting and gap tracking. The referenced implementation demonstrates this with consolidated evaluation summaries and 800 questions in XLSX format.

How can questionnaires be used to prepare for an ISO 27001 certification audit?

Questionnaires identify control applicability and current-state gaps, allow teams to document evidence and corrective actions, and produce evaluation summaries to demonstrate readiness to auditors. For a full-scope preparation, using a clause-and-control checklist with scoring — such as the 800-question set in ISO 27001/27002 (2022) - Security Audit Questionnaires (Tool 1) — supports readiness reporting.

How do I map questionnaire findings into a Statement of Applicability (SOA)?

Use questionnaire evaluations to determine which controls are applicable, note implementation status and justification for exclusions, and populate the SOA with applicability decisions and evidence. The document overview indicates a separate tool titled 'ISO 27K-2022 Version- Statement of Applicability (SOA)' is provided for that purpose.

Source: Best Practices in ISO 27001, ISO 27002 Excel: ISO 27001/27002 (2022) - Security Audit Questionnaires (Tool 1) Excel (XLSX) Spreadsheet, John Kyriazoglou