{"text_format":"1","workbook":"xlsx","n_sheets":2,"sheets":["User Instructions","Tool"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"User Instructions","index":0,"n_rows":2,"n_cols":1,"rows_kept":2,"cut":false,"hidden":false,"merged":[[1,0,1,12]]}
[]
["Place your cursor within the text area and double click; this will enable you to scroll through these user instructions"]

{"sheet":"Tool","index":1,"n_rows":159,"n_cols":8,"rows_kept":159,"cut":false,"hidden":false,"merged":[[1,1,2,4],[4,1,4,5],[6,1,7,5],[5,1,5,6]]}
[]
[null,"ISO27002:2013 Gap Analysis and Audit Checklist Tool"]
[]
[]
[null,"Instructions on how to use this tool are in this workbook, on the worksheet tab called 'User Instructions'.",null,null,null,null,null,"Date Completed: [DD.MM.YYYY]"]
[null,"Answers to the question 'Is this control required' should be obtained through a high level risk assessment process."]
[null,"This Gap Analysis tool should always be used in conjunction with a copy of ISO/IEC 27002:2013, which is the authoritative source for these controls and for the description of their contents."]
[]
[]
[null,"1. Clause","2. Title","3. Control objective/control question","4. Compliant? Y/N/QY","5. Is this control required?","6. Action Required","7. Issues and comments"]
[null,5.0999999999999996,"Management direction for information security","Does management  provide direction and support for information security in accordance with business requirements and relevant laws and regulations?","N","Y"]
[null,"5.1.1","Policies for information security","Is there an information security policy document, or set of policies, that has been defined, approved by management, and has it been published and communicated to all employees and relevant external parties?","N","Y"]
[null,"5.1.2","Review of the policies for information security","Is there a procedure for the information security policy, or policies, to be reviewed at planned intervals or if significant changes occur, and does this process ensure its continuing suitability, adequacy, and effectiveness, and is there evidence that the policy (or policies) is applied?","N","y"]
[null,6.1,"Internal organization","Is there a management framework to initiate and control the implementation and operation of information security within the organization?","N","Y"]
[null,"6.1.1","Information security roles and responsibilities","Have all information security responsibilities been defined and allocated?","N","y"]
[null,"6.1.2","Segregation of duties","Have conflicting duties and areas of responsibility been segregated to reduce opportunities for unauthorised or unintentional modification or misuse of the organisation's assets?","N","Y"]
[null,"6.1.3","Contact with authorities","Does the organisation maintain appropriate contacts with relevant authorities?","N","Y"]
[null,"6.1.4","Contact with special interest groups","Does the organization maintain appropriate contact with special interest groups or other specialist security forums and professional associations?","N","Y"]
[null,"6.1.5","Information security in project management","Does the organisation address information security in project management, regardless of the type of project?","N","Y"]
[null,6.2,"Mobile devices and teleworking","Does the organisation ensure the security of teleworking and use of mobile devices?","N","Y"]
[null,"6.2.1","Mobile device policy","Does the organisation have a policy and supporting security measures to manage the risks introduced by the use of mobile devices?","N","Y"]
[null,"6.2.2","Teleworking","Does the organisation have a policy and supporting security measures to protect information accessed, processed or stored at teleworking sites?","N","Y"]
[null,7.1,"Prior to employment","Does the organisation ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered?","N","Y"]
[null,"7.1.1","Screening","Does the organisation conduct background verification checks on all candidates for employment, in accordance with relevant laws, regulations and ethics, and are these checks proportional to the business requirements, the classification of the information to be accessed and the perceived risks?","N","Y"]
[null,"7.1.2","Terms and conditions of employment","Do contractual agreements with employees and contractors state their and the organisation's responsibilities for information security?","N","Y"]
[null,7.2,"During employment","Does the organisation ensure that employees and contractors are aware of and fulfil their information security responsibilities?","N","Y"]
[null,"7.2.1","Management responsibilities","Does the organisation's management require all employees and contractors to apply information security in accordance with the organisation's established policies and procedures?","N","Y"]
[null,"7.2.2","Information security awareness, education and training","Does the organisation ensure that all employees and relevant contractors receive appropriate awareness education and training and regular updates in organisational policies and procedures, as relevant for their job function?","N","Y"]
[null,"7.2.3","Disciplinary process","Does the organisation have a formal and communicated disciplinary process in place to take action against employees who commit an information security breach?","N","Y"]
[null,7.3,"Termination and change of employment","Does the organisation protect its interests as part of the process of changing or terminating employment?","N","Y"]
[null,"7.3.1","Termination or change of employment responsibilities","Does the organisation define and enforce information security responsibilities and duties that remain valid after termination or change of employment, and are these communicated to the employee or contractor?","N","Y"]
[null,8.1,"Responsibility for assets","Has the organisation identified organisational assets and defined appropriate protection responsibilities?","N","Y"]
[null,"8.1.1","Inventory of assets","Has the organisation identified assets associated with information and information processing facilities, and has an inventory of these assets been drawn up and maintained?","N","Y"]
[null,"8.1.2","Ownership of assets","Have owners of the assets maintained in the asset inventory been identified?","N","Y"]
[null,"8.1.3","Acceptable use of assets","Has the organisation identified, documented and implemented rules for the acceptable use of information and of assets associated with information and information processing facilities?","N","Y"]
[null,"8.1.4","Return of assets","Does the organisation requite all employees and external party users to return all of the organisational assets in their possession upon termination of their employment, contract or agreement?","N","Y"]
[null,8.1999999999999993,"Information classification","Does the organisation ensure that information receives an appropriate level of protection in accordance with its importance to the organisation?","N","Y"]
[null,"8.2.1","Classification of information","Does the organisation classify information in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification?","N","Y"]
[null,"8.2.2","Labelling of information","Has the organisation developed and implemented an appropriate set of procedures for information labelling in accordance with the information classification scheme?","N","Y"]
[null,"8.2.3","Handling of assets","Has the organisation developed and implemented procedures for handling assets in accordance with the information classification scheme?","N","Y"]
[null,8.3000000000000007,"Media handling","Does the organisation prevent unauthorised disclosure, modification, removal or destruction of information stored on media?","N","Y"]
[null,"8.3.1","Management of removable media","Has the organisation implemented procedures for the management of removable media in accordance with the classification scheme?","N","Y"]
[null,"8.3.2","Disposal of media","Does the organisation have formal procedures for the disposal of media securely when no longer required?","N","Y"]
[null,"8.3.3","Physical media transfer","Does the organisation protect media containing information against unauthorised access, misuse or corruption during transportation?","N","Y"]
[null,9.1,"Business requirements of access control","Does the organisation limit access to information and information processing facilities?","N","Y"]
[null,"9.1.1","Access control policy","Has the organisation established, documented and reviewed an access control policy based on business and information security requirements?","N","Y"]
[null,"9.1.2","Access to networks and network services","Are users restricted to access only those networks and network services that they have been specifically authorised to use?","N","Y"]
[null,9.1999999999999993,"User access management","Does the organisation have processes in place to ensure authorised user access and to prevent unauthorised access to systems and services?","N","Y"]
[null,"9.2.1","User registration and de-registration","Is there a formal user registration and de-registration process to enable assignment of access rights?","N","Y"]
[null,"9.2.2","User access provisioning","Is there a formal user access provisioning process to assign or revoke access rights for all user types to all systems and services?","N","Y"]
[null,"9.2.3","Management of privileged access rights","Does the organisation restrict and control the allocation and use of privileged access rights?","N","Y"]
[null,"9.2.4","Management of secret authentication information of users","Does the organisation have a formal management process to control the allocation of secret authentication information?","N","Y"]
[null,"9.2.5","Review of user access rights","Do asset owners review users' access rights at regular intervals?","N","Y"]
[null,"9.2.6","Removal or adjustment of access rights","Does the organisation removal (or adjust) access rights of employees and external party users to information and information processing facilities upon termination (or change) of their employment, contract or agreement?","N","Y"]
[null,9.3000000000000007,"User responsibilities","Are users accountable for safeguarding their authentication information?","N","Y"]
[null,"9.3.1","Use of secret authentication information","Are users required to follow the organisation's established practices in the use of secret authentication information?","N","Y"]
[null,9.4,"System and application access control","Does the organisation prevent unauthorised access to systems and applications?","N","Y"]
[null,"9.4.1","Information access restriction","Does the organisation restrict access to information and application system functions in accordance with the access control policy?","N","Y"]
[null,"9.4.2","Secure log-on procedures","Is there a secure log-on procedure to control access to systems and applications where required by the access control policy?","N","Y"]
[null,"9.4.3","Password management system","Are the password management systems interactive and do they ensure quality passwords?","N","Y"]
[null,"9.4.4","Use of privileged utility programs","Is the use of utility programs that might be capable of overriding system and application controls restricted and tightly controlled?","N","Y"]
[null,"9.4.5","Access control to program source code","Is access to program source code restricted?","N","Y"]
[null,10.1,"Cryptographic controls","Is cryptography properly and effectively used to protect the confidentiality, authenticity and/or integrity of information?","N","Y"]
[null,"10.1.1","Policy on the use of cryptographic controls","Has the organization developed and implemented a policy on its use of cryptographic controls for protection of its information?","N","Y"]
[null,"10.1.2","Key management","Has the organisation developed and implemented a policy on the use, protection and lifetime of cryptographic keys?","N","Y"]
[null,11.1,"Secure areas","Does the organisation prevent unauthorised physical access, damage and interference to the organisation's information and information processing facilities?","N","Y"]
[null,"11.1.1","Physical security perimeter","Has the organisation defined security perimters, and does it use them to protect areas that contain either sensitive or critical information and information processing facilities?","N","Y"]
[null,"11.1.2","Physical entry controls","Are secure areas protected by appropriate entry controls to ensure that only authorised personnel are allowed access?","N","Y"]
[null,"11.1.3","Securing offices, rooms and facilities","Has the organisation designed and applied physical security for offices, rooms and facilities?","N","Y"]
[null,"11.1.4","Protecting against external and environmental threats","Has the organisation designed and applied physical protection against natural disasters, malicious attacks and accidents?","N","Y"]
[null,"11.1.5","Working in secure areas","Have procedures for working in secure areas been designed and applied?","N","Y"]
[null,"11.1.6","Delivery and loading areas","Does the organisation control or isolate access points such as delivery and loading areas, and other points where unauthorised persons could enter the premises?","N","Y"]
[null,11.2,"Equipment","Does the organisation prevent loss, damage, theft and compromise of assets and interruption to the organisation's operations?","N","Y"]
[null,"11.2.1","Equipment siting and protection","Is equipment sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorised access?","N","Y"]
[null,"11.2.2","Supporting utilities","Is equipment protected from power failures and other disruptions caused by failures in supporting utilities?","N","Y"]
[null,"11.2.3","Cabling security","Is power and telecommunication cabling carrying data or supporting information services protected from interception, interference and damage?","N","Y"]
[null,"11.2.4","Equipment maintenance","Is equipment correctly maintained to ensure continued availability and integrity?","N","Y"]
[null,"11.2.5","Removal of assets","Does the organisation prevent equipment, information and software from being taken off-site without prior authorisation?","N","Y"]
[null,"11.2.6","Security of equipment and assets off-premises","Is security applied to off-site assets, and does this take into account the different risks of working outside the organisation's premises?","N","Y"]
[null,"11.2.7","Secure disposal or re-use of equipment","Does the organisation have a procedure or procedures to verify that equipment containing storage media has had any sensitive data and licensed software removed or securely overwritten prior to disposal or re-use?","N","Y"]
[null,"11.2.8","Unattended user equipment","Do users ensure that unattended equipment has appropriate protection?","N","Y"]
[null,"11.2.9","Clear desk and clear screen policy","Is there a clear desk policy for papers and removable storage media, and a clear screen policy for information processing facilities?","N","Y"]
[null,12.1,"Operational procedures and responsibilities","Does the organisation ensure correct and secure operations of information processing facilities?","N","Y"]
[null,"12.1.1","Documented operating procedures","Are operating procedures documents and made available to all users who need them?","N","Y"]
[null,"12.1.2","Change management","Does the organisation control changes to the organisation, business processes, information processing facilities and systems that affect information security?","N","Y"]
[null,"12.1.3","Capacity management","Is the use of resources monitored and tuned, and are projections made of future capacity requirements, to ensure the required system performance?","N","Y"]
[null,"12.1.4","Separation of development, testing and operational environments","Are the development, testing and operational environments separated to reduce the risks of unauthorised access and changes to the operational environment?","N","Y"]
[null,12.2,"Protection from malware","Are information and information processing facilities protected against malware?","N","Y"]
[null,"12.2.1","Controls against malware","Has the organisation implemented detection, prevention and recovery controls to protect against malware, and this is combined with appropriate user awareness?","N","Y"]
[null,12.3,"Backup","Does the organisation protect against loss of data?","N","Y"]
[null,"12.3.1","Information backup","Is there an agreed backup policy, and are backup copies of information, software and system images taken and tested regularly in accordance with this policy?","N","Y"]
[null,12.4,"Logging and monitoring","Does the organisation record events and generate evidence?","N","Y"]
[null,"12.4.1","Event logging","Does the organisation produce, keep and regularly review event logs recording user activities, exceptions, faults and information security events?","N","Y"]
[null,"12.4.2","Protection of log information","Are logging facilities and log information protected against tampering and unauthorized access?","N","Y"]
[null,"12.4.3","Administrator and operator logs","Are system administrator and system operator activities logged, and are the logs protected and regularly reviewed?","N","Y"]
[null,"12.4.4","Clock synchronization","Are the clocks of all relevant information processing systems within an organization or security domain synchronized with a single reference time source?","N","Y"]
[null,12.5,"Control of operational software","Is the integrity of operational systems ensured?","N","Y"]
[null,"12.5.1","Installation of software on operational systems","Are procedures implemented to control the installation of software on operational systems?","N","Y"]
[null,12.6,"Technical vulnerability management","Does the organisation prevent the exploitation of technical vulnerabilities?","N","Y"]
[null,"12.6.1","Management of technical vulnerabilities","Is timely information about technical vulnerabilities of information systems being used obtained, is the organization’s exposure to such vulnerabilities evaluated, and are the appropriate measures taken to address the associated risk? ","N","Y"]
[null,"12.6.2","Restrictions on software installation","Has the organisation established and implemented rules governing the installation of software by users?","N","Y"]
[null,12.7,"Information systems audit considerations ","Does the organisation minimise the impact of audit activities on operational systems?","N","Y"]
[null,"12.7.1","Information systems audit controls","Are audit requirements and activities involving verification of operational systems carefully planned and agreed to minimize disruptions to business processes?","N","Y"]
[null,13.1,"Network security management","Does the organisation protect information in networks and supporting information processing facilities?","N","Y"]
[null,"13.1.1","Network controls","Are networks managed and controlls to protect information in systems and applications?","N","Y"]
[null,"13.1.2","Security of network services","Are security mechanisms, service levels and management requirements of all network services identified and included in network services agreements, whether provided in-house or outsourced?","N","Y"]
[null,"13.1.3","Segregation in networks","Are groups of information services, users and information systems segregated on networks?","N","Y"]
[null,13.2,"Information transfer","Is the security of information transferred within the organisation and with any external entity maintained?","N","Y"]
[null,"13.2.1","Information transfer policies and procedures","Are formal transfer policies, procedures and controls in place to protect the transfer of information through the use of all types of communication facilities?","N","Y"]
[null,"13.2.2","Agreements on information transfer","Do agreements address the secure transfer of business information between the organisation and external parties?","N","Y"]
[null,"13.2.3","Electronic messaging","Is information involved in electronic messaging appropriately protected?","N","Y"]
[null,"13.2.4","Confidentiality or non-disclosure agreements","Are requirements for confidentiality or non-disclosure agreements reflecting the organisations needs for the protection of information identified, regularly reviewed and documented?","N","Y"]
[null,14.1,"Security requirements of information systems","Does the organization ensure that security is an integral party of information systems, including those information systems that provide services over public networks?","N","Y"]
[null,"14.1.1","Information security requirements analysis and specification","Are information security related requirements included in the requirements for new information systemsand enhancements to existing information systems?","N","Y"]
[null,"14.1.2","Securing application services on public networks","Is information involved in application services passing over public networks protected from fraudulent activity, contract dispute and unauthorised disclosure and modification?","N","Y"]
[null,"14.1.3","Protecting application services transactions","Is information involved in application service transactions protected to prevent incomplete transmission, mis-routing, unauthorised message alteration, unauthorised disclosure, unauthorised message duplication and replay?","N","Y"]
[null,14.2,"Security in development and support processes","Is information security designed and implemented within the development lifecycle of information systems?","N","Y"]
[null,"14.2.1","Secure development policy","Are there established rules for the development of software and systems, and are they applied to developments within the organisation?","N","Y"]
[null,"14.2.2","System change control procedures","Are there formal change control procedures to control changes to systems within the development lifecycle?","N","Y"]
[null,"14.2.3","Technical review of applications after operating platform changes","When operating systems are changed, are business critical applications reviewed and tested to ensure there is no adverse impact on organizational operations or security?","N","Y"]
[null,"14.2.4","Restrictions on changes to software packages","Are modifications to software packages discouraged, limited to necessary changes and are all changes strictly controlled? ","N","Y"]
[null,"14.2.5","Secure system engineering principles","Have principles for engineering secure systems been established, documented and maintained, and have they been applied to information system implementation efforts?","N","Y"]
[null,"14.2.6","Secure development environment","Has the organisation established and appropriately protected secure development environments for system development and integration efforts, covering the entire system development lifecycle?","N","Y"]
[null,"14.2.7","Outsourced development","Does the organisation supervise and monitor the activity of outsourced system development?","N","Y"]
[null,"14.2.8","System security testing","Is testing of security functionality conducted during development?","N","Y"]
[null,"14.2.9","System acceptance criteria","Are there acceptance testing programs and have related criteria been established for new information systems, upgrades and new versions?","N","Y"]
[null,14.3,"Test data","Is data used for testing protected?","N","Y"]
[null,"14.3.1","Protection of test data","Is test data selected carefully, and is it protected and controlled?","N","Y"]
[null,15.1,"Information security in supplier relationships","Are the organisation's assets that are accessible by suppliers protected?","N","Y"]
[null,"15.1.1","Information security policy for supplier relationships","Are information security requirements for mitigating the risks associated with supplier's access to the organisation's assets agreed with the supplier and documented?","N","Y"]
[null,"15.1.2","Addressing security within supplier agreements","Are all relevant information security requirements established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure for, the organisation's information?","N","Y"]
[null,"15.1.3","Information and communication technology supply chain","Do agreements with suppliers include requirements to address the information security risks associated with information and communications technology services and product supply chain?","N","Y"]
[null,15.2,"Supplier service delivery management","Does the organisation maintain an agreed level of information security and service delivery in line with supplier agreements?","N","Y"]
[null,"15.2.1","Monitoring and review of supplier services","Does the organisation regularly monitor, review and audit supplier service delivery?","N","Y"]
[null,"15.2.2","Managing changes to supplier services","Does the organisation manage changes to the provision of services by suppliers, including maintaining and improving existing information security policies, procedures and controls, taking account of the criticality of business information, systems and processes involved, and re-assessment of risks?","N","Y"]
[null,16.100000000000001,"Management of information security incidents and improvements","Does the organization ensure that a consistent and effective approach is applied to the management of information security incidents, including communication on security events and weaknesses?","N","Y"]
[null,"16.1.1","Responsibilities and procedures","Has the organisation established management responsibilities and procedures to ensure a quick, effective and orderly response to information security incidents?","N","Y"]
[null,"16.1.2","Reporting information security events","Are information security events reported through appropriate management channels as quickly as possible?","N","Y"]
[null,"16.1.3","Reporting information security weaknesses","Does the organisation require employees and contractors using the organisation's information systems and services to note and report any observed or suspected information security weaknesses in systems or services?","N","Y"]
[null,"16.1.4","Assessment of and decision on information security events","Does the organisation assess information security events and make decisions as to whether they are classified as information security incidents?","N","Y"]
[null,"16.1.5","Response to information security incidents","Are information security incidents responded to in accordance with the documented procedures?","N","Y"]
[null,"16.1.6","Learning from information security incidents","Does the organisation use knowledge gained from analysing and resolving information security incidents to reduce the likelihood or impact of future incidents?","N","Y"]
[null,"16.1.7","Collection of evidence","Has the organisation defined and applied procedures for the identification, collection, acquisition and preservation of information that can serve as evidence?","N","Y"]
[null,17.100000000000001,"Information security continuity","Is information security continuity embedded in the organisation business continuity management systems?","N","Y"]
[null,"17.1.1","Planning information security continuity","Has the organisation determined its requirements for information security and the continuity of information security management in adverse situations (e.g. during a crisis or disaster)?","N","Y"]
[null,"17.1.2","Implementing information security continuity","Has the organisation established, documented implemented and maintained processes, procedures and controls that ensure the required level of continuity for information security during an adverse situation?","N","Y"]
[null,"17.1.3","Verify, review and evaluate information security continuity","Does the organisation verify the established and implemented information security continuity controls at regular intervals, ensuring that they are valid and effective during adverse situations?","N","Y"]
[null,17.2,"Redundancies","Is the availability of information processing facilities ensured?","N","Y"]
[null,"17.2.1","Availability of information processing facilities","Are information processing facilities implemented with redundancy sufficient to meet availability requirements?","N","Y"]
[null,18.100000000000001,"Compliance with legal and contractual requirements","Does the organisation avoid breaches of legal, statutory, regulatory and contractual obligations related to information security and of any security requirements?","N","Y"]
[null,"18.1.1","Identification of applicable legislation and contractual requirements","Have all relevant legislative, statutory, regulatory and contractual requirements and the organization’s approach to meet these requirements been explicitly identified and documented, and is it kept up to date for each information system and the organization? ","N","Y"]
[null,"18.1.2","Intellectual property rights (IPR)","Have appropriate procedures been implemented to ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products?","N","Y"]
[null,"18.1.3","Protection of records","Are records protected from loss, destruction, falsification, unauthorised access and unauthorised release, in accordance with legislatory, regulatory, contractual and business requirements?","N","Y"]
[null,"18.1.4","Privacy and protection of personally identifiable information","Does the organisation ensure provacy and protection of personally identifiable information as required in relevant legislation and regulations?","N","Y"]
[null,"18.1.5","Regulation of cryptographic controls","Are cryptographic controls used in compliance with all relevant agreements, legislation and regulations?","N","Y"]
[null,18.2,"Information security reviews","Does the organisation ensure that information security is implemented and operated in accordance with the organisational policies and procedures?","N","Y"]
[null,"18.2.1","Independent review of information security","Is the organisation's approach to managing information security and its implementation reviewed independently and at planned intervals or when significant changes occur?","N","Y"]
[null,"18.2.2","Compliance with security policies and standards","Do managers regularly review the compliance of information processing and procedures wiuthin their area of responsibility with the appropriate security policies, standards and other security requirements?","N","Y"]
[null,"18.2.3","Technical compliance review","Are information systems regularly checked for compliance with the organisation's information security policies and standards?","N","Y"]