{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["Questionnaire","User Instructions","Management System"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":0,"defined_names":4,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Questionnaire","index":0,"n_rows":86,"n_cols":4,"rows_kept":86,"cut":false,"hidden":false,"merged":[]}
[]
[0,null,"Organization Information"]
[0.1,null,null,"Number of sites from which you business operates"]
[0.2,null,null,"Nature of business"]
[0.3,null,null,"Number of staff at locations:"]
[0.4,null,null,"Why are you looking at Information Security (issues, requirements)"]
[0.5,null,null,"Why are you interested in ISO27001? (internal, customer, incident)"]
[0.6,null,null,"Number of remote users"]
[0.7,null,null,"External interfaces with network (suppliers, VPNs, feeds)"]
[0.8,null,null,"What access do external users have to your information?"]
[0.9,null,null,"Is a curent risk approach documented?"]
["0.9A",null,null,"Is a copy of the risk analysis document available?"]
["0.9B",null,null,"Do you have any existing certifications? (ISO9001, etc.) Please provide details"]
[]
[]
[1,null,"Customer Personal Information and sensitivity of customer information"]
[1.1000000000000001]
[1.2,null,null,"Do you record customer details, names and addresses?"]
[1.3,null,null,"Do you record customer financial details, payment details or account information?"]
[1.4,null,null,"Do you record sales histories linked to customers?"]
[1.5,null,null,"Do you sell, share or distribute customer information?"]
[1.6,null,null,"Would your customers be concerned if information they gave you was stolen?"]
[1.7,null,null,"Do your customers mind you telling others that you work with them?"]
[]
[2,null,"Electronic information storage and systems"]
[2.1,null,null,"Do you store important information on computer databases?"]
[2.2000000000000002,null,null,"Do you use bespoke systems to access this information?"]
[2.2999999999999998,null,null,"Do you store customer information on multiple computer databases?"]
[2.4,null,null,"Do you control staff access to such databases?"]
[2.5,null,null,"Do you know exactly which staff members access the databases?"]
[2.6,null,null,"Do you know the physical locations where this information is stored?"]
[2.7,null,null,"Have you assigned an owner to this information?"]
[]
[3,null,"Non Electronic Information Storage and Systems"]
[3.1,null,null,"Do you store important information in apper or other non-electronic formats?"]
[3.2,null,null,"Is this information stored in multiple locations?"]
[3.3,null,null,"Do you have physical security protecting these stores? (i.e. locked cabinets)"]
[3.4,null,null,"Do you restrict access to such stores?"]
[3.5,null,null,"Do you know exactly which staff members access these stores?"]
[3.6,null,null,"Do you know physically where this information is stored?"]
[3.7,null,null,"Have you assigned an owner to this information?"]
[]
[4,null,"Building and location security"]
[4.0999999999999996,null,null,"Is your building accessible to the public?"]
[4.2,null,null,"Does your building have a security guard?"]
[4.3,null,null,"Does your building have an alarm system?"]
[4.4000000000000004,null,null,"Have you undertaken a risk assessment covering the building and contents?"]
[4.5,null,null,"Have you encountered building security issues previously? (eg theft)"]
[]
[5,null,"Staff Security Issues"]
[5.0999999999999996,null,null,"Do you take up staff references?"]
[5.2,null,null,"Do you undertake background checks on your staff?"]
[5.3,null,null,"Do staff have unrestricted access to the building?"]
[5.4,null,null,"Are you subject to special secuirty requirements? (i.e. positiive vetting)"]
[5.5,null,null,"Do staff sign 'Non disclosure agreements'?"]
[]
[6,null,"Information Identification"]
[6.1,null,null,"Have you identifiied all important informationwihtin your organization?"]
[6.2,null,null,"Have you identifiied the exact locaiton of all important information?"]
[6.3,null,null,"Are location and descriptions updated and available?"]
[6.4,null,null,"Have you a process for judging how important/valuable information is?"]
[6.5,null,null,"Have you assigned an owner to this information?"]
[]
[7,null,"Security Policies"]
[7.1,null,null,"Do you have security policies?"]
[7.2,null,null,"Do you make security policies available to staff?"]
[7.3,null,null,"Do all staff know and understand these policies?"]
[7.4,null,null,"Are the policies reviewed and updated?"]
[7.5,null,null,"Are staff trained in information security?"]
[]
[8,null,"Information Backups and Maintenance"]
[8.1,null,null,"Are internal information systems independently inspected?"]
[8.1999999999999993,null,null,"Are backups and copies taken of all important information?"]
[8.3000000000000007,null,null,"Are backups and copies appropriately tested and stored?"]
[8.4,null,null,"Do you have a disaster recovery plan?"]
[8.5,null,null,"Have you tested this plan?"]
[]
[9,null,"Compliance and Risk"]
[9.1,null,null,"Are you registered under the Data Protection Act?"]
[9.1999999999999993,null,null,"Is information security covered in customer/client conrtacts?"]
[9.3000000000000007,null,null,"Have you undertaken a risk assessment covering your information?"]
[9.4,null,null,"Have you identified specific threats to your information?"]
[9.5,null,null,"Have you taken positive action to mitigate these threats?"]
[9.6,null,null,"Do you have a Document Control procedure in place that meets the needs of another standard? (ISO9001, say)"]
[9.6999999999999993,null,null,"Do you have a Management Review process in place in accordance with another standard?"]
[9.8000000000000007,null,null,"Do you have an internal audit regime in place for another standard, such as ISO9901?"]

{"sheet":"User Instructions","index":1,"n_rows":1,"n_cols":1,"rows_kept":1,"cut":false,"hidden":false,"merged":[[0,0,0,13]]}
["Place your cursor within the text area and double click; this will enable you to scroll through these user instructions"]

{"sheet":"Management System","index":2,"n_rows":197,"n_cols":11,"rows_kept":197,"cut":false,"hidden":false,"merged":[[1,0,1,2],[4,3,4,5],[6,3,7,3],[190,0,190,2],[6,1,7,1],[6,2,7,2],[6,0,7,0],[6,7,7,7],[6,4,7,4],[6,5,7,5],[13,7,14,7],[6,6,7,6]]}
[]
["ISO27001 ISMS Gap Analysis Tool"]
[]
[]
[null,null,null,"Completed on: [DD.MM.YYYY]"]
[]
["Clause ISO27001","Title","Purpose/Clause","Documentation Required?","Compliant?\nY/N/QY","Documented ","Document Reference / Location","Issues and comments"]
[]
[4,"Context of the organisation"]
[4.0999999999999996,"Understanding the organisation and its context","Determine internal and external issues relevant to the organisation's purpose and that affect it's ability to achieve the intended outcome(s) of its ISMS.",null,"N","N"]
[4.2,"Understanding the needs and expectations of interested parties"]
["4.2.a",null,"Interested parties relevant to ISMS identified",null,"N","N",null,null,null,null," "]
["4.2.b",null,"Requirements of interested parties relevant to ISMS identified",null,"N","N"]
[4.3,"Determining the scope of the ISMS","Documented scope","Yes","N","N"]
["4.3.a",null,"Scope incorporates 4.1",null,"N","N"]
["4.3.b",null,"Scope incorporates 4.2",null,"N","N"]
["4.3.c",null,"Scope recognises the interfaces and dependencies between activities handled by the organisation and those handled by external parties",null,"N","N"]
[4.4000000000000004,"ISMS","The ISMS is established, implemented, maintained and continually improved, in accordance with ISO27001.",null,"N","N"]
[5,"Leadership"]
[5.0999999999999996,"Leadership and commitment","Top management demonstrates leadership and commitment to the ISMS",null,"N","N"]
["5.1.a",null,"Information security policy established in line with the organisation's strategic direction","Yes","N","N"]
[null,null,"Information security objectives established in line with the organisation's strategic direction",null,"N","N"]
["5.1.b",null,"ISMS requirements are integrated into the organisation's processes",null,"N","N"]
["5.1.c",null,"Resources for the ISMS are available",null,"N","N"]
["5.1.d",null,"Communicate importance of effective information security management and of conforming to ISMS requirements",null,"N","N"]
["5.1.e",null,"Ensure ISMS achieves intended outcomes",null,"N","N"]
["5.1.f",null,"Direct and support persons involved in the ISMS",null,"N","N"]
["5.1.g",null,"Promote continual improvement",null,"N","N"]
["5.1.h",null,"Support management roles demonstrating leadership in the ISMS",null,"N","N"]
[5.2,"Policy","Establish an information security policy",null,"N","N"]
["5.2.a",null,"Policy is appropriate to the purpose of the organisation",null,"N","N"]
["5.2.b",null,"Policy includes information security objectives or framework for setting information security objectives",null,"N","N"]
["5.2.c",null,"Policy commits to satisfy applicable requirements for information security",null,"N","N"]
["5.2.d",null,"Policy commits to continual improvement of ISMS",null,"N","N"]
["5.2.e",null,"Policy is documented",null,"N","N"]
["5.2.f",null,"Policy is communicated within the organisation",null,"N","N"]
["5.2.g",null,"Policy is appropriately available to interested parties",null,"N","N"]
[5.3,"Organisational roles, responsibilities and authorities","Top management assign responsibilities and authorities for roles relevant to information security",null,"N","N"]
[null,null,"Top management communicate responsibilities and authorities for roles relevant to information security",null,"N","N"]
["5.3.a",null,"Responsibility and authority assigned for ensuring ISMS conforms to ISO27001",null,"N","N"]
["5.3.b",null,"Responsibility and authority assigned for reporting ISMS performance to top management",null,"N","N"]
[6.1,"Actions to address risks and opportunities"]
["6.1.1","General","When planning for ISMS, the organisation will:",null,"N","N"]
[null,null,"consider issues referred to 4.1 and requirements in 4.2",null,"N","N"]
[null,null,"determine risks and opportunities that need to be addressed to:",null,"N","N"]
["6.1.1.a",null,"Ensure ISMS can achieve intended outcomes",null,"N","N"]
["6.1.1.b",null,"Prevent or redice undesired effects",null,"N","N"]
["6.1.1.c",null,"Achieve continual improvement.",null,"N","N"]
["6.1.1.d",null,"Organisation will plan actions to address the identified risks and opportunities",null,"N","N"]
["6.1.1.e.1",null,"Organisation will plan how to integrate the actions into ISMS processes",null,"N","N"]
["6.1.1.e.2",null,"Organisation will plan how to evaluate effectiveness of actions",null,"N","N"]
["6.1.2","Information security risk assessment","Define and apply a risk assessment process",null,"N","N"]
[null,null,"Retain documented information about risk assessment process","Yes","N","N"]
["6.1.2.a",null,"Establish and maintain information security risk criteria, including:",null,"N","N"]
["6.1.2.a.1",null,"risk acceptance criteria",null,"N","N"]
["6.1.2.a.2",null,"criteria for performing information security risk assessments.",null,"N","N"]
["6.1.2.b",null,"Risk assessments produce contistent, valid and comparable results",null,"N","N"]
["6.1.2.c",null,"Risk assessments identify security risks:",null,"N","N"]
["6.1.2.c.1",null,"risks associated with loss of confidentiality, integrity and availability",null,"N","N"]
["6.1.2.c.2",null,"identify risk owners.",null,"N","N"]
["6.1.2.d",null,"Analyse information security risks:",null,"N","N"]
["6.1.2.d.1",null,"assess consequences of 6.1.2.c.1",null,"N","N"]
["6.1.2.d.2",null,"assess likelihood of 6.1.2.c.1",null,"N","N"]
["6.1.2.d.3",null,"determine levels of risk.",null,"N","N"]
["6.1.2.e",null,"evaluate information security risks:",null,"N","N"]
["6.1.2.e.1",null,"comparison of risk analysis with risk criteria (6.1.2.a)",null,"N","N"]
["6.1.2.e.2",null,"prioritise risks for risk treatment.",null,"N","N"]
["6.1.3","Information security risk treatment","Apply risk treatment plan",null,"N","N"]
[null,null,"Retain documented information about information security risk treatment process","Yes","N","N"]
["6.1.3.a",null,"Selection of appropriate risk treatment options",null,"N","N"]
["6.1.3.b",null,"Determine controls necessary (from any source)",null,"N","N"]
["6.1.3.c",null,"Compare controls in 6.1.3.b to those in Annex A",null,"N","N"]
["6.1.3.d",null,"Statement of Applicability",null,"N","N"]
["6.1.3.e",null,"Information security risk treatment plan",null,"N","N"]
["6.1.3.f",null,"Risk owner approval for treatment plan and residual risk",null,"N","N"]
[6.2,"Information security objectives and planning to achieve them","Establish information security objectives",null,"N","N"]
[null,null,"Retain documented information on the information security objectives","Yes","N","N"]
["6.2.a",null,"Objectives are consistent with the information security policy",null,"N","N"]
["6.2.b",null,"Objectives are measurable",null,"N","N"]
["6.2.c",null,"Objectives take account of information security requirements, and results from risk assessment and risk treatments",null,"N","N"]
["6.2.d",null,"Objectives are communicated",null,"N","N"]
["6.2.e",null,"Objectives are updated as appropriate",null,"N","N"]
["6.2.f",null,"When planning how to achieve objectives, determine: what will be done",null,"N","N"]
["6.2.g",null,"what resources are required",null,"N","N"]
["6.2.h",null,"who is responsible",null,"N","N"]
["6.2.i",null,"when it will be completed",null,"N","N"]
["6.2.j",null,"how the results will be evaluated.",null,"N","N"]
[7,"Support"]
[7.1,"Resources","Determine and provide resources necessary to establish, implement, maintain and continually improve the ISMS",null,"N","N"]
[7.2,"Competence"]
["7.2.a",null,"Determine necessary competence for work affecting information security performance",null,"N","N"]
["7.2.b",null,"Ensure competence on basis of education, training or experience",null,"N","N"]
["7.2.c",null,"Take action to acquire necessary competence; evaluate effectiveness of actions.",null,"N","N"]
["7.2.d",null,"Retain documentation of evidence of competence","Yes","N","N"]
[7.3,"Awareness","Persons doing work under the organisation's control are aware of:",null,"N","N"]
["7.3.a",null,"information security policy",null,"N","N"]
["7.3.b",null,"their contribution to effectiveness of the ISMS, including benefits of improved information security performance",null,"N","N"]
["7.3.c",null,"implications of not conforming with ISMS requirements",null,"N","N"]
[7.4,"Communication","Determine the need for internal and external communications re. ISMS, including:",null,"N","N"]
["7.4.a",null,"what to communicate",null,"N","N"]
["7.4.b",null,"when to communicate",null,"N","N"]
["7.4.c",null,"with whom to communicate",null,"N","N"]
["7.4.d",null,"who shall communicate",null,"N","N"]
["7.4.e",null,"the process of communication.",null,"N","N"]
[7.5,"Documented information"]
["7.5.1","General","ISMS includes:","Yes","N","N"]
["7.5.1.a",null,"documents required by ISO27001:2013","Yes","N","N"]
["7.5.1.b",null,"documents required by the organisation for the effectiveness of the ISMS","Yes","N","N"]
["7.5.2","Creating and updating","When creating and updating documents, ensure appropriate:",null,"N","N"]
["7.5.2.a",null,"identification and description",null,"N","N"]
["7.5.2.b",null,"format and media",null,"N","N"]
["7.5.2.c",null,"review and approval for suitability and adequacy.",null,"N","N"]
["7.5.3","Control of documented information","Documented information is controlled to ensure:",null,"N","N"]
["7.5.3.a",null,"available and suitable for use, where and when necessary",null,"N","N"]
["7.5.3.b",null,"adequately protected.",null,"N","N"]
["7.5.3.c",null,"Address distribution, access, retrieval and use of documented information",null,"N","N"]
["7.5.3.d",null,"Address storage and preservation of documented information",null,"N","N"]
["7.5.3.e",null,"Address change control for documented information",null,"N","N"]
["7.5.3.f",null,"Address retention and disposition of documented information",null,"N","N"]
[null,null,"External documentation is identified as such, and controlled.",null,"N","N"]
[8,"Operation"]
[8.1,"Operational planning and control","Plan, implement and control the processes for information security requirements",null,"N","N"]
[null,null,"Implement the actions in 6.1",null,"N","N"]
[null,null,"Implement plans to achieve the information security objectives in 6.2",null,"N","N"]
[null,null,"Documents necessary to carry out processes as planned","Yes","N","N"]
[null,null,"Control planned changes",null,"N","N"]
[null,null,"Review consequences of unintended changes, taking action to mitigate adverse effects as necessary",null,"N","N"]
[null,null,"Ensure that outsourced processes are determined and controlled.",null,"N","N"]
[8.1999999999999993,"Information security risk assessment","Perform risk assessments at planning intervals or when significant changes are proposed or occur",null,"N","N"]
[null,null,"Retain documentation of the results of the risk assessments","Yes","N","N"]
[8.3000000000000007,"Information security risk treatment","Implement the risk treatment plan",null,"N","N"]
[null,null,"Retain documentation of the results of the risk treatment","Yes","N","N"]
[9,"Performance evaluation"]
[9.1,"Monitoring, measurement, analysis and evaluation","Evaluate information security performance and effectiveness of the ISMS",null,"N","N"]
["9.1.a",null,"Determine what needs to be monitored and measured, incl. processes and controls",null,"N","N"]
["9.1.b",null,"Determine methjods of monitoring, measuring, analysis and evaluation, ensuring valid results",null,"N","N"]
[null,null,"Results to be comparable and reproducible",null,"N","N"]
["9.1.c",null,"Determine when monitoring is performed",null,"N","N"]
["9.1.d",null,"Determine who monitors and measures",null,"N","N"]
["9.1.e",null,"Determine when results are analysed and evaluated",null,"N","N"]
["9.1.f",null,"Determine who analyses and evaluates results",null,"N","N"]
[null,null,"Retain documented information as evidence of monitoring and measurement results","Yes","N","N"]
[9.1999999999999993,"Internal audit","Conduct internal audits at planned intervals",null,"N","N"]
["9.2.a",null,"Audits to ensure the ISMS conforms to:",null,"N","N"]
["9.2.a.1",null,"organisation's requirements for the ISMS",null,"N","N"]
["9.2.a.2",null,"requirements of ISO27001:2013.",null,"N","N"]
["9.2.b",null,"Audits ensure the ISMS is effectively planned and implemented",null,"N","N"]
["9.2.c",null,"Plan, establish, implement and maintain an audit programme",null,"N","N"]
[null,null,"include frequency, methods, responsibilities, planning requirements and reporting",null,"N","N"]
[null,null,"Take into consideration the importance of the processes concerned and results of previous audits",null,"N","N"]
["9.2.d",null,"Define audit criteria",null,"N","N"]
[null,null,"Define scope of each audit",null,"N","N"]
["9.2.e",null,"Select auditors",null,"N","N"]
[null,null,"Conduct audits that ensure objectivity and impartiality",null,"N","N"]
["9.2.f",null,"Audit results are reported to relevant management",null,"N","N"]
["9.2.g",null,"Retain documentation as evidence of the audit programme and results","Yes","N","N"]
[9.3000000000000007,"Management review","Top management reviews the ISMS at planned intervals",null,"N","N"]
[null,null,"Ensure continuing suitability, adequacy and effectiveness",null,"N","N"]
["9.3.a",null,"Review considers the status of actions from previous management reviews",null,"N","N"]
["9.3.b",null,"Review considers changes in internal and external issues relevant to the ISMS",null,"N","N"]
["9.3.c",null,"Review considers feedback on information security performance, including trends in:",null,"N","N"]
["9.3.c.1",null,"nonconformities and corrective actions",null,"N","N"]
["9.3.c.2",null,"monitoring and measurement results",null,"N","N"]
["9.3.c.3",null,"audit results",null,"N","N"]
["9.3.c.4",null,"fulfilment of information security objectives.",null,"N","N"]
["9.3.d",null,"Review considers feedback from interested parties",null,"N","N"]
["9.3.e",null,"Review considers results of risk assessment and status of risk treatment plan",null,"N","N"]
["9.3.f",null,"Review considers opportunities for continual improvement",null,"N","N"]
[null,null,"Review outputs include decisions related to continual improvements opportunities",null,"N","N"]
[null,null,"Review outputs include decisions related to need for changes to the ISMS",null,"N","N"]
[null,null,"Retain documented information as evidence of the management reviews","Yes","N","N"]
[10,"Improvement"]
[10.1,"Nonconformity and corrective action","When nonconformity occurs:",null,"N","N"]
["10.1.a",null,"react to the nonconformity, and:",null,"N","N"]
["10.1.a.1",null,"tack action to control and correct it",null,"N","N"]
["10.1.a.2",null,"deal with consequences.",null,"N","N"]
["10.1.b",null,"evaluate need for action to eliminate the cause of nonconformity, by:",null,"N","N"]
["10.1.b.1",null,"reviewing the nonconformity",null,"N","N"]
["10.1.b.2",null,"determining the causes of the nonconformity",null,"N","N"]
["10.1.b.3",null,"determining if similar nonconformities exist or could occur.",null,"N","N"]
["10.1.c",null,"implement necessary actions",null,"N","N"]
["10.1.d",null,"review effectiveness of any actions taken",null,"N","N"]
["10.1.e",null,"make changes to the ISMS if necessary.",null,"N","N"]
[null,null,"Corrective actions are appropriate to the effects of the nonconformities",null,"N","N"]
[null,null,"Retain documented information as evidence of:","Yes","N","N"]
["10.1.f",null,"nature of the nonconformities and subsequent actions taken","Yes","N","N"]
["10.1.g",null,"results of any corrective action.","Yes","N","N"]
[10.199999999999999,"Continual improvement","Improve suitability of the ISMS",null,"N","N"]
[null,null,"Improve adequacy of the ISMS",null,"N","N"]
[null,null,"Improve effectiveness of the ISMS",null,"N","N"]
["Not mandatory but consider:"]
[null,null,"Risks associated with open corrective actions assessed and added to risk register"]
[null,null,"Risk management combined with preventive action to avoid duplication and confusion"]
[null,null,"ISMS itself added to asset inventory"]
[null,null,"Risk assessments conducted on ISMS"]
[null,null,"Corrective/preventive actions taken, controls implemented to preserve confidentiality, integrity and availability of ISMS"]
[null,null,"BC plans developed and tested to sustain key ISMS products and services through disruptive incidents"]