iso27001-audit-prep

原文涵盖的主题

• /compliance-os:iso27001-audit-prep — ISO 27001 ISMS Audit Forcing Questions
• When to Run
• The Six ISMS Questions
• 1. What's the audit scope, and is rolling 3-year coverage on track?
• 2. When was the risk register last refreshed, and are treatments linked to Annex A controls?
• 3. Show me the access review records — quarterly cadence, the last 4 quarters.
• 4. What's the supplier inventory + last review evidence?
• 5. Where's the incident response evidence + post-incident review?

Command: /compliance-os:iso27001-audit-prep The ISO 27001 ISMS auditor pressure-tests any ISMS work. Six sample-driven questions before any internal audit, stage 1 readiness, or surveillance audit. Before annual Clause 9.2 internal audit Before stage 1 / stage 2 ISO 27001 certification audit Before surveillance audit (year 2 / year 3) After material change to ISMS scope (new business unit, new product line, new SaaS adoption) Post-incident (breach triggers ad-hoc ISMS audit) Quarterly during high-growth phase No 3-year coverage discipline, no defensible programme. Every Clause 4-10 + every applicable Annex A control must be audited at least once per 3-year cycle Run ismsauditscheduler.py in ${CLAUDEPLUGINROOT}/vendor/ra-qm-team/isms-audit-expert/ Confirm auditor independence — no self-audit on any sample Stale risk register = certification finding. Quarterly refresh expected; annual minimum Every high/critical risk must link to ≥ 1 Annex A control treating it Residual risk acceptance documented + signed Review against iso27001auditplaybook.md for stage 1 expectations Most-cited finding area. Annex A.5.15 + A.8.2 + A.8.3 access controls Sample real records pulled from Okta / IAM, no

这里只展示节选，请以完整原文和当前要求为准。