Articles
ISO 27001
6 min
What to have ready before an ISO 27001 Stage 2 audit
Stage 2 audits the management system in operation, which means the auditor is looking for records that processes ran rather than documents saying they exist. The gap between a complete policy set and a passing Stage 2 is evidence.
6 min
Does ISO 27001 require a penetration test?
ISO/IEC 27001 does not use the phrase penetration test. Annex A 8.8 requires management of technical vulnerabilities and A 8.29 requires security testing. ISO/IEC 27002:2022, the implementation guidance for those controls, names penetration testing directly, which is why certification bodies expect it at Stage 2.