ISO/IEC 27001:2022 Audit-Readiness Rubric — Information Security Management
What this is: relevant to Regscribe's pharma/biotech customer because ISO 27001 is commonly pursued given the sensitivity of clinical trial and patient data — a related but distinct compliance need from GxP.
Sourcing note: the full ISO 27001 standard text is copyrighted and sold by ISO — no verbatim clause text is used below. Structure/paraphrase sourced from BSI Group (bsigroup.com) and ISMS.online, cross-checked; see regscribe-iso27001-pcidss-research memory for full sourcing detail. No quantified failure-pattern data (equivalent to the FDA Warning Letters / MHRA deficiency data used in the GxP rubrics) was researched for this standard — the "common failure pattern" column below is omitted rather than fabricated; only requirement/citation/evidence are populated.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance
ISMS core clauses (4-10)
| # | Requirement | Citation | Evidence of compliance |
|---|---|---|---|
| 1 | Internal/external issues affecting the ISMS identified; interested parties and their requirements documented; ISMS scope defined | ISO 27001:2022, Clause 4 | ISMS scope statement; documented context analysis |
| 2 | Top management demonstrates visible ownership: approves the information security policy, assigns roles/responsibilities/authorities, ensures resources are provided | ISO 27001:2022, Clause 5 | Approved Information Security Policy; documented role assignments; resourcing decisions |
| 3 | Formal risk assessment methodology applied; risk treatment plan produced; Statement of Applicability documents which of the 93 Annex A controls are implemented/excluded and why; measurable security objectives set | ISO 27001:2022, Clause 6 | Risk assessment methodology document; risk register; risk treatment plan; Statement of Applicability; documented security objectives |
| 4 | Resources, competence, awareness, communication, and control of documented information all addressed | ISO 27001:2022, Clause 7 | Training/competence records; awareness program evidence; document control procedure |
| 5 | Risk treatment plan executed in practice; risk assessments repeated at planned intervals or on significant change | ISO 27001:2022, Clause 8 | Operational records showing planned controls actually implemented; re-assessment records tied to change events |
| 6 | Monitoring/measurement/analysis/evaluation of the ISMS; scheduled internal audit program; periodic management review | ISO 27001:2022, Clause 9 | Internal audit programme and reports; management review minutes with defined agenda coverage |
| 7 | Nonconformities handled with root-cause analysis and corrective action; continual improvement demonstrated | ISO 27001:2022, Clause 10 | Nonconformity/corrective action log; evidence of ISMS changes resulting from findings |
Annex A control coverage (93 controls, 4 themes — 2022 version)
| # | Requirement | Citation | Evidence of compliance |
|---|---|---|---|
| 8 | Organizational controls implemented and documented where applicable per the Statement of Applicability (37 controls spanning policy, roles, asset management, access control, supplier relationships, incident management, business continuity, compliance) | ISO 27001:2022, Annex A §5 | Per-control implementation evidence referenced from the SoA; policy documents; asset inventory; access control matrix |
| 9 | People controls implemented (8 controls: screening, employment terms, awareness/training, disciplinary process, post-termination responsibilities, confidentiality, remote working, event reporting) | ISO 27001:2022, Annex A §6 | HR screening records; signed confidentiality agreements; training records; remote-working policy |
| 10 | Physical controls implemented (14 controls: perimeters, entry control, monitoring, environmental protection, secure areas, clear desk/screen, equipment protection, media handling, cabling, disposal) | ISO 27001:2022, Annex A §7 | Physical access logs; environmental monitoring records; asset disposal records |
| 11 | Technological controls implemented (34 controls: endpoint devices, privileged access, malware protection, vulnerability management, backup, logging, network security, cryptography, secure development lifecycle, change management) | ISO 27001:2022, Annex A §8 | Access control configuration; vulnerability scan reports; backup test records; logging/monitoring configuration; secure-SDLC evidence |
Documents/evidence typically needed
Information Security Policy; ISMS scope statement; risk assessment methodology and risk register; risk treatment plan; Statement of Applicability; security objectives; competence/training records; operational procedure documentation; internal audit programme and reports; management review records; nonconformity and corrective action records.
Pharma/biotech relevance
ISO 27001 is generic-industry, not pharma-specific. The fit is applying its access-control, encryption, and data-classification controls to clinical/patient data — commonly pursued alongside GxP, not instead of it.
Gaps/follow-ups
No quantified real-world audit-finding data (equivalent to FDA Warning Letters or MHRA deficiency-trend data) was found for ISO 27001 this session — the failure-pattern column present in the GxP rubrics is deliberately omitted here rather than fabricated. Certification-process granular timings (Stage 1/2 durations) are from a UKAS-accredited body (ISOQAR), not BSI-specific — see docs/iso27001-checklist.md for that detail.