With ISO 27001, what do you audit against?

Organisations are required to conduct audits to provide evidence of conformance to:

• The organisation’s own requirements for its ISMS
• The mandatory clauses of the standard (clauses 4-10)
• ISO 27001 Annex A (and other) controls which are included within the scope of the ISMS

Audits can also be aligned to processes, many of which will be been developed to meet the objectives of your ISMS and will complement the implementation of the clauses and controls of the Standard.