$-ѴѴ;uĹ ;=bmbu Ѵov 0f;|bˆov 7;

";]†ub7-77;Ѵ-m=oul-1bॕm

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

41
 ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

42
ƕĺ"orou|;
7.1 Recursos

-ou]-mbŒ-1bॕm7;0;7;|;ulbm-u‹ruorou1bom-u
Ѵovu;1†uvovm;1;v-ubovr-u-;Ѵ;v|-0Ѵ;1blb;m|oķ
blrѴ;l;m|-1bॕmķl-m|;mblb;m|o‹l;fou-1omঞm†-
7;Ѵ vbv|;l- 7; ];vঞॕm 7; Ѵ- v;]†ub7-7 7; Ѵ-
bm=oul-1bॕmĺ

7.2 Competencia
La organización debe:

ĺ ;|;ulbm-uѴ-1olr;|;m1b-m;1;v-ub-7;Ѵ-vr;uvom-vt†;u;-ѴbŒ-mķ0-fov†1om|uoѴķ†m|u-0-fot†;
-=;1|--v†7;v;lr;ोo;mv;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
ĺ v;]†u-uv; t†; ;v|-v r;uvom-v v;-m 1olr;|;m|;vķ 0-v࢙m7ov; ;m Ѵ- ;7†1-1bॕmķ =oul-1bॕm o
;Šr;ub;m1b--7;1†-7-vĺ
ĺ †-m7ov;--rѴb1-0Ѵ;ķrom;u;ml-u1_--11bom;vr-u--7t†bubuѴ-1olr;|;m1b-m;1;v-ub-‹;ˆ-Ѵ†-u
Ѵ-;=b1-1b-7;Ѵ-v-11bom;vѴѴ;ˆ-7-v-1-0oĺ
ĺ omv;uˆ-uѴ-bm=oul-1bॕm7o1†l;m|-7--ruorb-7-ķ1olo;ˆb7;m1b-7;Ѵ-1olr;|;m1b-ĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

$Ĺ-v-11bom;v-rѴb1-0Ѵ;vr†;7;mbm1Ѵ†buķrou;f;lrѴoĹѴ-=oul-1bॕmķѴ-|†|ouझ-oѴ-u;-vb]m-1bॕm
7;Ѵ-vr;uvom-v;lrѴ;-7-v-1|†-Ѵl;m|;ĸoѴ-1om|u-|-1bॕm7;r;uvom-v1olr;|;m|;vĺ
7.3 Concienciación
-vr;uvom-vt†;|u-0-f-m0-fo;Ѵ1om|uoѴ7;Ѵ-
ou]-mbŒ-1bॕm7;0;mv;u1omv1b;m|;v7;Ĺ

ĺ -roѴझ|b1-7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
ĺ "† 1om|ub0†1bॕm - Ѵ- ;=b1-1b- 7;Ѵ vbv|;l- 7;
];v|bॕm 7; Ѵ- v;]†ub7-7 7; Ѵ- bm=oul-1bॕmķ
bm1Ѵ†‹;m7o Ѵov 0;m;=b1bov 7; †m- l;fou- 7;Ѵ
7;v;lr;ोo;mv;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
ĺ -v blrѴb1-1bom;v 7; mo 1†lrѴbu 1om Ѵov
u;t†bvb|ov 7;Ѵ vbv|;l- 7; ];v|bॕm 7; Ѵ-
v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

43
 7.4 Comunicación

- ou]-mbŒ-1bॕm 7;0; 7;|;ulbm-u Ѵ- m;1;vb7-7 7;

1ol†mb1-1bom;v bm|;um-v ‹ ;Š|;um-v r;uঞm;m|;v -Ѵ
vbv|;l-7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmķ
t†;bm1Ѵ†‹-mĹ

ĺ Ѵ1om|;mb7o7;Ѵ-1ol†mb1-1bॕmĺ
ĺ †࢙m7o1ol†mb1-uĺ
ĺ t†b࣐m1ol†mb1-uĺ
ĺ †b࣐m7;0;1ol†mb1-uĺ
ĺ ov ruo1;vov rou Ѵov t†; 7;0; ;=;1|†-uv; Ѵ-
1ol†mb1-1bॕmĺ
7.5 Información Documentada
7.5.1 Consideraciones Generales

Ѵvbv|;l-7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕm7;Ѵ-ou]-mbŒ-1bॕm7;0;bm1Ѵ†buĹ

ĺ -bm=oul-1bॕm7o1†l;m|-7-u;t†;ub7-rou;v|-moul-bm|;um-1bom-Ѵĺ
ĺ -bm=oul-1bॕm7o1†l;m|-7-t†;Ѵ-ou]-mbŒ-1bॕm_-7;|;ulbm-7ot†;;vm;1;v-ub-r-u-Ѵ-;=b1-1b-
7;Ѵvbv|;l-7;];v|bॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

$Ĺ Ѵ-Ѵ1-m1;7;Ѵ-bm=oul-1bॕm7o1†l;m|-7-r-u-†mvbv|;l-7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-
bm=oul-1bॕmr†;7;v;u7b=;u;m|;7;†m-ou]-mbŒ-1bॕm-o|u-ķ7;0b7o-Ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

Ɛĺ Ѵ|-l-ोo7;Ѵ-ou]-mbŒ-1bॕm‹-v†|bro7;-1|bˆb7-7;vķruo1;vovķruo7†1|ov‹v;uˆb1bovĺ
Ƒĺ -1olrѴ;fb7-77;Ѵovruo1;vov‹v†vbm|;u-11bom;vĺ
ƒĺ -1olr;|;m1b-7;Ѵ-vr;uvom-vĺ

7.5.2 Creación y Actualización

†-m7ov;1u;-‹-1|†-ѴbŒ-Ѵ-bm=oul-1bॕm7o1†l;m|-7-ķѴ-ou]-mbŒ-1bॕm7;0;-v;]†u-uv;ķ;mѴ-
l-m;u-t†;1ouu;vrom7-ķ7;Ѵovb]†b;m|;Ĺ

ĺ -b7;m|b=b1-1bॕm‹7;v1ubr1bॕmŐrou;f;lrѴoķ|झ|†Ѵoķ=;1_-ķ-†|ouomিl;uo7;u;=;u;m1b-őĺ
ĺ Ѵ =oul-|o Őrou ;f;lrѴoķ b7bol-ķ ˆ;uvbॕm 7;Ѵ vo=|‰-u;ķ ]u࢙=b1ovő ‹ v†v l;7bov 7; vorou|; Őrou
;f;lrѴoķr-r;Ѵķ;Ѵ;1|uॕmb1oőĺ
ĺ -u;ˆbvbॕm‹-ruo0-1bॕm1omu;vr;1|o-Ѵ-b7om;b7-7‹-7;1†-1bॕmĺ

44
7.5.3 Control de la Información Documentada

-bm=oul-1bॕm7o1†l;m|-7-u;t†;ub7-rou;Ѵvbv|;l-
7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕm‹rou;v|-
moul-bm|;um-1bom-Ѵv;7;0;1om|uoѴ-ur-u--v;]†u-uv;
t†;Ĺ

ĺ v|࣐ 7bvromb0Ѵ; ‹ ru;r-u-7- r-u- v† †voķ 7ॕm7; ‹

1†࢙m7ov;m;1;vb|;ĺ
ĺ v|࣐ruo|;]b7--7;1†-7-l;m|;Őrou;f;lrѴoķ1om|u-
r࣐u7b7- 7; Ѵ- 1om=b7;m1b-Ѵb7-7ķ †vo bm-7;1†-7oķ o
r࣐u7b7-7;bm|;]ub7-7őĺ
-u-;Ѵ1om|uoѴ7;Ѵ-bm=oul-1bॕm7o1†l;m|-7-ķѴ-ou]-mbŒ-1bॕm7;0;|u-|-uѴ-vvb]†b;m|;v-1ঞˆb7-7;vķ
v;]িmv;--rѴb1-0Ѵ;Ĺ

ĺ bv|ub0†1bॕmķ-11;voķu;1†r;u-1bॕm‹†voĺ
ĺ Ѵl-1;m-lb;m|o‹ru;v;uˆ-1bॕmķbm1Ѵ†b7-Ѵ-ru;v;uˆ-1bॕm7;Ѵ-Ѵ;]b0bѴb7-7ĺ
ĺ om|uoѴ7;1-l0bovŐrou;f;lrѴoķ1om|uoѴ7;ˆ;uvbॕmőĺ
ĺ !;|;m1bॕm‹7bvrovb1bॕmĺ

-bm=oul-1bॕm7o1†l;m|-7-7;oub];m;Š|;umoķt†;Ѵ-ou]-mbŒ-1bॕm_-7;|;ulbm-7ot†;;vm;1;v-ub-r-u-
Ѵ-rѴ-mbC1-1bॕm‹or;u-1bॕm7;Ѵvbv|;l-7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmv;7;0;b7;mঞC1-u‹
1om|uoѴ-uķv;]িmv;--7;1†-7oĺ

$Ĺ Ѵ-11;voblrѴb1-†m-7;1bvbॕm1om1;umb;m|;-Ѵr;ulbvovoѴ-l;m|;r-u-1omv†Ѵ|-uѴ-bm=oul-1bॕm

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

7o1†l;m|-7-ķo;Ѵr;ulbvo‹Ѵ--†|oub7-7r-u-1omv†Ѵ|-u‹lo7bC1-uѴ-bm=oul-1bॕm7o1†l;m|-7-ķ;|1ĺ

45
 ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

46
Ѷĺr;u-1bॕm
ѶĺƐѴ-mbC1-1bॕm‹om|uoѴr;u-1bom-Ѵ

-ou]-mbŒ-1bॕm7;0;rѴ-mbC1-uķblrѴ;l;m|-u‹1om|uoѴ-uѴovruo1;vovm;1;v-ubovr-u-1†lrѴbuѴov
u;t†bvb|ov 7; v;]†ub7-7 7; Ѵ- bm=oul-1bॕm‹ r-u- blrѴ;l;m|-u Ѵ-v -11bom;v 7;|;ulbm-7-v ;m ;Ѵ
-r-u|-7oѵĺƐĺ-ou]-mbŒ-1bॕm7;0;blrѴ;l;m|-u|-l0b࣐mrѴ-m;vr-u--Ѵ1-mŒ-uѴovo0f;ঞˆov7;
v;]†ub7-77;Ѵ-bm=oul-1bॕm7;|;ulbm-7ov;m;Ѵ-r-u|-7o6.2.

m Ѵ- l;7b7- m;1;v-ub- Ѵ- ou]-mbŒ-1bॕm 7;0; l-m|;m;u bm=oul-1bॕm 7o1†l;m|-7-ķ r-u- |;m;u Ѵ-
1omC-mŒ-7;t†;Ѵovruo1;vovv;_-mѴѴ;ˆ-7o-1-0ov;]িmѴorѴ-mbC1-7oĺ

-ou]-mbŒ-1bॕm7;0;1om|uoѴ-uѴov1-l0bovrѴ-mbC1-7ov‹u;ˆbv-uѴ-v1omv;1†;m1b-v7;Ѵov1-l0bov
moru;ˆbv|ovķѴѴ;ˆ-m7o-1-0o-11bom;vr-u-lbঞ]-uѴov;=;1|ov-7ˆ;uvovķ1†-m7ov;-m;1;v-uboĺ

-ou]-mbŒ-1bॕm7;0;]-u-mঞŒ-ut†;Ѵovruo1;vov1om|u-|-7ov;Š|;um-l;m|;;v|࣐m1om|uoѴ-7ovĺ

8.2 Apreciación de los Riesgos de

Seguridad de la Información
- ou]-mbŒ-1bॕm 7;0; ;=;1|†-u -ru;1b-1bom;v 7;

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ub;v]ov7;v;]†ub7-77;Ѵ-bm=oul-1bॕm-bm|;uˆ-Ѵov
rѴ-mbC1-7ovķ‹1†-m7ov;ruorom]-mov;ruo7†Œ1-m
lo7bC1-1bom;vblrou|-m|;vķ|;mb;m7o;m1†;m|-Ѵov
1ub|;ubov;v|-0Ѵ;1b7ov;m;Ѵr†m|o6.1.2 a).

- ou]-mbŒ-1bॕm 7;0; 1omv;uˆ-u bm=oul-1bॕm

7o1†l;m|-7-7;Ѵovu;v†Ѵ|-7ov7;Ѵ-v-ru;1b-1bom;v
7;ub;v]ov7;v;]†ub7-77;bm=oul-1bॕmĺ

47
 ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

48
49
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)
 8.3 Tratamiento de los Riesgos de Seguridad de la Información

- ou]-mbŒ-1bॕm 7;0; blrѴ;l;m|-u ;Ѵ rѴ-m 7;

|u-|-lb;m|o 7; Ѵov ub;v]ov 7; v;]†ub7-7 7; Ѵ-
bm=oul-1bॕmĺ

- ou]-mbŒ-1bॕm 7;0; 1omv;uˆ-u bm=oul-1bॕm

7o1†l;m|-7-7;Ѵovu;v†Ѵ|-7ov7;Ѵ|u-|-lb;m|o
7;Ѵovub;v]ov7;v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

Evaluación y Tratamiento de Riesgos

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

50
 Ɩĺ ˆ-Ѵ†-1bॕm7;Ѵ ;v;lr;ोo

51
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)
 9.1 Seguimiento, Medición, Análisis y Evaluación

-ou]-mbŒ-1bॕm7;0;;ˆ-Ѵ†-u;Ѵ7;v;lr;ोo7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕm‹Ѵ-;C1-1b-7;Ѵvbv|;l-
7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

La organización debe determinar:

ĺ t†࣐;vm;1;v-ubo_-1;uv;]†blb;m|o‹t†࣐;vm;1;v-ubol;7buķbm1Ѵ†‹;m7oruo1;vov‹1om|uoѴ;v7;
v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
ĺ ovl࣐|o7ov7;v;]†blb;m|oķl;7b1bॕmķ-m࢙Ѵbvbv‹;ˆ-Ѵ†-1bॕmķv;]িmv;--rѴb1-0Ѵ;ķr-u-]-u-m|bŒ-u
u;v†Ѵ|-7ovˆ࢙Ѵb7ovĺ

$Ĺovl࣐|o7ovv;Ѵ;11bom-7ov7;0;mruo7†1buu;v†Ѵ|-7ov1olr-u-0Ѵ;v‹u;ruo7†1b0Ѵ;vr-u-v;u
1omvb7;u-7ovˆ࢙Ѵb7ovĺ
ĺ †࢙m7ov;7;0;mѴѴ;ˆ-u-1-0o;Ѵv;]†blb;m|o
‹Ѵ-l;7b1bॕmĺ
ĺ †b࣐m7;0;_-1;u;Ѵv;]†blb;m|o‹Ѵ-l;7b1bॕmĺ
ĺ †࢙m7o v; 7;0;m -m-ѴbŒ-u ‹ ;ˆ-Ѵ†-u Ѵov
u;v†Ѵ|-7ov7;Ѵv;]†blb;m|o‹Ѵ-l;7b1bॕmĺ
ĺ †b࣐m7;0;-m-ѴbŒ-u‹;ˆ-Ѵ†-u;vovu;v†Ѵ|-7ovĺ

- ou]-mbŒ-1bॕm 7;0; 1omv;uˆ-u Ѵ- bm=oul-1bॕm

7o1†l;m|-7- -7;1†-7- 1olo ;ˆb7;m1b- 7; Ѵov
u;v†Ѵ|-7ovĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

52
9.2 Auditoría Interna

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

- ou]-mbŒ-1bॕm 7;0; ѴѴ;ˆ-u - 1-0o -†7b|ouझ-v
bm|;um-v-bm|;uˆ-ѴovrѴ-mbC1-7ovķr-u-ruorou1bom-u
bm=oul-1bॕm-1;u1-7;vb;Ѵvbv|;l-7;];vঞॕm7;Ѵ-
v;]†ub7-77;Ѵ-bm=oul-1bॕmĹ

ĺ †lrѴ;1omĹ
Ɛĺ ov u;t†bvb|ov ruorbov 7; Ѵ- ou]-mbŒ-1bॕm
r-u-v†vbv|;l-7;];v|bॕm7;Ѵ-v;]†ub7-7
7;Ѵ-bm=oul-1bॕmĺ
Ƒĺ ovu;t†bvb|ov7;;v|-moul-bm|;um-1bom-Ѵĺ
ĺ v|࢙ blrѴ;l;m|-7o ‹ l-m|;mb7o 7; l-m;u-
;=b1-Œĺ

53
 La organización debe:

ĺ Ѵ-mb=b1-uķ;v|-0Ѵ;1;uķblrѴ;l;m|-u‹l-m|;m;u†mooˆ-ubovruo]u-l-v7;-†7b|ouझ-t†;bm1Ѵ†‹-m
Ѵ-=u;1†;m1b-ķѴovl࣐|o7ovķѴ-vu;vromv-0bѴb7-7;vķѴovu;t†bvb|ov7;rѴ-mb=b1-1bॕmķ‹Ѵ-;Ѵ-0ou-1bॕm
7; bm=oul;vĺ ov ruo]u-l-v 7; -†7b|ouझ- 7;0;m |;m;u ;m 1†;m|- Ѵ- blrou|-m1b- 7; Ѵov ruo1;vov
bmˆoѴ†1u-7ov‹Ѵovu;v†Ѵ|-7ov7;Ѵ-v-†7b|ouझ-vru;ˆb-vĺ
ĺ -u-1-7--†7b|ouझ-ķ7;=bmbuv†v1ub|;ubov‹v†-Ѵ1-m1;ĺ
ĺ ";Ѵ;11bom-uѴov-†7b|ou;v‹ѴѴ;ˆ-u-1-0o-†7b|ouझ-vr-u--v;]†u-uv;7;Ѵ-o0f;|bˆb7-7‹Ѵ-blr-u1b-Ѵb7-7
7;Ѵruo1;vo7;-†7b|ouझ-ĺ
ĺ v;]†u-uv;7;t†;v;bm=oul--Ѵ-7bu;11bॕmr;u|bm;m|;7;Ѵovu;v†Ѵ|-7ov7;Ѵ-v-†7b|ouझ-vĺ
ĺ omv;uˆ-u bm=oul-1bॕm 7o1†l;m|-7- 1olo ;ˆb7;m1b- 7; Ѵ- blrѴ;l;m|-1bॕm 7;Ѵ ruo]u-l- 7;
-†7b|ouझ-‹7;Ѵovu;v†Ѵ|-7ov7;;v|-ĺ

Auditoría
Auditoría v;7;Cm;1olo;Ѵruo1;vovbv|;l࢙ঞ1oķbm7;r;m7b;m|;‹7o1†l;m|-7or-u-o0|;m;u
;ˆb7;m1b- o0f;ঞˆ-‹ ;ˆ-Ѵ†-uѴ- o0f;ঞˆ-l;m|; r-u- 7;|;ulbm-u ;m t†࣐ l;7b7- v; 1†lrѴ;m Ѵov
1ub|;ubov7;-†7b|ouझ-ĺ

ˆb7;m1b-o0f;ঞˆ-7-|ovt†;u;vr-Ѵ7-mѴ-;Šbv|;m1b-oѴ-ˆ;u7-77;-Ѵ]oĺ

- ;ˆb7;m1b- o0f;ঞˆ- v; r†;7; o0|;m;u - |u-ˆ࣐v 7; o0v;uˆ-1bॕmķ l;7b1bॕmķ ru†;0- o rou o|uov
l;7bovĺ

- ;ˆb7;m1b- o0f;ঞˆ- r-u- ;Ѵ ruorॕvb|o 7; Ѵ- -†7b|ouझ- ];m;u-Ѵl;m|; 1omvbv|; ;m u;]bv|uovķ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

7;1Ѵ-u-1bom;v7;_;1_ov†o|u-bm=oul-1bॕmt†;vomu;Ѵ;ˆ-m|;vr-u-Ѵov1ub|;ubov7;-†7b|ouझ-‹
ˆ;ubC1-0Ѵ;vĺ

Criterios de auditoría1omf†m|o7;u;t†bvb|ov†ঞѴbŒ-7ov1olou;=;u;m1b-1omu;vr;1|o-Ѵov1†-Ѵ;v
v;1olr-u-Ѵ-;ˆb7;m1b-o0f;ঞˆ-ĺ

"b Ѵov 1ub|;ubov 7; -†7b|ouझ- vom Ѵ;]-Ѵ;v Őbm1Ѵ†b7ov Ѵov u;t†bvb|ov Ѵ;]-Ѵ;v o u;]Ѵ-l;m|-ubovőķ
Ѵ-vr-Ѵ-0u-vľ1†lrѴblb;m|oĿoľbm1†lrѴblb;m|oĿ-l;m†7ov;†ঞѴbŒ-m;m†m-1om1Ѵ†vbॕm7;
-†7b|ouझ-

ovu;t†bvb|ovr†;7;mbm1Ѵ†buroѴझঞ1-vķruo1;7blb;m|ovķbmv|u†11bom;v7;|u-0-foķu;t†bvb|ovѴ;]-Ѵ;vķ
o0Ѵb]-1bom;v1om|u-1|†-Ѵ;vķ;|1ĺ

54
Alcance de auditoríav;u;C;u;-Ѵ-Ѵ1-m1;‹Ѵझlb|;v7;†m--†7b|ouझ-

Ѵ-Ѵ1-m1;7;Ѵ--†7b|ouझ-];m;u-Ѵl;m|;bm1Ѵ†‹;†m-7;v1ubr1bॕm7;Ѵ-v†0b1-1bom;vࣱvb1-v‹ˆbu|†-Ѵ;vķ
=†m1bom;vķ†mb7-7;vou]-mbŒ-ঞˆ-vķ-1ঞˆb7-7;v‹ruo1;vovķ-vझ1olo;Ѵr;uझo7o7;ঞ;lro1†0b;u|oĺ

&m-†0b1-1bॕmˆbu|†-Ѵ;v1†-m7o†m-ou]-mbŒ-1bॕmu;-ѴbŒ-†m|u-0-fooruorou1bom-†mv;uˆb1bo
†v-m7o†m;m|oumo;mѴझm;-t†;r;ulb|;-Ѵ-vr;uvom-vķbm7;r;m7b;m|;l;m|;7;Ѵ-v†0b1-1bom;v
ࣱvb1-vķ;f;1†|-uruo1;vovĺ

9.3 Revisión por la Dirección

- -Ѵ|- 7bu;11bॕm 7;0; u;ˆbv-u ;Ѵ vbv|;l- 7;
];vঞॕm 7; Ѵ- v;]†ub7-7 7; Ѵ- bm=oul-1bॕm 7;
Ѵ- ou]-mbŒ-1bॕm - bm|;uˆ-Ѵov rѴ-mbC1-7ovķ r-u-
-v;]†u-uv; 7; v† 1omˆ;mb;m1b-ķ -|7;1†-1bॕm ‹
;C1-1b-1omঞm†-ĺ

- u;ˆbvbॕm rou Ѵ- 7bu;11bॕm 7;0; bm1Ѵ†bu

1omvb7;u-1bom;vvo0u;Ĺ

ĺ Ѵ ;v|-7o 7; Ѵ-v -11bom;v 7;v7; -m|;ubou;v

u;ˆbvbom;vrouѴ-7bu;11bॕmĺ
ĺ ov 1-l0bov ;m Ѵ-v 1†;v|bom;v ;Š|;um-v ;
bm|;um-v t†; v;-m r;u|bm;m|;v -Ѵ vbv|;l- 7;
];v|bॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

ĺ - bm=oul-1bॕm vo0u; ;Ѵ 1olrou|-lb;m|o 7;
Ѵ- v;]†ub7-7 7; Ѵ- bm=oul-1bॕmķ bm1Ѵ†b7-v Ѵ-v
|;m7;m1b-vu;Ѵ-|bˆ-v-Ĺ
Ɛĺ o1om=oulb7-7;v‹-11bom;v1ouu;1|bˆ-vĺ
Ƒĺ ";]†blb;m|o‹u;v†Ѵ|-7ov7;Ѵ-vl;7b1bom;vĺ
ƒĺ !;v†Ѵ|-7ov7;-†7b|ouझ-ĺ
Ɠĺ Ѵ 1†lrѴblb;m|o 7; Ѵov o0f;|bˆov 7;
v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
ĺ ov 1ol;m|-ubov ruoˆ;mb;m|;v 7; Ѵ-v r-u|;v
bm|;u;v-7-vĺ

55
 ĺ ovu;v†Ѵ|-7ov7;Ѵ--ru;1b-1bॕm7;Ѵovub;v]ov‹;Ѵ;v|-7o7;ѴrѴ-m7;|u-|-lb;m|o7;ub;v]ovĺ
ĺ -vorou|†mb7-7;v7;l;fou-1om|bm†-ĺ

ov;Ѵ;l;m|ov7;v-Ѵb7-7;Ѵ-u;ˆbvbॕmrouѴ-7bu;11bॕm7;0;mbm1Ѵ†buѴ-v7;1bvbom;vu;Ѵ-1bom-7-v
1omѴ-vorou|†mb7-7;v7;l;fou-1omঞm†-‹1†-Ѵt†b;um;1;vb7-77;1-l0bo;m;Ѵvbv|;l-7;
];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

-ou]-mbŒ-1bॕm7;0;1omv;uˆ-ubm=oul-1bॕm7o1†l;m|-7-1olo;ˆb7;m1b-7;Ѵovu;v†Ѵ|-7ov7;Ѵ-v
u;ˆbvbom;vrouѴ-7bu;11bॕmĺ

-v-1|-v7;!;ˆbvbॕmrouѴ- bu;11bॕmv;7;0;bm1Ѵ†bu;v|ovr†m|ov1ololझmblo‹;v|-um†l;u--
7-v;mou7;m1ouu;Ѵ-ঞˆoĺ

Ɛĺ 11bom;v7;v;]†blb;m|o7;Ѵov-1†;u7ov7;Ѵ1|--m|;ubou7;!;†mbॕm7;Ѵolb|࣐""ĺ
Ƒĺ -l0bov;mѴov-v†m|ov;Š|;umov;bm|;umovt†;vomr;u|bm;m|;v-Ѵ""ĺ
ƒĺ ov1ol;m|-ubovvo0u;;Ѵ7;v;lr;ोo7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmķbm1Ѵ†b7-v|;m7;m1b-v;mĹ
mo1om=oulb7-7;v‹-11bom;v1ouu;1ঞˆ-vĺ
Ɠĺ !;v†Ѵ|-7ov7;Ѵlomb|ou;o‹l;7b1bom;vĺ
Ɣĺ !;v†Ѵ|-7ov7;-†7b|ouझ-ĺ
ѵĺ †lrѴblb;m|o7;Ѵovo0f;|bˆov7;v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ
ƕĺ ol;m|-ubov7;Ѵ-vr-u|;vbm|;u;v-7-vĺ
Ѷĺ !;v†Ѵ|-7ov7;Ѵ-;ˆ-Ѵ†-1bॕm7;ub;v]o‹;Ѵ;v|-7o7;ѴrѴ-m7;|u-|-lb;m|o7;ub;v]oĺ
Ɩĺ rou|†mb7-7;vr-u-Ѵ-l;fou-1om|bm†-ĺ
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

56
 ƐƏĺ;fou-

57
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)
 ƐƏĺƐoom=oulb7-7‹11bom;vouu;1ঞˆ-v

†-m7oo1†uu-†m-mo1om=oulb7-7ķѴ-ou]-mbŒ-1bॕm7;0;Ĺ

ĺ !;-11bom-u-m|;Ѵ-mo1om=oulb7-7ķ‹v;]িmv;--rѴb1-0Ѵ;Ĺ
Ɛĺ Ѵ;ˆ-u-1-0o-11bom;vr-u-1om|uoѴ-uѴ-‹1ouu;]buѴ-ĺ
Ƒĺ -1;u=u;m|;-Ѵ-v1omv;1†;m1b-vĺ
ĺ ˆ-Ѵ†-uѴ-m;1;vb7-77;-11bom;vr-u-;Ѵblbm-uѴ-v1-†v-v7;Ѵ-mo1om=oulb7-7ķ1om;Ѵ=bm7;t†;
moˆ†;Ѵˆ--o1†uubuķmbo1†uu-;mo|u-r-u|;ķl;7b-m|;Ĺ
Ɛĺ -u;ˆbvbॕm7;Ѵ-mo1om=oulb7-7ĺ
Ƒĺ -7;|;ulbm-1bॕm7;Ѵ-v1-†v-v7;Ѵ-mo1om=oulb7-7ĺ
ƒĺ - 7;|;ulbm-1bॕm 7; vb ;Šbv|;m mo 1om=oulb7-7;v vblbѴ-u;vķ o t†; ro|;m1b-Ѵl;m|; ro7uझ-m
o1†uubuĺ
ĺ lrѴ;l;m|-u1†-Ѵt†b;u-11bॕmm;1;v-ub-ĺ
ĺ !;ˆbv-uѴ-;=b1-1b-7;Ѵ-v-11bom;v1ouu;1|bˆ-vѴѴ;ˆ-7-v-1-0oĺ
ĺ "b;vm;1;v-uboķ_-1;u1-l0bov-Ѵvbv|;l-7;];v|bॕm7;Ѵ-v;]†ub7-77;Ѵ-bm=oul-1bॕmĺ

-v-11bom;v1ouu;1ঞˆ-v7;0;mv;u-7;1†-7-v-Ѵov;=;1|ov7;Ѵ-vmo1om=oulb7-7;v;m1om|u-7-vĺ

-ou]-mbŒ-1bॕm7;0;1omv;uˆ-ubm=oul-1bॕm7o1†l;m|-7-ķ1olo;ˆb7;m1b-7;Ĺ

ĺ -m-|†u-Ѵ;Œ-7;Ѵ-vmo1om=oulb7-7;v‹1†-Ѵt†b;u-11bॕmrov|;ubouѴѴ;ˆ-7--1-0oĺ
ĺ ovu;v†Ѵ|-7ov7;1†-Ѵt†b;u-11bॕm1ouu;1|bˆ-ĺ

ƐƏĺƑ;fou-omঞm†-
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

- ou]-mbŒ-1bॕm 7;0; l;fou-u 7; l-m;u-

1omঞm†-Ѵ-b7om;b7-7ķ-7;1†-1bॕm‹;C1-1b-
7;Ѵvbv|;l-7;];vঞॕm7;Ѵ-v;]†ub7-77;Ѵ-
bm=oul-1bॕmĺ

58
 m;ŠoƐĹ$࣐ulbmov‹ ;=bmb1bom;v

59
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)
 $-ѴѴ;uĹ !;ˆbv-u Ѵov$࣐ulbmov ‹ ;=bmb1bom;v
7;";]†ub7-77;Ѵ-m=oul-1bॕm
ISO 27001 INTERNAL AUDITOR / LEAD AUDITOR (I27001IA/LA)

60