GRC Compliance Readiness Assessment

An information security policy is approved by top management and published to staff.

ISO 27001 Clause 5.2, A.5.1 · GDPR Art. 24(2)

Topic-specific policies (access, data handling, incidents, suppliers) exist, each with a named owner.

ISO 27001 A.5.1

Security roles and responsibilities are defined and assigned, including a data protection lead.

ISO 27001 Clause 5.3, A.5.2 · GDPR Art. 37-39

Policies are reviewed at least yearly and exceptions are approved, recorded and given an expiry date.

ISO 27001 A.5.1, Clause 7.5

A documented risk assessment method defines scales, risk owners and acceptance criteria.

ISO 27001 Clause 6.1.2 · GDPR Art. 32(2)

A risk register is maintained, with an owner and treatment decision for every risk.

ISO 27001 Clause 6.1.3, 8.2, 8.3

A Statement of Applicability (or equivalent control list) justifies which controls apply.

ISO 27001 Clause 6.1.3(d)

Data protection impact assessments (DPIAs) are done before high-risk processing starts.

GDPR Art. 35

An inventory of information assets and personal data exists, including where data is stored and shared.

ISO 27001 A.5.9 · GDPR Art. 30

Records of processing activities document purposes, lawful basis, recipients and retention.

GDPR Art. 6, 30

Data is classified, and handling rules (encryption, masking, sharing) are applied per class.

ISO 27001 A.5.12, A.5.13, A.8.11, A.8.24 · GDPR Art. 25, 32(1)(a)

Retention periods are defined and data is securely deleted when no longer needed.

ISO 27001 A.5.33, A.8.10 · GDPR Art. 5(1)(e)

Joiner, mover and leaver processes grant and remove access promptly.

ISO 27001 A.5.15, A.5.18 · GDPR Art. 32(1)(b)

Multi-factor authentication is enforced for remote access, email and systems holding personal data.

ISO 27001 A.8.5 · GDPR Art. 32(1)(b)

Privileged access is restricted, logged and separated from everyday accounts.

ISO 27001 A.8.2, A.8.15

Access to critical systems and personal data is reviewed at least quarterly.

ISO 27001 A.5.18 · GDPR Art. 32(1)(d)

All staff complete security awareness training at onboarding and at least yearly.

ISO 27001 Clause 7.3, A.6.3 · GDPR Art. 39(1)(b)

High-risk roles (finance, IT, developers, data handlers) receive role-based training.

ISO 27001 Clause 7.2, A.6.3

Staff acknowledge key policies and know how to report incidents and suspicious emails.

ISO 27001 A.6.2, A.6.8

Training effectiveness is measured, for example with phishing simulation report rates.

ISO 27001 Clause 9.1

Suppliers that handle company or personal data are assessed for security before onboarding.

ISO 27001 A.5.19, A.5.21 · GDPR Art. 28(1)

Contracts include security clauses and, for processors, GDPR Article 28 terms.

ISO 27001 A.5.20 · GDPR Art. 28(3)

Critical suppliers are reviewed periodically and sub-processors are tracked.

ISO 27001 A.5.22 · GDPR Art. 28(2)

International transfers of personal data have an adequacy decision or safeguards such as SCCs.

GDPR Art. 44-46

A documented incident response plan defines roles, severity levels and escalation.

ISO 27001 A.5.24, A.5.26

The plan includes a personal data breach assessment and 72-hour authority notification.

GDPR Art. 33, 34

All incidents and breaches are logged, including those not reported to regulators.

ISO 27001 A.5.25, A.5.27 · GDPR Art. 33(5)

The plan is tested at least yearly with a tabletop exercise and lessons are acted on.

ISO 27001 A.5.27, A.5.30 · GDPR Art. 32(1)(d)

Each control has an owner and evidence is collected on a schedule, not just before audits.

ISO 27001 Clause 9.1, A.5.36 · GDPR Art. 5(2)

An internal audit program covers the management system and controls at least yearly.

ISO 27001 Clause 9.2, A.5.35

Leadership reviews security and compliance status at planned intervals and records decisions.

ISO 27001 Clause 9.3 · GDPR Art. 24(1)

Audit findings and nonconformities are tracked with root cause, owner and due date until closed.

ISO 27001 Clause 10.2