ISO 27001: what the auditor will ask you
Complete plan
Five modules for all staff of a company that is ISO 27001 certified or getting certified: the auditor's three questions, the label before you share, access you no longer need, clear desk and locked screen, and how to answer on audit day. Awareness evidence for clauses 7.2 and 7.3 and control A.6.3.
- 11 min
- 5 modules
- 15-question check
- English · Français
- Attestation
You will be able to
- Know where to find your company's security policy and name one or two rules that apply to your job
- Know your company's classification levels and what each one allows
- Understand why unused access is a risk (stolen account, former employee)
- Lock your computer as soon as you leave it (Windows + L, ctrl + ⌘ + Q on a Mac)
- Answer an auditor by describing what you actually do, and say "I don't know" rather than make something up
Programme
5 modules · 11 min-
ISO 27001: the auditor's three questions 2 min
- Know where to find your company's security policy and name one or two rules that apply to your job
- Describe your own contribution to security through concrete actions
- Know the consequences of not following it, for the company and for yourself
-
Check the label first 2 min
- Know your company's classification levels and what each one allows
- Check the label, the recipient and the channel before you share, print or store
- Know that a copy, an export or a screenshot keeps the original's level, and when in doubt protect an unlabelled document as confidential and ask its owner
-
Access you no longer need 2 min
- Understand why unused access is a risk (stolen account, former employee)
- Report access you no longer need when you change role or project
- Answer an access review honestly, and leave without keeping copies
-
Clear desk, locked screen 2 min
- Lock your computer as soon as you leave it (Windows + L, ctrl + ⌘ + Q on a Mac)
- Leave nothing sensitive on the desk, at the printer or in view
- Apply the same rule on the move and at home: screen out of sight, no confidential calls on speaker, papers in a closed bag
-
Audit day 2 min
- Answer an auditor by describing what you actually do, and say "I don't know" rather than make something up
- Show where the rule and the evidence are: policy, procedure, training certificate
- Ask for an exception or report a rule that blocks you instead of working around it; know what a nonconformity is
-
Knowledge check
15 questions, pass mark 80 %. Explanations after each answer; you can try again.
-
Attestation
One per person, with the date, the score and the frameworks covered — anyone can check it online with its code.
Version 1 · updated October 4, 2026