ISO 27001 Compliance Checklist for Staffing Agencies

Determine the boundaries and applicability of the information security management system considering internal and external issues.

Develop a top-level information security policy appropriate to the organization approved by top management.

Ensure top management demonstrates leadership and commitment to the ISMS by providing resources and direction.

Produce a Statement of Applicability listing all Annex A controls with justification for inclusion or exclusion.

Establish and apply a risk assessment process identifying risks to confidentiality, integrity, and availability of information.

Determine risk treatment options and develop a plan for implementing chosen controls with residual risk acceptance.

Assign and communicate information security roles and responsibilities across the organization.

Identify information assets, assign ownership, and classify them according to their protection requirements.

Address information security requirements in supplier agreements and monitor supplier service delivery.

Define and implement access control policies based on business and security requirements with least privilege.

Develop and implement a policy on the use of cryptographic controls for protection of information.

Identify and implement security mechanisms, service levels, and management requirements for network services.

Establish backup policies and regularly test backup copies of information, software, and system images.

Control changes to the organization, business processes, and information systems that affect information security.

Document and make available operating procedures for all information processing activities.

Require all employees and contractors to report observed or suspected security weaknesses and events.

Define management responsibilities and procedures to ensure quick and effective response to information security incidents.

Top management must review the ISMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness.

Plan and conduct internal audits at planned intervals to verify the ISMS conforms to requirements and is effectively maintained.

React to nonconformities, take corrective action, and evaluate the need for action to eliminate the cause.