ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Name of applicant:
Organization:
Professional experience: (from/to, company/institute, function/role)
1.
2.
Information Security Aspect
(examples for sorts of competence area)
Proof of Professional Experience
Remarks of the Certification Body
Please describe professional experience and knowledge
with regard to following aspects of “Information Security” ,
based on given facts of your CV
(intensity, volume, duration, etc.)
Management system
e.g.
 Establishing an ISMS (completely or partly)
 Practical experience with risk assessment
methods
 Risk evaluation/treatment (plan)
 Operation of management system
 Reviews/auditing of ISMS (components)
 Improvement plan concerning IS aspects
(corrections/prevention measures)
 Preparation of documentation
Page 1 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Information security policy (strategies)
e.g.
 Establishing or supporting any IS policy
 Participation of reviews of the policy
Page 2 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Internal organization
e.g.
 Implementation or maintenance of IS
infrastructure within the organization
 Co-ordination/reporting of information
security tasks
 Establishing/implementation of IS-relevant
controls
 Membership in specialist committees
 Risk assessment concerning external
parties (customer, partner, etc.)
 Liasioning with authorities
 Setting up requirements of confidentiality
documents
 Participating in independent review of IS
Asset management
e.g.
 Owner of relevant assets, critical
information
 Definition of rules for use of assets
 Conduct of risk assessments for assets
 Definition of the corresponding levels of
protection for assets
Page 3 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Human resources security
(before, during employment, at termination/change)
e.g.
 Definition of security aspects for roles or
functions (e.g. system administrator,
service personell)
 Clarifying IS concerns when hiring
employees (e.g. in interviews in IS relevant
areas)
 Conduct of IS awareness trainings for
employees
 Terms and conditions of employment
 Removal of access rights
Page 4 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Physical and environmental security
e.g.
 Design of security perimeters and entry
controls
 Implementation of security and monitoring
procedures
 Conduct of security checks
 Equipment responsibility (incl.
service/maintenance tasks, mobile tools,
disposal etc.), siting and protecting of
equipment security
Page 5 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Communications and operations management
e.g.
 Definition or implementation (participation)
of operating procedures and responsibilities
to ensure the correct and secure operation
of information processing facilities
 Conduct of capacity planning
 involved in change management of
information processing facilities/systems
 Participate in system acceptance test or
service evaluation(IS-aspects)
 Responsibility for system documentation
 Implementation of virus scanners and
firewalls, configuration of mobile code
 Implementation/operation of information
back-up systems
 Implementation/monitoring of controls for
network security
 Handling/safeguarding of information media
or significant information (incl. disposal)
 Involved in service delivery management
(e.g. monitoring, review, negotiation)
Access control
e.g.
 Definition of policies and business
requirements for the access to information,
IT systems and networks
 Managing and controlling access rights to
information systems
 User password management
 Experience as a user of sensitive
information/systems
 Conduct of security trainings for users
 Practical experience in security of mobile
Page 6 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence


computing and teleworking
Experience in network management
Experience in operating systems control
(setup of policies and rules, monitoring)
Information sytems acquisition, development
and maintenance
e.g.
 Definition of security requirements for new
systems (for development, change and
maintenance)
 Implementation of controls for secure
operation of application systems
 Conception and implementation of
cryptographic controls
 Implementation of security controls for
development and maintenance processes
 Responsibility for technical vulnerability
/patch management
IS Incident Management
e.g.
 Participation in reporting and management of
IS events/incidents
 Analyzing and risk assessments of incidents
 Compilation of lessons learned from incidents
 Evidence collection
Business continuity management
e.g.
 Establishing/implementation of emergency
plans
 Test and evaluation of emergency
Page 7 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence

scenarios
Participation in business impact analysis
Compliance with legal and other requirements,
security requirements and technical standards
e.g.
 Knowledge of applicable relevant statutory,
regulatory and contractual requirements
 Conduct of compliance checks
 Experience in protection of data and
intellectual property rights
 Conduct of IS relevant audits
 Special trainings in legal requirements (e.g.
cryptography)
Other aspects with regard to information
security
 Experience in using audit tools
 Audits in IT industries
Trainings (IS specific):



Y
Y
Page 8 of 9
ISO 27001 Competence Check
Annex of Application Form ISO 27001 (Please also provide complete CV):
Proof of Information Security Competence
Location/Date:
Signature of Applicant:
Page 9 of 9