Do you provide any guidance documents or recommendations with regard to ISO 27001, 27002 as to the 'schedule or frequency' recommended for testing of required and recommended controls? I have not found any specific requirement beyond assuring presence and functioning either in what I have seen of ISO27001, NIST 800, OWASP or SANS? If you offer a template that suggests how frequently specific server logs should be examined as well as other controls that should be looked at I would recommend it to a client.
Answer: Specific guidance for control testing is difficult to provide since each organization context and risks are unique, but you can use some of the criteria applied to planning internal audits to help define a proper test schedule, like:
- Criticality of the assets under protection of the control: the more critical the asset, the more frequent should be controls testing.
- Frequency of changes: the more frequent changes in assets or in the environment where the asset operates, the more frequent should be controls testing.
- Results of previous test: previous tests pointing corrections or improvement to be made, should be considered to reduce interval between tests.
It is important to note that testing of controls should not be confused with internal audit; in smaller companies, internal audit is usually performed once a year by people independent of the audited process, while testing generally is performed by people involved in the process.
Regarding documentation, unfortunately we do not have a template that covers controls testing, but I suggest you to take a look at the following templates, since I believe that with some adaptations you can make them more general and use them to help you testing a wider range of controls :