Manifestly: A Checklist App for Teams

Define the ISMS scope statement

Approve the Statement of Applicability

Publish policies and collect acknowledgments

Confirm ISMS roles in the RACI matrix

Refresh the risk register and treatment plan

Hold the management review meeting

Verify pre-employment screening records

Confirm annual security awareness training completion

Reconcile the information asset inventory

Spot-check handling rules per classification tier

Run access reviews across SSO and identity systems

Audit privileged accounts in AWS, GitHub, and databases

Remediate orphaned privileged accounts

Review the cryptographic controls policy

Verify KMS key rotation and access logs

Review badge access logs for offices and data rooms

Confirm secure disposal records for retired media

Confirm EDR coverage across managed endpoints

Review the vulnerability management dashboard

Sample change tickets against production deploys

Validate network segmentation between prod, dev, and corporate

Review the data transfer register and DLP exceptions

Confirm SAST and SCA run on every pull request

Audit non-production environments for live data

Refresh the vendor risk register

Confirm DPAs and Annex II clauses with sub-processors

Escalate high-residual-risk vendors to the security committee

Run a tabletop exercise of the incident runbook

Verify the 72-hour breach notification path

Conduct a backup restore drill into a non-prod environment

Update the business impact analysis for tier-1 services

Map controls to ISO 27001:2022 Annex A coverage

Run the internal audit and log findings

Free Checklist Templates for Information Security