Context of the organization
The first group of rows asks whether the organisation understands the context it is protecting, the parties that constrain it, the boundary of the system and the system itself. An ISMS audit that starts with the control list and never tests the context cannot tell whether the controls are the right ones.
Leadership
The second group tests whether top management owns the ISMS, whether the policy constrains real decisions, and whether roles and authorities are assigned and used. Leadership is tested by decisions and resources, not by a signature.
Planning
The third group tests risk assessment, risk treatment, the Statement of Applicability, the objectives and the planning of changes. This is where most ISMS audits find the gap between the risk register and the controls that are actually running.
Support
The fourth group tests resources, competence, awareness, communication and documented information. These are the conditions that make the controls possible, and they are the most common source of a finding that a control exists on paper but not in practice.
Operation
The fifth group tests whether the processes that carry information security risk are planned, controlled and assessed, and whether risk treatment is implemented and repeated after change.
Performance evaluation
The sixth group tests monitoring, internal audit and management review. It is the group that closes the loop between the ISMS plan and its results, and it is where the 27007 guidance and the 27001 internal audit clause meet.
Improvement
The seventh group tests continual improvement and the handling of nonconformity and corrective action. The 2022 edition swapped the numbers, so the 2020 row numbering no longer matches the clause.