ISO & IEC / Technical specification
ISO/IEC TS 27008:2019 Assess controls in operation
ISO/IEC TS 27008 guides the assessment of information security controls, including technical checks where appropriate. It helps reviewers move from a documented control design to evidence about implementation and operation.
The place in the system
Where it fits
It deepens control-level assessment for an ISMS and complements the ISMS-wide audit approach of 27007.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- State the control objective and assessment criteria before testing.
- Sample both configured settings and evidence of routine operation.
- Record the limits of the sample and any compensating context.
Evidence to look for
- Control assessment plan
- Configuration or process sample
- Assessment observation record
Illustrative example
What it could look like
A policy says privileged access is reviewed each quarter, yet reviewers need to know whether the process actually catches dormant accounts. They sample approvals, changes and removals and report what the evidence supports.
Boundary to keep clear
Use the full TS designation and do not portray one sampled control check as a full ISMS audit or certification.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.