Practical Checklists

These checklists are designed for use in team meetings and regular review sessions. You can tick off each item as soon as it is met, directly on this page.

Getting Started with ISO 27001

Based on the phases set out in the article “Mastering Application Security”.

Phase 1: Plan (PLAN)

• checkLeadership supportHave you obtained a clear, documented commitment from senior management to implement the system?
• checkScope definitionHave you clearly defined what you need to protect, such as customer data and intellectual property?
• checkRoles and responsibilitiesHave information security roles and responsibilities been formally assigned?

Phase 2: Design (DESIGN)

• checkRisk assessmentHave you carried out a systematic risk assessment to identify threats and vulnerabilities?
• checkTreatment planHave you drawn up a risk treatment plan based on the results of the assessment?
• checkControls reviewHave you reviewed the Annex A controls to design a secure architecture?

Phase 3: Build (BUILD)

• checkSecure codingAre developers trained in secure coding practices, and do they apply them?
• checkVulnerability managementDo you have a continuous process for discovering and managing vulnerabilities?
• checkRepository securityAre code repositories adequately secured?

Phase 4: Run (RUN)

• checkIncident responseDo you have a ready, tested plan for responding to security incidents?
• checkMonitoring and measurementDo you continuously monitor and measure the effectiveness of security controls?
• checkContinual improvementDo you carry out regular audits and reviews to ensure the system evolves?

Building a DevSecOps Culture

Based on the principles set out in the article “DevSecOps Dynamics”.

• checkShift leftAre security checks integrated into the early design and coding stages, not just at the end?
• checkAutomationAre security tests (such as SAST and DAST) automatically integrated into CI/CD pipelines?
• checkShared ownershipIs security a shared responsibility across the development, operations and security teams?
• checkEmpowermentDo developers have the tools and knowledge they need to own the security of the code they write?
• checkFeedbackDo the automated pipelines provide fast, continuous feedback on quality and security?
• checkSupply chainDo you produce a software bill of materials (SBOM) for every release and verify the provenance of libraries?
• checkAdapting to threatsDoes continuous monitoring allow you to adapt quickly to evolving threats?

AI Governance (AIMS)

Based on the pillars set out in the article “Mastering AI Security”.

Pillar 1: Strategic Alignment

• checkHas senior management committed to a clear AI policy aligned with business objectives?
• checkAre roles and responsibilities clearly defined, such as the model owner and the data steward?

Pillar 2: Risk and Impact Assessment

• checkHave you carried out assessments of technical risks, such as model security and prompt injection?
• checkHave you carried out assessments of societal and ethical impact, such as bias and fairness?
• checkDo you ensure explainability, so that it is known how the model makes its decisions?
• checkHave you defined what AI agents are permitted to do without human approval?
• checkDo you review compliance with global regulations, such as the EU AI Act and its revised deadlines?

Pillar 3: Operational Excellence

• checkHave sufficient resources and dedicated teams been provided to support the governance system?
• checkAre there day-to-day operational controls for continuous monitoring and review of model performance?

Pillar 4: Continual Improvement

• checkIs there a clear process for managing “nonconformities” when things go wrong?
• checkAre corrective actions taken to learn from mistakes and strengthen governance?

Applying the InnovaForge Framework

Based on the pillars set out in the article “Forging Innovation”.

Pillar 1: Mindset

• checkDo you encourage the team to see challenges as opportunities for learning and growth?
• checkAre you actively working to dismantle the “I’m not creative” myth among individuals?

Pillar 2: Tools

• checkDo you regularly use structured techniques, such as brainstorming, mind mapping and SCAMPER, to generate ideas?

Pillar 3: Environment

• checkDo you provide psychological safety in which failure is seen as a learning event rather than a mistake to be punished?
• checkDo you provide “innovation sandboxes” that allow teams to experiment safely?

Pillar 4: Habit

• checkIs innovative thinking part of the daily rhythm, or confined to quarterly workshops?