ISO/IEC 27001 Information Security Management Standard 2022

A.5 Organizational controls

A.5.1

Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

Policies for information security

A.5 Organizational controls

A.5.2

Information security roles and responsibilities should be defined and allocated according to the organisation needs.

Roles and Responsibilities

A.5 Organizational controls

A.5.3

Conflicting duties and conflicting areas of responsibility should be segregated.

Segregation of Duties

A.5 Organizational controls

A.5.5

The organisation should establish and maintain contact with relevant authorities.

Contact With Authorities

A.5 Organizational controls

A.5.7

Information relating to information security threats should be collected and analysed to produce threat intelligence.

Threat Intelligence

A.5 Organizational controls

A.5.10

Rules for the acceptable use and procedures for handling information and other associated assets should be identified, documented and implemented.

Acceptable Use Of Information And Other Associated Assets

A.5 Organizational controls

A.5.13

An appropriate set of procedures for information labelling should be developed and implemented in accordance with the information classification scheme adopted by the organisation.

Labelling Of Information

A.5 Organizational controls

A.5.14

Information transfer rules, procedures, or agreements should be in place for all types of transfer facilities within the organisation and between the organisation and other parties.

Information Transfer

A.5 Organizational controls

A.5.15

Rules to control physical and logical access to information and other associated assets should be established

Access Control

A.5 Organizational controls

A.5.16

The full lifecycle of identities should be managed.

Identity Management

A.5 Organizational controls

A.5.17

Allocation and management of authentication information should be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

Authentication Information

A.5 Organizational controls

A.5.18

Access rights to information and other associated assets should be provisioned, reviewed, modified and removed in accordance with the organisations topic-specific policy on and rules for access control.

Access Rights

A.5 Organizational controls

A.5.19

Processes and procedures should be defined and implemented to manage the information security risks associated with the use of suppliers products or services.

Information Security In Supplier Relationships

A.5 Organizational controls

A.5.21

Processes and procedures should be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.

Managing Information Security In The ICT Supply Chain

A.5 Organizational controls

A.5.22

The organisation should regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

Monitor, Review And Change Management Of Supplier Services

A.5 Organizational controls

A.5.24

The organization should plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.

Information Security Incident Management Planning and Preparation

A.5 Organizational controls

A.5.25

The organisation should assess information security events and decide if they are to be categorised as information security incidents.

Assessment And Decision On Information Security Events

A.5 Organizational controls

A.5.26

Information security incidents should be responded to in accordance with the documented procedures.

Response To Information Security Incidents

A.5 Organizational controls

A.5.28

The organisation should establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.

Collection Of Evidence

A.5 Organizational controls

A.5.33

Records should be protected from loss, destruction, falsification, unauthorised access and unauthorised release.

Protection Of Records

A.5 Organizational controls

A.5.34

The organisation should identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.

Privacy And Protection Of PII

A.5 Organizational controls

A.5.36

Compliance with the organisations information security policy, topic-specific policies, rules and standards should be regularly reviewed.

Compliance With Policies, Rules And Standards For Information Security

A.5 Organizational controls

A.5.37

Operating procedures for information processing facilities should be documented and made available to personnel who need them.

Documented Operating Procedures

A.6 People controls

A.6.4

A disciplinary process should be formalised and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.

Disciplinary Process

A.6 People controls

A.6.7

Security measures should be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organisations premises.

Remote Working

A.6 People controls

A.6.8

The organisation should provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

Information Security Event Reporting

A.7 Physical controls

A.7.4

Premises should be continuously monitored for unauthorised physical access.

Physical Security Monitoring

A.7 Physical controls

A.7.10

Storage media should be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisations classification scheme and handling requirements.

Storage Media

A.7 Physical controls

A.7.14

Items of equipment containing storage media should be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.

Secure Disposal Or Re-Use Of Equipment

A.8 Technological controls

A.8.1

Information stored on, processed by or accessible via user endpoint devices should be protected.

User Endpoint Devices

A.8 Technological controls

A.8.2

The allocation and use of privileged access rights should be restricted and managed.

Privileged Access Rights

A.8 Technological controls

A.8.3

Access to information and other associated assets should be restricted in accordance with the established topic-specific policy on access control.

Information Access Restriction

A.8 Technological controls

A.8.5

Secure authentication technologies and procedures should be implemented based on information access restrictions and the topic-specific policy on access control.

Secure Authentication

A.8 Technological controls

A.8.7

Protection against malware should be implemented and supported by appropriate user awareness.

Protection Against Malware

A.8 Technological controls

A.8.8

Information about technical vulnerabilities of information systems in use should be obtained, the organisations exposure to such vulnerabilities should be evaluated and appropriate measures should be taken.

Management of Technical Vulnerabilities

A.8 Technological controls

A.8.12

Data leakage prevention measures should be applied to systems, networks and any other devices that process, store or transmit sensitive information.

Data Leakage Prevention

A.8 Technological controls

A.8.15

Logs that record activities, exceptions, faults and other relevant events should be produced, stored, protected and analysed.

Logging

A.8 Technological controls

A.8.18

The use of utility programs that can be capable of overriding system and application controls should be restricted and tightly controlled

Use of Privileged Utility Programs

A.8 Technological controls

A.8.19

Procedures and measures should be implemented to securely manage software installation on operational systems.

Installation of Software on Operational Systems

A.8 Technological controls

A.8.20

Networks and network devices should be secured, managed and controlled to protect information in systems and applications.

Network Security

A.8 Technological controls

A.8.21

Security mechanisms, service levels and service requirements of network services should be identified, implemented and monitored.

Security of Network Services

A.8 Technological controls

A.8.23

Access to external websites should be managed to reduce exposure to malicious content.

Web Filtering

A.8 Technological controls

A.8.26

Information security requirements should be identified, specified and approved when developing or acquiring applications.

Application Security Requirements

A.8 Technological controls

A.8.30

The organisation should direct, monitor and review the activities related to outsourced system development.

Outsourced Development

A.8 Technological controls

A.8.34

Audit tests and other assurance activities involving assessment of operational systems should be planned and agreed between the tester and appropriate management.

Protection of Information Systems During Audit Testing