ISO 27001:2022

Requirements and controls

• Clauses Mandatory Clauses

  • C4 Context of the organization

    • C.4.1 Understanding the organization and its context

      Work out which internal and external issues matter to the organization's purpose and could affect what the ISMS is meant to achieve.

      • Internal Audit
      • ISMS Manual

    • C.4.2 Understanding the needs and expectations of interested parties

      List the stakeholders that matter to the ISMS, what security requirements they have, and which of those the ISMS will handle.

      • Internal Audit
      • ISMS Manual
      • Assigned Security & Privacy Responsibilities

    • C.4.3 Determining the scope of the ISMS

      Decide and document which parts of the organization, locations, systems and interfaces the ISMS covers.

      • Automated Incident Reporting
      • ISMS Scope Document

    • C.4.4 Information security management system

      Set up, run, maintain and keep improving the ISMS, including the processes it relies on and how they interact.

      • Assigned Security & Privacy Responsibilities
      • Internal Audit
      • Security & Privacy Program Review
      • Automated Incident Reporting
      • ISMS Scope Document
      • ISMS Manual

  • C5 Leadership

    • C.5.1 Leadership and commitment

      Top management actively backs the ISMS by tying it to business strategy, funding it, embedding it in daily processes and pushing for improvement.

      • Automated Incident Reporting
      • Assigned Security & Privacy Responsibilities
      • Internal Audit
      • Security & Privacy Program Review
      • ISMS Scope Document
      • ISMS Manual

    • C.5.2 Information security policy

      Top management issues an information security policy suited to the organization that sets direction and objectives, and makes sure it is communicated and available.

      • Information Security & Privacy Policies

    • C.5.3 Organizational roles, responsibilities and authorities

      Top management assigns and communicates who is responsible for the ISMS and for reporting on how well it performs.

      • Organizational Structure
      • Roles & Responsibilities
      • Compliance Program Manager
      • People Operations Owner
      • Asset Ownership Assignment
      • Assigned Security & Privacy Responsibilities
      • Security & Privacy Program Review
      • ISMS Manual

  • C6 Planning

    • C.6.1 Actions to address risks and opportunities

      Plan how to deal with ISMS risks and opportunities through a repeatable risk assessment and risk treatment process and a Statement of Applicability.

      • Risk Framing
      • Risk Assessment
      • Fraud Risk Assessment
      • ISMS Manual
      • Risk Assessment Policy & Procedure

    • C.6.2 Information security objectives and planning to achieve them

      Set measurable security objectives and plan what will be done, by whom, with which resources and by when to reach them.

      • Assigned Security & Privacy Responsibilities
      • Internal Audit
      • Information Security & Privacy Policies
      • Security & Privacy Program Review
      • ISMS Manual
      • ISMS Scope Document

    • C.6.3 Planning of changes

      Make changes to the ISMS deliberately and in a planned way rather than ad hoc.

      • ISMS Manual
      • ISMS Scope Document

  • C7 Support

    • C.7.1 Resources

      Provide the people, budget and tools needed to build, run and improve the ISMS.

      • Management Review of Risks
      • Internal Audit
      • Risk Framing
      • ISMS Manual
      • ISMS Scope Document

    • C.7.2 Competence

      Make sure people whose work affects information security have the right skills through education, training or experience, and keep proof of it.

      • Roles & Responsibilities
      • Organizational Structure
      • Competency Screening
      • Personnel Screening
      • New Hire Policy Acknowledgement
      • Performance Review
      • Periodic Policy Acknowledgement
      • Publishing Security & Privacy Documentation
      • Human Resources Policy & Procedure
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • C.7.3 Awareness

      Make sure staff know the security policy, how they contribute to the ISMS and what happens if they do not follow it.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • ISMS Manual

    • C.7.4 Communication

      Decide what security topics to communicate, when, to whom and through which channels, both inside and outside the organization.

      • Automated Incident Reporting
      • Incident Reporting Assistance
      • Publishing Security & Privacy Documentation
      • Information Security & Privacy Policies
      • ISMS Manual
      • Conspicuous Privacy Notice Link

    • C.7.5.1 Documented information (general)

      Keep the documents and records the standard requires plus any others the organization needs for the ISMS to work.

      • Internal Audit
      • ISMS Manual

    • C.7.5.2 Creating and updating documented information

      Give documents a clear identity, a suitable format and a review and approval step whenever they are created or changed.

      • ISMS Manual

    • C.7.5.3 Control of documented information

      Keep documents available where needed and protected, and manage their distribution, versions, storage, retention and disposal.

      • Information Security & Privacy Policies
      • ISMS Manual

  • C8 Operation

    • C.8.1 Operational planning and control

      Plan and run the processes needed to meet security requirements, including outsourced processes and planned changes, and keep evidence they ran as intended.

      • ISMS Manual

    • C.8.2 Information security risk assessment

      Run security risk assessments at planned intervals and whenever significant changes happen, and keep the results.

      • Risk Framing
      • Risk Assessment Policy & Procedure
      • ISMS Scope Document

    • C.8.3 Information security risk treatment

      Carry out the risk treatment plan and keep records of what was done and the outcome.

      • Risk Framing
      • Risk Assessment Policy & Procedure
      • ISMS Manual
      • ISMS Scope Document

  • C9 Performance evaluation

    • C.9.1 Monitoring, measurement, analysis and evaluation

      Choose what to measure about security performance, how and when, and use the results to judge whether the ISMS is effective.

      • Internal Audit
      • ISMS Manual

    • C.9.2 Internal audit

      Audit the ISMS internally on a planned schedule to check it meets the organization's and the standard's requirements and is working in practice.

      • Internal Audit
      • ISMS Manual

    • C.9.3 Management review

      Top management reviews the ISMS at planned intervals to confirm it is still suitable and effective and records the decisions made.

      • Management Review of Policies
      • Security & Privacy Program Review
      • Management Review of Org Chart
      • Management Review of Risks
      • Management Review of Third-Party Risks
      • Internal Audit
      • ISMS Manual
      • ISMS Scope Document

  • C10 Improvement

    • C.10.1 Continual improvement

      Keep making the ISMS more suitable, adequate and effective over time.

      • Assigned Security & Privacy Responsibilities
      • Internal Audit
      • Security & Privacy Program Review
      • ISMS Scope Document
      • ISMS Manual

    • C.10.2 Nonconformity and corrective action

      When something does not conform, contain it, find and fix the root cause, check the fix worked and keep records.

      • Assigned Security & Privacy Responsibilities
      • Internal Audit
      • Security & Privacy Program Review
      • ISMS Manual
      • ISMS Scope Document

• Annex A Annex A Controls

  • A.5 Organisational Controls

    • A.5.1 Policies for information security

      Write a top-level security policy and supporting topic policies, get them approved by management, share them with staff and relevant parties, and review them regularly.

      • Information Security & Privacy Policies
      • Management Review of Policies
      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement

    • A.5.2 Information security roles and responsibilities

      Define who is responsible for which security tasks and assign those roles based on what the organization needs.

      • Organizational Structure
      • Roles & Responsibilities
      • Assigned Security & Privacy Responsibilities
      • Security & Privacy Program Review
      • Asset Ownership Assignment
      • People Operations Owner
      • Compliance Program Manager
      • Cybersecurity Responsibilities

    • A.5.3 Segregation of duties

      Split conflicting tasks between different people so that no one person can misuse or alter assets unnoticed.

      • Organizational Structure
      • Roles & Responsibilities
      • Management Review of Org Chart
      • Cybersecurity Responsibilities

    • A.5.4 Management responsibilities

      Managers make sure their teams follow the organization's security policies and procedures.

      • Security & Privacy Awareness
      • Internal Audit
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • A.5.5 Contact with authorities

      Keep working relationships and contact details for regulators, law enforcement and other relevant authorities.

      • Cybersecurity Responsibilities

    • A.5.6 Contact with special interest groups

      Stay connected with security forums and professional groups to keep up with good practice and emerging threats.

      • Cybersecurity Responsibilities

    • A.5.7 Threat intelligence

      Gather and analyze information about security threats and use it to decide on protective measures.

      • Capacity & Performance Management
      • Incident Management Policy & Procedure
      • Incident Tracking
      • Centralized Security Logging

    • A.5.8 Information security in project management

      Treat security as part of every project, with security requirements identified and handled from start to finish.

      • Risk Framing
      • Risk Assessment
      • Fraud Risk Assessment
      • Approval of Changes
      • Risk Assessment Policy & Procedure
      • Secure System Modification
      • Change Management Policy & Procedure

    • A.5.9 Inventory of information and other associated assets

      Keep an up-to-date inventory of information and related assets, each with a named owner.

      • Limit Network Connections
      • Inventory of Infrastructure Assets
      • Endpoint Security Validation
      • Asset Inventory Updates
      • Inventory of Endpoint Assets
      • External System Connections

    • A.5.10 Acceptable use of information and other associated assets

      Set clear rules for how staff may use and handle information and related assets, and put them into practice.

      • Rules of Behavior

    • A.5.11 Return of assets

      Collect company assets from staff and other parties when their employment, contract or agreement changes or ends.

      • Human Resources Policy & Procedure
      • People Operations Owner

    • A.5.12 Classification of information

      Classify information by sensitivity and legal and business needs so each class gets the right level of protection.

      • Data Classification Labels
      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Asset Inventory Updates
      • Secure System Modification
      • Data Classification Policy

    • A.5.13 Labelling of information

      Mark information with its classification using agreed labelling procedures.

      • Data Classification Labels
      • Security Governance Program
      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Asset Inventory Updates

    • A.5.14 Information transfer

      Have rules or agreements that protect information whenever it is sent internally or to outside parties, whatever the method.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Subservice Organization Evaluation
      • Transmission Confidentiality

    • A.5.15 Access control

      Define rules for who may physically or logically access information and assets, based on business and security needs.

      • Rules of Behavior
      • Access Control Policy & Procedure
      • Endpoint Security Policy
      • Inventory of Endpoint Assets
      • Asset Inventory Updates

    • A.5.16 Identity management

      Manage user and system identities through their whole lifecycle, from creation to removal.

      • Production System Access Review
      • Termination of Employment
      • Access Control Policy & Procedure
      • Identity Validation
      • User Privilege Reviews
      • User Access Reviews

    • A.5.17 Authentication information

      Control how passwords, keys and other secrets are issued and handled, and tell staff how to keep them safe.

      • Access Control Policy & Procedure
      • Password Management Guidelines
      • Identity Validation
      • Termination of Employment
      • Multi-Factor Authentication

    • A.5.18 Access rights

      Grant, review, adjust and remove access rights according to the access control rules.

      • Access Control Policy & Procedure
      • Identity Validation
      • Termination of Employment
      • User Privilege Reviews
      • User Access Reviews

    • A.5.19 Information security in supplier relationships

      Have a process to manage the security risks that come from using suppliers' products and services.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Vendor Management Policy & Procedure

    • A.5.20 Addressing information security within supplier agreements

      Write the security requirements that apply to each supplier into the agreement with that supplier.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Subservice Organization Evaluation
      • Vendor Management Policy & Procedure

    • A.5.21 Managing information security in the ICT supply chain

      Manage security risks that come from the supply chain behind the technology products and services you buy.

      • Third-Party Criticality Assessments
      • Risk Framing
      • Risk Assessment
      • Fraud Risk Assessment
      • Management Review of Third-Party Risks
      • Management Review of Risks
      • Vendor Management Policy & Procedure
      • Risk Assessment Policy & Procedure

    • A.5.22 Monitoring, review and change management of supplier services

      Regularly check suppliers' security practices and service delivery, and manage changes to the services they provide.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks

    • A.5.23 Information security for use of cloud services

      Define how cloud services are chosen, used, managed and exited in line with the organization's security requirements.

      • Vendor Management Policy & Procedure

    • A.5.24 Information security incident management planning and preparation

      Prepare for incidents by defining the incident management process, roles and responsibilities in advance.

      • Automated Incident Reporting
      • Incident Reporting Assistance
      • Anomalous Behavior Detection
      • Incident Management Policy & Procedure
      • Incident Tracking

    • A.5.25 Assessment and decision on information security events

      Review reported security events and decide whether each one counts as an incident.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • A.5.26 Response to information security incidents

      Handle security incidents by following the documented response procedures.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Centralized Security Logging
      • Anomalous Behavior Detection

    • A.5.27 Learning from information security incidents

      Use what was learned from past incidents to strengthen security controls.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Internal Audit
      • Security & Privacy Program Review

    • A.5.28 Collection of evidence

      Have procedures for identifying, collecting and preserving evidence about security events so it can be relied on later.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Anomalous Behavior Detection
      • Centralized Security Logging

    • A.5.29 Information security during disruption

      Plan how security will be maintained at an acceptable level during outages and other disruptions.

      • Disaster Recovery Testing
      • Backup Restoration Testing
      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure

    • A.5.30 ICT readiness for business continuity

      Plan, build and test IT readiness so that business continuity objectives can be met when disruption hits.

      • Backup Restoration Testing
      • Disaster Recovery Testing
      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure

    • A.5.31 Legal, statutory, regulatory and contractual requirements

      Identify, record and keep current the legal, regulatory and contractual security requirements that apply, and how the organization meets them.

      • Data Governance
      • Statutory, Regulatory & Contractual Compliance

    • A.5.32 Intellectual property rights

      Protect intellectual property rights, including using software only within its license terms.

      • Statutory, Regulatory & Contractual Compliance

    • A.5.33 Protection of records

      Keep records safe from loss, destruction, tampering and unauthorized access or release.

      • Media Disposal Policy
      • Security Governance Program
      • Data Classification Policy
      • Statutory, Regulatory & Contractual Compliance

    • A.5.34 Privacy and protection of PII

      Identify and meet the legal and contractual requirements for privacy and for protecting personal data.

      • Data Protection Policy & Procedure
      • Statutory, Regulatory & Contractual Compliance
      • Privacy by Design Policy

    • A.5.35 Independent review of information security

      Have the organization's security approach reviewed by someone independent at planned intervals or after major changes.

      • Internal Audit
      • Security & Privacy Program Review
      • Statutory, Regulatory & Contractual Compliance

    • A.5.36 Compliance with policies, rules and standards for information security

      Regularly check that security policies, rules and standards are actually being followed.

      • Internal Audit
      • Security & Privacy Program Review
      • Statutory, Regulatory & Contractual Compliance

    • A.5.37 Documented operating procedures

      Write down how IT systems and facilities are operated and make those procedures available to the people who need them.

      • Internal Audit
      • Management Review of Policies
      • Security & Privacy Program Review
      • Management Review of Risks
      • Management Review of Third-Party Risks
      • Information Security & Privacy Policies
      • Segregation of Duties
      • ISMS Scope Document
      • ISMS Manual

  • A.6 People Controls

    • A.6.1 Screening

      Run background checks on candidates before hiring, and periodically where justified, in proportion to the role, the risk and the law.

      • Personnel Screening

    • A.6.2 Terms and conditions of employment

      Spell out both the employee's and the organization's security responsibilities in employment contracts.

      • Organizational Structure
      • Code of Business Conduct
      • Roles & Responsibilities
      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Impact Analysis
      • People Operations Owner
      • Human Resources Policy & Procedure

    • A.6.3 Information security awareness, education and training

      Give staff security awareness training suited to their role, with regular refreshers on policies and procedures.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • A.6.4 Disciplinary process

      Have a formal, known disciplinary process for people who break security policy.

      • Code of Business Conduct
      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Publishing Security & Privacy Documentation
      • Information Security & Privacy Policies

    • A.6.5 Responsibilities after termination or change of employment

      Define and enforce the security duties, such as confidentiality, that continue after someone leaves or changes role.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement

    • A.6.6 Confidentiality or non-disclosure agreements

      Have staff and relevant outside parties sign confidentiality or non-disclosure agreements that match the organization's needs, and review them periodically.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Information Security & Privacy Policies
      • Management Review of Policies

    • A.6.7 Remote working

      Put security measures in place to protect information that staff access or handle while working away from the office.

      • Production System Access Review
      • Termination of Employment
      • Identity Validation
      • Access Control Policy & Procedure
      • Production Database Access Restriction
      • Limit Network Connections
      • Multi-Factor Authentication
      • User Privilege Reviews
      • User Access Reviews
      • Malware Protection
      • Full Device Encryption
      • Endpoint Security Validation
      • Session Lock
      • Media Disposal Policy
      • Endpoint Security Policy
      • External System Connections

    • A.6.8 Information security event reporting

      Give staff a simple way to report suspected security events quickly through the right channels.

      • Automated Incident Reporting
      • Incident Reporting Assistance
      • Incident Management Policy & Procedure
      • Incident Tracking

  • A.7 Physical Controls

    • A.7.1 Physical security perimeters

      Define physical perimeters around areas holding information and equipment and use them to keep those areas protected.

      • Physical Protection Policy & Procedure

    • A.7.2 Physical entry

      Control who can enter secure areas using appropriate entry controls and access points.

    • A.7.3 Securing offices, rooms and facilities

      Design and apply physical security for offices, rooms and other facilities.

      • Physical Protection Policy & Procedure

    • A.7.4 Physical security monitoring

      Watch premises continuously, for example with alarms or cameras, to detect unauthorized physical access.

    • A.7.5 Protecting against physical and environmental threats

      Protect facilities against fire, flood, natural disasters and deliberate physical attacks.

      • Physical Protection Policy & Procedure
      • Disaster Recovery Policy
      • Business Continuity Policy & Procedure
      • Disaster Recovery Testing

    • A.7.6 Working in secure areas

      Set and enforce rules for how people work inside secure areas.

      • Physical Protection Policy & Procedure
      • Media Disposal Policy

    • A.7.7 Clear desk and clear screen

      Require that papers and removable media are put away and screens are locked when left unattended.

      • Media Disposal Policy
      • Physical Protection Policy & Procedure
      • Endpoint Security Policy
      • Session Lock

    • A.7.8 Equipment siting and protection

      Place equipment where it is protected from environmental hazards and unauthorized access.

      • Physical Protection Policy & Procedure
      • Endpoint Security Policy
      • Media Disposal Policy

    • A.7.9 Security of assets off-premises

      Protect laptops and other assets used outside the organization's premises.

      • Media Disposal Policy
      • Physical Protection Policy & Procedure
      • Endpoint Security Policy
      • Malware Protection
      • Full Device Encryption
      • Endpoint Security Validation
      • Session Lock
      • Inventory of Endpoint Assets

    • A.7.10 Storage media

      Manage storage media securely from purchase through use, transport and disposal according to its classification.

      • Media Disposal Policy

    • A.7.11 Supporting utilities

      Protect facilities against power cuts and other failures in supporting utilities.

      • Physical Protection Policy & Procedure

    • A.7.12 Cabling security

      Protect power and network cabling from interception, interference and damage.

    • A.7.13 Equipment maintenance

      Maintain equipment properly so information stays available, intact and confidential.

      • Endpoint Security Policy
      • Malware Protection
      • Full Device Encryption
      • Endpoint Security Validation
      • Session Lock

    • A.7.14 Secure disposal or re-use of equipment

      Check that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or reused.

      • Media Disposal Policy

  • A.8 Technological Controls

    • A.8.1 User endpoint devices

      Protect information stored on or reachable from laptops, phones and other user devices.

      • Endpoint Security Policy
      • Malware Protection
      • Endpoint Security Validation
      • Full Device Encryption
      • Session Lock

    • A.8.2 Privileged access rights

      Limit and closely manage who gets administrator or other privileged access and how it is used.

      • Access Control Policy & Procedure
      • Identity Validation
      • Termination of Employment
      • Production Database Access Restriction
      • Multi-Factor Authentication
      • User Privilege Reviews
      • User Access Reviews

    • A.8.3 Information access restriction

      Restrict access to information and systems according to the access control policy.

      • Access Control Policy & Procedure
      • Identity Validation
      • Termination of Employment
      • Production Database Access Restriction
      • Multi-Factor Authentication
      • User Privilege Reviews
      • User Access Reviews
      • Limit Network Connections
      • External System Connections

    • A.8.4 Access to source code

      Control who can read and change source code, development tools and software libraries.

      • Identity Validation
      • User Privilege Reviews
      • Multi-Factor Authentication

    • A.8.5 Secure authentication

      Use secure login methods, such as multi-factor authentication, matched to how sensitive the access is.

      • Multi-Factor Authentication

    • A.8.6 Capacity management

      Monitor resource use and adjust capacity to meet current and expected demand.

      • Anomalous Behavior Detection
      • Centralized Security Logging
      • Impact Analysis

    • A.8.7 Protection against malware

      Defend against malware with technical tools backed by user awareness.

      • Malware Protection

    • A.8.8 Management of technical vulnerabilities

      Track technical vulnerabilities in systems in use, assess the exposure and fix or mitigate them in time.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation
      • Penetration Testing
      • Capacity & Performance Management

    • A.8.9 Configuration management

      Define secure configurations for hardware, software, services and networks, apply them and watch for drift.

      • Impact Analysis
      • Data Backups
      • Encryption of Data at Rest

    • A.8.10 Information deletion

      Delete information from systems, devices and storage once it is no longer needed.

      • Media Disposal Policy
      • Data Retention Policy

    • A.8.11 Data masking

      Mask or pseudonymize data where access rules, business needs or the law call for it.

      • Full Device Encryption
      • Encryption of Data at Rest
      • Transmission Confidentiality
      • Encryption Policy & Procedure
      • Data Protection Policy & Procedure

    • A.8.12 Data leakage prevention

      Use measures to detect and stop sensitive information from leaking out of systems, networks and devices.

      • Data Protection Policy & Procedure
      • Full Device Encryption
      • Encryption of Data at Rest
      • Transmission Confidentiality
      • Encryption Policy & Procedure

    • A.8.13 Information backup

      Keep backups of information, software and systems according to an agreed backup policy and test that they can be restored.

      • Data Backup Policy
      • Data Backups
      • Backup Restoration Testing

    • A.8.14 Redundancy of information processing facilities

      Build in enough redundancy for systems to meet their availability requirements.

      • Data Backup Policy
      • Data Backups

    • A.8.15 Logging

      Record activities, exceptions, faults and other relevant events in logs that are stored, protected and analyzed.

      • Anomalous Behavior Detection
      • Centralized Security Logging
      • Incident Management Policy & Procedure
      • Incident Tracking

    • A.8.16 Monitoring activities

      Watch networks, systems and applications for unusual behavior and act to assess possible incidents.

      • Anomalous Behavior Detection
      • Centralized Security Logging
      • Incident Management Policy & Procedure
      • Incident Tracking
      • Capacity & Performance Management
      • Data Breach Notification Policy

    • A.8.17 Clock synchronization

      Keep system clocks synchronized to approved time sources so logs and events line up.

      • Clock Synchronization

    • A.8.18 Use of privileged utility programs

      Restrict and tightly control utility programs that can bypass system and application controls.

      • Change Management Policy & Procedure

    • A.8.19 Installation of software on operational systems

      Control how software is installed on production systems so only approved software goes in.

      • Rules of Behavior
      • Security Governance Program

    • A.8.20 Networks security

      Secure, manage and control networks and network devices to protect the information passing through them.

      • External System Connections
      • Access Control Policy & Procedure
      • Identity Validation
      • Multi-Factor Authentication
      • Limit Network Connections
      • Transmission Confidentiality
      • Network Security Policy & Procedure

    • A.8.21 Security of network services

      Define and monitor the security features and service levels required from network services, whether in-house or outsourced.

      • Impact Analysis
      • Capacity & Performance Management
      • Subservice Organization Evaluation
      • Network & Data Flow Diagrams

    • A.8.22 Segregation of networks

      Separate groups of users, services and systems into distinct network segments.

      • Inventory of Infrastructure Assets
      • Identity Validation

    • A.8.23 Web filtering

      Control access to external websites to reduce exposure to malicious content.

      • Malware Protection
      • Full Device Encryption
      • Endpoint Security Validation
      • Session Lock
      • Endpoint Security Policy

    • A.8.24 Use of cryptography

      Set rules for using encryption effectively, including how cryptographic keys are managed.

      • Full Device Encryption
      • Encryption of Data at Rest
      • Encryption Policy & Procedure

    • A.8.25 Secure development life cycle

      Set rules so that software and systems are developed securely at every stage.

      • Security & Privacy Awareness
      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Change Management Policy & Procedure
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • A.8.26 Application security requirements

      Identify and approve security requirements when building or buying applications.

      • Periodic Security & Privacy Training
      • New Hire Security & Privacy Training
      • Security & Privacy Awareness
      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes
      • Vulnerability Management Policy & Procedure
      • Vulnerability Remediation Process
      • Centralized Flaw Remediation

    • A.8.27 Secure system architecture and engineering principles

      Define secure engineering principles, keep them current and apply them to all system development work.

      • Security & Privacy Awareness
      • Change Management Policy & Procedure
      • Vulnerability Management Policy & Procedure
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • A.8.28 Secure coding

      Write software following secure coding practices that prevent common vulnerabilities.

      • Security & Privacy Awareness
      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Change Management Policy & Procedure
      • Approval of Changes
      • Centralized Flaw Remediation
      • Vulnerability Remediation Process
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • A.8.29 Security testing in development and acceptance

      Test for security throughout development and before systems are accepted into production.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes

    • A.8.30 Outsourced development

      Direct, monitor and review development work done by outside parties.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes
      • Vulnerability Management Policy & Procedure

    • A.8.31 Separation of development, test and production environments

      Keep development, test and production environments apart and secure each of them.

      • Secure System Modification
      • Approval of Changes

    • A.8.32 Change management

      Run changes to systems and IT facilities through a defined change management process.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes

    • A.8.33 Test information

      Choose, protect and manage the data used for testing, avoiding exposure of sensitive production data.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes

    • A.8.34 Protection of information systems during audit testing

      Plan and agree audits and technical tests on live systems with management so they do not disrupt operations.

      • Internal Audit
      • Security & Privacy Program Review
      • Penetration Testing