Introduction
  • Introduction
Changes in ISO Annex A:2022
  • Changes in ISO Annex A:2022
5. Organizational Controls
  • Introduction
  • 5.1. Information Security Policy
  • 5.2. Information Security Roles and Responsibilities
  • 5.3. Segregation of Duties
  • 5.4. Management Responsibilities
  • 5.5 Contact with Authorities
  • 5.6 Contact with Special Interest Groups
  • 5.7 Threat Intelligence
  • 5.8 Information Security in Project Management
  • 5.9 Inventory of Information and Other Associated Assets
  • 5.10 Acceptable Use of Information and Other Associated Assets
  • 5.11 Return of Assets
  • 5.12 Classification of Information
  • 5.13 Labeling of Information
  • 5.14 Information Transfer
  • 5.15 Access Control
  • 5.16 Identity Management
  • 5.17 Authentication Information
  • 5.18 Access Rights
  • 5.19 Information Security in Supplier Relationships
  • 5.20 Addressing Security Within Supplier Agreements
  • 5.21 Managing Information Security in the ICT Supply Chain
  • 5.22 Monitoring, Review & Change Management of Supplier Services
  • 5.25 Assessment and Decision on Information Security Events
  • 5.23 Information Security for Use of Cloud Services
  • 5.24 Information Security Incident Management Planning and Preparation
  • 5.27 Learning from Information Security Incidents
  • 5.26 Response to Information Security Incidents
  • 5.28 Collection of Evidence
  • 5.29 Information Security During Disruption
  • 5.30 ICT Readiness for Business Continuity
  • 5.31 Statutory, Regulatory and Contractual Requirements
  • 5.32 Intellectual Property Rights
  • 5.33 Protection of records
  • 5.34 Privacy and Protection of PII
  • 5.35 Independent Review of Information Security
  • 5.36 Compliance with Policies, Rules and Standards for Information Security
  • 5.37 Documented operating procedures
6. People Controls
  • Introduction
  • 6.1 Screening
  • 6.2 Terms and Conditions of Employment
  • 6.3 Information Security Awareness, Education and training
  • 6.4 Disciplinary Process
  • 6.5 Responsibilities After Termination or Change of Employment
  • 6.6 Confidentiality or Non-disclosure Agreements
  • 6.7 Remote working
  • 6.8 Information Security Event Reporting
7. Physical Controls
  • Introduction
  • 7.1 Physical Security Perimeters
  • 7.2 Physical Entry
  • 7.4 Physical security monitoring
  • 7.3 Securing Offices, Rooms and Facilities
  • 7.5 Protecting Against Physical and Environmental Threat
  • 7.6 Working in Secure Areas
  • 7.7 Clear Desk and Clear Screen
  • 7.8 Equipment Siting and Protection
  • 7.9 Security of Assets Off-premises
  • 7.10 Storage Media
  • 7.11 Supporting Utilities
  • 7.12 Cabling Security
  • 7.13 Equipment maintenance
  • 7.14 Secure Disposal or Re-use of Equipment
8. Technological Controls
  • Introduction
  • 8.1 User Endpoint Devices
  • 8.2 Privileged access rights
  • 8.3 Information Access Restriction
  • 8.4 Access To Source Code
  • 8.5 Secure Authentication
  • 8.6 Capacity Management
  • 8.7 Protection Against Malware
  • 8.8 Management of Technical Vulnerabilities
  • 8.9 Configuration Management
  • 8.10 Information Deletion
  • 8.11 Data Masking
  • 8.12 Data Leakage Prevention
  • 8.13 Information Backup
  • 8.14 Redundancy of Information Processing Facilities
  • 8.15 Logging
  • 8.16 Monitoring Activities
  • 8.17 Clock Synchronization
  • 8.18 Use of Priviledged Utility Program
  • 8.19 Installation of Software on Operational Systems
  • 8.20 Networks Security
  • 8.21 Security of Network Service
  • 8.22 Segregation of Networks
  • 8.23 Web Filtering
  • 8.24 Use of Cryptography
  • 8.25 Secure Development Life Cycle
  • 8.27 Secure System Architecture and Engineering Principles
  • 8.28 Secure Coding
  • 8.29 Security Testing in Development and Acceptance
  • 8.26 Application Security Requirements