Controls

Information Security Policies

This control requires the definition, approval, and communication of a high-level information security policy and t…

Information Security Roles and Responsibilities

This control requires the definition and allocation of information security roles and responsibilities within the o…

Segregation of Duties

This control ensures that conflicting duties and areas of responsibility are separated to reduce the risk of unauth…

Management Responsibilities

This control requires management to ensure that all personnel apply information security in accordance with the est…

Contact with Authorities

The organization must maintain appropriate contacts with relevant authorities to ensure that information can be exc…

Contact with Special Interest Groups

This control encourages participation in professional security forums, industry groups, and specialist associations…

Threat Intelligence

This control requires the organization to collect and analyze information regarding information security threats. B…

Information Security in Project Management

Information security must be integrated into project management practices regardless of the nature of the project. …

Inventory of Information and Other Associated Assets

The organization must identify its information and other associated assets and maintain an inventory of these asset…

Acceptable Use of Information and Other Associated Assets

Rules for the acceptable use of information and other associated assets must be identified, documented, and impleme…

Return of Assets

Personnel and other interested parties must return all the organization's assets in their possession upon terminati…

Classification of Information

The organization must classify information according to its security requirements based on confidentiality, integri…

Labelling of Information

An appropriate set of procedures for information labelling should be developed and implemented in accordance with t…

Information Transfer

Information transfer rules, procedures, or agreements should be in place for all types of transfer facilities withi…

Access Control

Rules to control physical and logical access to information and other associated assets should be established and i…

Identity Management

The full life cycle of identities should be managed, including the identification, authentication, and authorizatio…

Authentication Information

The allocation and management of authentication information should be controlled by a formal management process. Th…

Access Rights

Access rights to information and other associated assets should be provisioned, reviewed, modified, and removed in …

Information Security in Supplier Relationships

Processes and agreed requirements should be defined and implemented to mitigate the risks associated with the suppl…

Addressing Information Security Within Supplier Agreements

The organization should establish and agree on relevant information security requirements with each supplier that m…

Managing Information Security in the ICT Supply Chain

The organization should define and implement processes to manage the risks associated with the Information and Comm…

Monitoring, Review and Change Management of Supplier Services

The organization should regularly monitor, review, and audit supplier service delivery. This ensures that the infor…

Information Security for Use of Cloud Services

Processes for acquisition, use, management, and exit from cloud services should be established in accordance with t…

Information Security Incident Management Planning and Preparation

The organization should plan and prepare for information security incident management by defining, establishing, an…

Assessment and Decision on Information Security Events

The organization should assess information security events and decide whether they should be categorized as informa…

Response to Information Security Incidents

Information security incidents should be responded to in accordance with the established procedures. This phase foc…

Learning from Information Security Incidents

Knowledge gained from information security incidents should be used to strengthen and improve the information secur…

Collection of Evidence

The organization should establish and implement procedures for the identification, collection, acquisition, and pre…

Information Security During Disruption

The organization should plan how to maintain information security at an appropriate level during a disruption. Secu…

ICT Readiness for Business Continuity

Information and Communication Technology (ICT) readiness should be planned, implemented, maintained, and tested bas…

Legal, Statutory, Regulatory and Contractual Requirements

The organization should identify and document all relevant legal, statutory, regulatory, and contractual requiremen…

Intellectual Property Rights

The organization should implement appropriate procedures to protect intellectual property rights. This ensures that…

Protection of Records

Records should be protected from loss, destruction, falsification, unauthorized access, and unauthorized release, i…

Privacy and Protection of PII

The organization should identify and meet the requirements regarding the preservation of privacy and protection of …

Independent Review of Information Security

The organization's approach to managing information security and its implementation (e.g., control objectives, cont…

Compliance with Policies, Rules and Standards for Information Security

Managers should regularly review the compliance of information processing and procedures within their area of respo…

Documented Operating Procedures

Operating procedures for information processing facilities should be documented and made available to personnel who…

Screening

Background verification checks on all candidates for employment should be carried out prior to joining the organiza…

Terms and Conditions of Employment

Contractual agreements with employees and contractors should state their responsibilities for information security.…

Information Security Awareness, Education and Training

Personnel and relevant interested parties should receive appropriate information security awareness, education, and…

Disciplinary Process

A formal and communicated disciplinary process should be in place to take action against personnel who have committ…

Responsibilities After Termination or Change of Employment

Information security responsibilities and duties that remain valid after termination or change of employment should…

Confidentiality or Non-Disclosure Agreements

Confidentiality or non-disclosure agreements (NDAs) reflecting the organization's needs for the protection of infor…

Remote Working

Security measures should be implemented when personnel are working remotely to protect information accessed, proces…

Information Security Event Reporting

Personnel and contractors should be required to report any observed or suspected information security events throug…

Physical Security Perimeters

Physical security perimeters should be defined and used to protect areas that contain information and other associa…

Physical Entry Controls

Secure areas should be protected by appropriate entry controls to ensure that only authorized personnel are allowed…

Securing Offices, Rooms and Facilities

Physical security for offices, rooms, and facilities should be designed and implemented to prevent unauthorized acc…

Physical Security Monitoring

The organization should continuously monitor physical areas for unauthorized access or suspicious activity. This in…

Protecting Against Physical and Environmental Threats

Protection against natural disasters, malicious attacks, or accidents should be designed and implemented. This cove…

Working in Secure Areas

Procedures for working in secure areas should be designed and implemented. This ensures that personnel follow speci…

Clear Desk and Clear Screen

A clear desk policy for papers and removable storage media and a clear screen policy for information processing fac…

Equipment Siting and Protection

Equipment should be sited and protected to reduce the risks from environmental threats and hazards, and opportuniti…

Security of Assets Off-Premises

Off-premises assets should be protected, considering the different risks of working outside the organization's prem…

Storage Media

Storage media should be managed throughout their lifecycle of acquisition, use, transportation, and disposal in acc…

Supporting Utilities

Equipment should be protected from power failures and other disruptions caused by failures in supporting utilities.…

Cabling Security

Power and telecommunications cabling carrying data or supporting information services should be protected from inte…

Equipment Maintenance

Equipment should be correctly maintained to ensure its continued availability and integrity. Regular servicing and …

Secure Disposal or Re-Use of Equipment

Items of equipment containing storage media should be verified to ensure that any sensitive data and licensed softw…

User Endpoint Devices

Information stored on, processed by, or accessible via user endpoint devices should be protected. This ensures that…

Privileged Access Rights

The allocation and use of privileged access rights should be restricted and managed. This ensures that administrati…

Information Access Restriction

Access to information and other associated assets should be restricted in accordance with the established topic-spe…

Access to Source Code

Read and write access to source code, development tools, and software libraries should be appropriately managed. Th…

Secure Authentication

Secure authentication technologies and procedures should be implemented based on information access restrictions an…

Capacity Management

The use of resources should be monitored and adjusted in line with current and expected capacity requirements. This…

Protection Against Malware

Protection against malware should be implemented and supported by appropriate user awareness. This involves a multi…

Management of Technical Vulnerabilities

Information about technical vulnerabilities of information systems in use should be obtained, the organization's ex…

Configuration Management

Configurations, including security configurations, of hardware, software, services, and networks should be establis…

Information Deletion

Information stored in information systems, devices, or any other storage media should be deleted when no longer req…

Data Masking

Data masking should be used in accordance with the organization's topic-specific policy on access control and other…

Data Leakage Prevention

Data leakage prevention (DLP) measures should be applied to systems, networks and any other devices that process, s…

Information Backup

Backup copies of information, software and system images should be maintained and regularly tested in accordance wi…

Redundancy of Information Processing Facilities

Information processing facilities should be implemented with redundancy sufficient to meet availability requirement…

Logging

Logs that record activities, exceptions, faults and other relevant events should be produced, kept and periodically…

Monitoring Activities

Networks, systems and applications should be monitored for anomalous behavior and appropriate actions taken to eval…

Clock Synchronization

The clocks of all relevant information processing systems within an organization or security domain should be synch…

Use of Privileged Utility Programs

The use of utility programs that can be capable of overriding system and application controls should be restricted …

Installation of Software on Operational Systems

Procedures and measures should be implemented to securely manage the installation of software on operational system…

Network Security

Networks and network devices should be secured, managed and controlled to protect information in systems and applic…

Security of Network Services

Security mechanisms, service levels and management requirements of all network services should be identified, imple…

Segregation of Networks

Groups of information services, users and information systems should be segregated on networks. This limits the bla…

Web Filtering

Access to external websites should be managed to reduce exposure to malicious content and ensure that the use of th…

Use of Cryptography

Rules for the effective use of cryptography, including cryptographic key management, should be defined and implemen…

Secure Development Life Cycle

Rules for the secure development of software and systems should be established and applied. This ensures that secur…

Application Security Requirements

Information security requirements should be identified, specified and approved when developing or acquiring applica…

Secure System Architecture and Engineering Principles

Principles for engineering secure systems should be established, documented, maintained and applied to any informat…

Secure Coding

Secure coding principles should be applied to software development. This reduces the number of security vulnerabili…

Security Testing in Development and Acceptance

Security testing activities should be defined and implemented in the development life cycle. This involves verifyin…

Outsourced Development

The organization should direct, monitor and review the activities related to outsourced system development. This en…

Separation of Development, Test and Production Environments

Development, testing and production environments should be separated and secured to reduce the risks of unauthorize…

Change Management

Changes to information processing facilities and systems should be subject to change management procedures. This en…

Test Data

Test data should be selected, protected and managed appropriately. This ensures that the testing process does not i…

Protection of Information Systems During Audit Testing

Audit requirements and activities involving checks on operational systems should be planned and agreed between the …