|

Controls

Organizational controls

Information Security Policies

This control requires the definition, approval, and communication of a high-level information security policy and topic-…

Information Security Roles and Responsibilities

This control requires the definition and allocation of information security roles and responsibilities within the organi…

Segregation of Duties

This control ensures that conflicting duties and areas of responsibility are separated to reduce the risk of unauthorize…

Management Responsibilities

This control requires management to ensure that all personnel apply information security in accordance with the establis…

Contact with Authorities

The organization must maintain appropriate contacts with relevant authorities to ensure that information can be exchange…

Contact with Special Interest Groups

This control encourages participation in professional security forums, industry groups, and specialist associations. Sta…

Threat Intelligence

This control requires the organization to collect and analyze information regarding information security threats. By mai…

Information Security in Project Management

Information security must be integrated into project management practices regardless of the nature of the project. This …

Inventory of Information and Other Associated Assets

The organization must identify its information and other associated assets and maintain an inventory of these assets. Yo…

Acceptable Use of Information and Other Associated Assets

Rules for the acceptable use of information and other associated assets must be identified, documented, and implemented.…

Return of Assets

Personnel and other interested parties must return all the organization's assets in their possession upon termination of…

Classification of Information

The organization must classify information according to its security requirements based on confidentiality, integrity, a…

Labelling of Information

An appropriate set of procedures for information labelling should be developed and implemented in accordance with the in…

Information Transfer

Information transfer rules, procedures, or agreements should be in place for all types of transfer facilities within the…

Rules to control physical and logical access to information and other associated assets should be established and implem…

Identity Management

The full life cycle of identities should be managed, including the identification, authentication, and authorization of …

Authentication Information

The allocation and management of authentication information should be controlled by a formal management process. This en…

Access rights to information and other associated assets should be provisioned, reviewed, modified, and removed in accor…

Information Security in Supplier Relationships

Processes and agreed requirements should be defined and implemented to mitigate the risks associated with the supplier's…

Addressing Information Security Within Supplier Agreements

The organization should establish and agree on relevant information security requirements with each supplier that may ac…

Managing Information Security in the ICT Supply Chain

The organization should define and implement processes to manage the risks associated with the Information and Communica…

Monitoring, Review and Change Management of Supplier Services

The organization should regularly monitor, review, and audit supplier service delivery. This ensures that the informatio…

Information Security for Use of Cloud Services

Processes for acquisition, use, management, and exit from cloud services should be established in accordance with the or…

Information Security Incident Management Planning and Preparation

The organization should plan and prepare for information security incident management by defining, establishing, and com…

Assessment and Decision on Information Security Events

The organization should assess information security events and decide whether they should be categorized as information …

Response to Information Security Incidents

Information security incidents should be responded to in accordance with the established procedures. This phase focuses …

Learning from Information Security Incidents

Knowledge gained from information security incidents should be used to strengthen and improve the information security c…

Collection of Evidence

The organization should establish and implement procedures for the identification, collection, acquisition, and preserva…

Information Security During Disruption

The organization should plan how to maintain information security at an appropriate level during a disruption. Security …

ICT Readiness for Business Continuity

Information and Communication Technology (ICT) readiness should be planned, implemented, maintained, and tested based on…

Legal, Statutory, Regulatory and Contractual Requirements

The organization should identify and document all relevant legal, statutory, regulatory, and contractual requirements re…

Intellectual Property Rights

The organization should implement appropriate procedures to protect intellectual property rights. This ensures that both…

Protection of Records

Records should be protected from loss, destruction, falsification, unauthorized access, and unauthorized release, in acc…

Privacy and Protection of PII

The organization should identify and meet the requirements regarding the preservation of privacy and protection of perso…

Independent Review of Information Security

The organization's approach to managing information security and its implementation (e.g., control objectives, controls,…

Compliance with Policies, Rules and Standards for Information Security

Managers should regularly review the compliance of information processing and procedures within their area of responsibi…

Documented Operating Procedures

Operating procedures for information processing facilities should be documented and made available to personnel who need…

People controls

Background verification checks on all candidates for employment should be carried out prior to joining the organization.…

Terms and Conditions of Employment

Contractual agreements with employees and contractors should state their responsibilities for information security. This…

Information Security Awareness, Education and Training

Personnel and relevant interested parties should receive appropriate information security awareness, education, and trai…

Disciplinary Process

A formal and communicated disciplinary process should be in place to take action against personnel who have committed an…

Responsibilities After Termination or Change of Employment

Information security responsibilities and duties that remain valid after termination or change of employment should be d…

Confidentiality or Non-Disclosure Agreements

Confidentiality or non-disclosure agreements (NDAs) reflecting the organization's needs for the protection of informatio…

Security measures should be implemented when personnel are working remotely to protect information accessed, processed, …

Information Security Event Reporting

Personnel and contractors should be required to report any observed or suspected information security events through app…

Physical controls

Physical Security Perimeters

Physical security perimeters should be defined and used to protect areas that contain information and other associated a…

Physical Entry Controls

Secure areas should be protected by appropriate entry controls to ensure that only authorized personnel are allowed acce…

Securing Offices, Rooms and Facilities

Physical security for offices, rooms, and facilities should be designed and implemented to prevent unauthorized access, …

Physical Security Monitoring

The organization should continuously monitor physical areas for unauthorized access or suspicious activity. This involve…

Protecting Against Physical and Environmental Threats

Protection against natural disasters, malicious attacks, or accidents should be designed and implemented. This covers fi…

Working in Secure Areas

Procedures for working in secure areas should be designed and implemented. This ensures that personnel follow specific s…

Clear Desk and Clear Screen

A clear desk policy for papers and removable storage media and a clear screen policy for information processing faciliti…

Equipment Siting and Protection

Equipment should be sited and protected to reduce the risks from environmental threats and hazards, and opportunities fo…

Security of Assets Off-Premises

Off-premises assets should be protected, considering the different risks of working outside the organization's premises.…

Storage media should be managed throughout their lifecycle of acquisition, use, transportation, and disposal in accordan…

Supporting Utilities

Equipment should be protected from power failures and other disruptions caused by failures in supporting utilities. This…

Cabling Security

Power and telecommunications cabling carrying data or supporting information services should be protected from intercept…

Equipment Maintenance

Equipment should be correctly maintained to ensure its continued availability and integrity. Regular servicing and proac…

Secure Disposal or Re-Use of Equipment

Items of equipment containing storage media should be verified to ensure that any sensitive data and licensed software h…

Technological controls

User Endpoint Devices

Information stored on, processed by, or accessible via user endpoint devices should be protected. This ensures that lapt…

Privileged Access Rights

The allocation and use of privileged access rights should be restricted and managed. This ensures that administrative po…

Information Access Restriction

Access to information and other associated assets should be restricted in accordance with the established topic-specific…

Access to Source Code

Read and write access to source code, development tools, and software libraries should be appropriately managed. This pr…

Secure Authentication

Secure authentication technologies and procedures should be implemented based on information access restrictions and the…

Capacity Management

The use of resources should be monitored and adjusted in line with current and expected capacity requirements. This ensu…

Protection Against Malware

Protection against malware should be implemented and supported by appropriate user awareness. This involves a multi-laye…

Management of Technical Vulnerabilities

Information about technical vulnerabilities of information systems in use should be obtained, the organization's exposur…

Configuration Management

Configurations, including security configurations, of hardware, software, services, and networks should be established, …

Information Deletion

Information stored in information systems, devices, or any other storage media should be deleted when no longer required…

Data masking should be used in accordance with the organization's topic-specific policy on access control and other rela…

Data Leakage Prevention

Data leakage prevention (DLP) measures should be applied to systems, networks and any other devices that process, store …

Information Backup

Backup copies of information, software and system images should be maintained and regularly tested in accordance with th…

Redundancy of Information Processing Facilities

Information processing facilities should be implemented with redundancy sufficient to meet availability requirements. Th…

Logs that record activities, exceptions, faults and other relevant events should be produced, kept and periodically revi…

Monitoring Activities

Networks, systems and applications should be monitored for anomalous behavior and appropriate actions taken to evaluate …

Clock Synchronization

The clocks of all relevant information processing systems within an organization or security domain should be synchroniz…

Use of Privileged Utility Programs

The use of utility programs that can be capable of overriding system and application controls should be restricted and t…

Installation of Software on Operational Systems

Procedures and measures should be implemented to securely manage the installation of software on operational systems. Th…

Network Security

Networks and network devices should be secured, managed and controlled to protect information in systems and application…

Security of Network Services

Security mechanisms, service levels and management requirements of all network services should be identified, implemente…

Segregation of Networks

Groups of information services, users and information systems should be segregated on networks. This limits the blast ra…

Access to external websites should be managed to reduce exposure to malicious content and ensure that the use of the int…

Use of Cryptography

Rules for the effective use of cryptography, including cryptographic key management, should be defined and implemented. …

Secure Development Life Cycle

Rules for the secure development of software and systems should be established and applied. This ensures that security i…

Application Security Requirements

Information security requirements should be identified, specified and approved when developing or acquiring applications…

Secure System Architecture and Engineering Principles

Principles for engineering secure systems should be established, documented, maintained and applied to any information s…

Secure coding principles should be applied to software development. This reduces the number of security vulnerabilities …

Security Testing in Development and Acceptance

Security testing activities should be defined and implemented in the development life cycle. This involves verifying tha…

Outsourced Development

The organization should direct, monitor and review the activities related to outsourced system development. This ensures…

Separation of Development, Test and Production Environments

Development, testing and production environments should be separated and secured to reduce the risks of unauthorized acc…

Change Management

Changes to information processing facilities and systems should be subject to change management procedures. This ensures…

Test data should be selected, protected and managed appropriately. This ensures that the testing process does not inadve…

Protection of Information Systems During Audit Testing

Audit requirements and activities involving checks on operational systems should be planned and agreed between the teste…