Showing 86 controls
5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur
The goal is to ensure that appropriate safeguards are in place and effective.
5.11 Return of Assets - Personnel and other interested parties as appropriate shall return all the organization's assets in their possession upon change or termination of their employment, contract, or agreement.
The goal is to ensure that appropriate safeguards are in place and effective.
5.12 Classification of Assets - Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability, and relevant interested party requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
5.13 Labelling of Information - An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.
The goal is to ensure that appropriate safeguards are in place and effective.
5.14 Information Transfer - Information transfer rules, procedures, or agreements shall be in place for all types of transfer facilities within the organization and between the organization and other parties.
The goal is to ensure that appropriate safeguards are in place and effective.
5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
5.16 Identity Management - The full lifecycle of identities shall be managed.
The goal is to ensure that appropriate safeguards are in place and effective.
5.17 Authentication information - Allocation and management of authentication information shall be controlled by a management process, including advising personnel on the appropriate handling of authentication information.
The goal is to ensure that appropriate safeguards are in place and effective.
5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.
The goal is to ensure that appropriate safeguards are in place and effective.
5.19 Information Security in Supplier relationships - Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of suppliers' products or services.
The goal is to ensure that appropriate safeguards are in place and effective.
5.2 Information security roles and responsibilities shall be defined and allocated according to the organization needs.
The goal is to ensure that appropriate safeguards are in place and effective.
5.21 Managing information security in the ICT supply chain - Processes and procedures shall be defined and implemented to manage the information security risks associated with ICT products and services supply chain.
The goal is to ensure that appropriate safeguards are in place and effective.
5.22 Monitoring, review and change management of supplier services - The organization shall regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery
The goal is to ensure that appropriate safeguards are in place and effective.
5.23 Information security for use of cloud services - Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.
The goal is to ensure that appropriate safeguards are in place and effective.
5.25 Assessment and decision on information security events - The organization shall assess information security events and decide if they are to be categorized as information security incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
5.26 Response to information security incidents - Information security incidents shall be responded to in accordance with the documented procedures.
The goal is to ensure that appropriate safeguards are in place and effective.
5.27 Learning from information security incidents - Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls.
The goal is to ensure that appropriate safeguards are in place and effective.
5.28 Collection of evidence - The organization shall establish and implement procedures for the identification, collection, acquisition, and preservation of evidence related to information security events
The goal is to ensure that appropriate safeguards are in place and effective.
5.29 Information security during disruption - The organization shall plan how to maintain information security at an appropriate level during disruption.
The goal is to ensure that appropriate safeguards are in place and effective.
5.3 Conflicting duties and conflicting areas of responsibility shall be segregated.
The goal is to ensure that appropriate safeguards are in place and effective.
5.31 Identification of legal, statutory, regulatory, and contractual requirements - Legal, statutory, regulatory, and contractual requirements relevant to information security and the organization's approach to meet these requirements shall be identified, documented, and kept up to date.
The goal is to ensure that appropriate safeguards are in place and effective.
5.32 Intellectual property right - The organization shall implement appropriate procedures to protect intellectual property rights.
The goal is to ensure that appropriate safeguards are in place and effective.
5.33 Protection of records - Records shall be protected from loss, destruction, falsification, unauthorized access, and unauthorized release.
The goal is to ensure that appropriate safeguards are in place and effective.
5.34 Privacy and Protection of PII - The organization shall identify and meet the requirements regarding preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
5.35 Independent review of information security - The organization's approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.
The goal is to ensure that appropriate safeguards are in place and effective.
5.36 Compliance with policies and standards for information security - Compliance with the organization's information security policy, topic-specific policies, rules, and standards shall be regularly reviewed.
The goal is to ensure that appropriate safeguards are in place and effective.
5.37 Documented Operating Procedures - Operating procedures for information processing facilities shall be documented and made available to personnel who need them.
The goal is to ensure that appropriate safeguards are in place and effective.
5.4 Management shall require all personnel to apply information security in accordance with the established information security policy, topic-specific policies, and procedures of the organization.
The goal is to ensure that appropriate safeguards are in place and effective.
5.5 The organization shall establish and maintain contact with relevant authorities.
The goal is to ensure that appropriate safeguards are in place and effective.
5.6 The organization shall establish and maintain contact with special interest groups or other specialist security forums and professional associations.
The goal is to ensure that appropriate safeguards are in place and effective.
5.7 Information relating to information security threats shall be collected and analyzed to produce threat intelligence.
The goal is to ensure that appropriate safeguards are in place and effective.
5.8 Information security shall be integrated into project management.
The goal is to ensure that appropriate safeguards are in place and effective.
5.9 An inventory of information and other associated assets, including owners, shall be developed, and maintained.
The goal is to ensure that appropriate safeguards are in place and effective.
6.1 Screening - Background verification checks on all candidates to become personnel shall be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations, and ethics, and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.
The goal is to ensure that appropriate safeguards are in place and effective.
6.2 Terms and conditions of employment - The employment contractual agreements shall state the personnel's and the organization's responsibilities for information security.
The goal is to ensure that appropriate safeguards are in place and effective.
6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.
The goal is to ensure that appropriate safeguards are in place and effective.
6.4 Disciplinary process - A disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.
The goal is to ensure that appropriate safeguards are in place and effective.
6.5 Responsibilities after termination or change of employment - Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, enforced, and communicated to relevant personnel and other interested parties.
The goal is to ensure that appropriate safeguards are in place and effective.
6.6 Confidentiality or non disclosure agreements - Confidentiality or non-disclosure agreements reflecting the organization's needs for the protection of information shall be identified, documented, regularly reviewed, and signed by personnel and other relevant interested parties.
The goal is to ensure that appropriate safeguards are in place and effective.
6.7 Remote Working - Security measures shall be implemented when personnel are working remotely to protect information accessed, processed, or stored outside the organization's premises.
The goal is to ensure that appropriate safeguards are in place and effective.
6.8 Information security event reporting - The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.
The goal is to ensure that appropriate safeguards are in place and effective.
7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
7.11 Supporting utilities - Information processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities.
The goal is to ensure that appropriate safeguards are in place and effective.
7.12 Cabling Security - Cables carrying power, data or supporting information services shall be protected from interception, interference, or damage.
The goal is to ensure that appropriate safeguards are in place and effective.
7.13 Equipment maintenance - Equipment shall be maintained correctly to ensure availability, integrity, and confidentiality of information.
The goal is to ensure that appropriate safeguards are in place and effective.
7.14 Secure disposal or re-use of equipment - Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
The goal is to ensure that appropriate safeguards are in place and effective.
7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.
The goal is to ensure that appropriate safeguards are in place and effective.
7.3 Securing offices, rooms, and facilities - Physical security for offices, rooms, and facilities shall be designed and implemented.
The goal is to ensure that appropriate safeguards are in place and effective.
7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.
The goal is to ensure that appropriate safeguards are in place and effective.
7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.
The goal is to ensure that appropriate safeguards are in place and effective.
7.6 Working in secure areas - Procedures for working in secure areas shall be designed and implemented.
The goal is to ensure that appropriate safeguards are in place and effective.
7.7 Clear desk and clear screen - Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.
The goal is to ensure that appropriate safeguards are in place and effective.
7.8 Equipment siting and protection - Equipment shall be sited securely and protected.
The goal is to ensure that appropriate safeguards are in place and effective.
7.9 Security of assets off premises - Off-site assets shall be protected.
The goal is to ensure that appropriate safeguards are in place and effective.
8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.
The goal is to ensure that appropriate safeguards are in place and effective.
8.11 Data Masking - Data masking shall be used in accordance with the organization's topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.
The goal is to ensure that appropriate safeguards are in place and effective.
8.12 Data leakage prevention - Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store, or transmit sensitive information.
The goal is to ensure that appropriate safeguards are in place and effective.
8.13 Information backup - Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.
The goal is to ensure that appropriate safeguards are in place and effective.
8.14 Redundancies of information processing facilities - Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.
The goal is to ensure that appropriate safeguards are in place and effective.
8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
8.17 Clock synchronization - The clocks of information processing systems used by the organization shall be synchronized to approved time sources.
The goal is to ensure that appropriate safeguards are in place and effective.
8.18 Use of privileged utility programs - The use of utility programs that can be capable of overriding system and application controls shall be restricted and tightly controlled.
The goal is to ensure that appropriate safeguards are in place and effective.
8.19 Installation of software on operational systems - Procedures and measures shall be implemented to securely manage software installation on operational systems.
The goal is to ensure that appropriate safeguards are in place and effective.
8.20 Network controls - Networks and network devices shall be secured, managed, and controlled to protect information in systems and applications.
The goal is to ensure that appropriate safeguards are in place and effective.
8.21 Security of network services - Security mechanisms, service levels, and service requirements of network services shall be identified, implemented, and monitored.
The goal is to ensure that appropriate safeguards are in place and effective.
8.22 Segregation of networks - Groups of information services, users, and information systems shall be segregated in the organization's networks.
The goal is to ensure that appropriate safeguards are in place and effective.
8.23 Web filtering - Access to external websites shall be managed to reduce exposure to malicious content.
The goal is to ensure that appropriate safeguards are in place and effective.
8.24 Use of cryptography - Rules for the effective use of cryptography, including cryptographic key management, shall be defined, and implemented.
The goal is to ensure that appropriate safeguards are in place and effective.
8.25 Secure development life cycle - Rules for the secure development of software and systems shall be established and applied.
The goal is to ensure that appropriate safeguards are in place and effective.
8.26 Application security requirements - Information security requirements shall be identified, specified, and approved when developing or acquiring applications.
The goal is to ensure that appropriate safeguards are in place and effective.
8.27 Secure system architecture - Principles for engineering secure systems shall be established, documented, maintained, and applied to any information system development activities.
The goal is to ensure that appropriate safeguards are in place and effective.
8.28 Secure Coding - Secure coding principles shall be applied to software development.
The goal is to ensure that appropriate safeguards are in place and effective.
8.29 Security testing in development and acceptance - Security testing processes shall be defined and implemented in the development life cycle.
The goal is to ensure that appropriate safeguards are in place and effective.
8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.
The goal is to ensure that appropriate safeguards are in place and effective.
8.31 Separation of development, test and production environments - Development, testing, and production environments shall be separated and secured.
The goal is to ensure that appropriate safeguards are in place and effective.
8.32 Change Management - Changes to information processing facilities and information systems shall be subject to change management procedures.
The goal is to ensure that appropriate safeguards are in place and effective.
8.33 Test information - Test information shall be appropriately selected, protected, and managed.
The goal is to ensure that appropriate safeguards are in place and effective.
8.34 Protection of information systems during audit testing. - Audit tests and other assurance activities involving assessment of operational systems shall be planned and agreed between the tester and appropriate management.
The goal is to ensure that appropriate safeguards are in place and effective.
8.4 Access to source code - Read and write access to source code, development tools and software libraries shall be appropriately managed.
The goal is to ensure that appropriate safeguards are in place and effective.
8.5 Secure authentication - Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.
The goal is to ensure that appropriate safeguards are in place and effective.
8.6 Capacity management - The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
8.7 Protection against malware - Protection against malware shall be implemented and supported by appropriate user awareness.
The goal is to ensure that appropriate safeguards are in place and effective.
8.8 Management of technical vulnerabilities - Information about technical vulnerabilities of information systems in use shall be obtained, the organization's exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.
The goal is to ensure that appropriate safeguards are in place and effective.
8.9 Configuration management = Configurations, including security configurations, of hardware, software, services, and networks shall be established, documented, implemented, monitored, and reviewed.
The goal is to ensure that appropriate safeguards are in place and effective.