The controls in
ISO 27001:2013 are:-
Information
security policies- To provide management direction and support for information
security in accordance with business requirements and relevant laws and
regulations.
Organization
of information security-To establish a management framework to initiate and
control the implementation and operation of information security within the
organization and To ensure the security of teleworking and use of mobile
devices.
Human
resources security- Prior to Employment- To ensure that employees and
contractors understand their responsibilities and are suit- able for the roles
for which they are considered.
During
employment- To ensure that employees and contractors are aware of and fulfill
their information security responsibilities.
Termination and change of employment-To
protect the organization’s interests as part of the process of changing or
terminating employment.
Asset
management - To limit access to information and information processing
facilities and to ensure authorized user access and to prevent unauthorized
access to systems and services.
Cryptography
-To ensure proper and effective use of cryptography to protect the confidentiality,
authenticity and/or integrity of information.
Physical And Environmental Security- To
prevent unauthorized physical access, damage and interference to the
organization’s information and information processing facilities.
Operational
security- To ensure correct and secure operations of information processing
facilities are protected against malware.
Backup-To protects against loss of data,
Logging and monitoring- To record events and generate evidence.
Control of operational software- To
ensure the integrity of operational systems.
Communications
security- To ensure the protection of information in networks and its
supporting information processing facilities. Information Transfer and To
maintain the security of information transferred within an organization and
with any external entity.
System
acquisition, development and maintenance- To ensure that information security
is an integral part of information systems across the entire lifecycle. This also includes the
requirements for information systems which provide services over public
networks.
Supplier
relationships –To ensure protection of the organization’s assets that is
accessible by suppliers and to supply delivery management to maintain an agreed
level of information security and service delivery in line with supplier
agreements
Information
security incident management - To ensure a consistent and effective approach to
the management of information security incidents, including communication on
security events and weaknesses.
Information
security aspects of business continuity management –It shall be embedded in the
organization’s business continuity management systems.
User questions & answers