ISO
27001 is the international standard that describes best practice for an ISMS
(information security management system).
The
Standard takes a risk-based approach to information security, requiring
organisations to identify threats to their organisation and select appropriate
controls to tackle them.
Those
controls are outlined in Annex A of the Standard. There are 114 in total, split
into 14 sections (or ‘control sets’). Each section focuses on a specific aspect
of information security.
There are 114
controls listed in ISO 27001 – it would be a violation of intellectual property
rights if I listed all the controls here, but let me just explain how the
controls are structured, and the purpose of each of the 14 sections from Annex
A:
·
A.5
Information security policies – controls on how the policies are written
and reviewed
·
A.6
Organization of information security – controls on how the
responsibilities are assigned; also includes the controls for mobile devices
and teleworking
·
A.7
Human resources security – controls prior to employment, during, and after
the employment
·
A.8
Asset management – controls related to inventory of assets and acceptable
use, also for information classification and media handling
·
A.9
Access control – controls for Access control policy, user access
management, system and application access control, and user responsibilities
·
A.10
Cryptography – controls related to encryption and key management
·
A.11
Physical and environmental security – controls defining secure areas,
entry controls, protection against threats, equipment security, secure
disposal, clear desk and clear screen policy, etc.
·
A.12
Operational security – lots of controls related to management of IT
production: change management, capacity management, malware, backup, logging,
monitoring, installation, vulnerabilities, etc.
·
A.13
Communications security – controls related to network security,
segregation, network services, transfer of information, messaging, etc.
·
A.14
System acquisition, development and maintenance – controls defining
security requirements and security in development and support processes
·
A.15
Supplier relationships – controls on what to include in agreements, and
how to monitor the suppliers
·
A.16
Information security incident management – controls for reporting events
and weaknesses, defining responsibilities, response procedures, and collection
of evidence
·
A.17
Information security aspects of business continuity management – controls
requiring the planning of business continuity, procedures, verification and
reviewing, and IT redundancy
·
A.18
Compliance – controls requiring the identification of applicable laws and
regulations, intellectual property protection, personal data protection, and
reviews of information security
User questions & answers