{"id":8999,"date":"2022-09-27T22:28:00","date_gmt":"2022-09-27T20:28:00","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8999"},"modified":"2022-09-27T22:34:19","modified_gmt":"2022-09-27T20:34:19","slug":"iso-27001-controls-ultimate-guide-updated-for-2022","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/governance-risk-and-compliance\/iso-27001-controls-ultimate-guide-updated-for-2022\/","title":{"rendered":"ISO 27001 Controls Ultimate Guide \u2013 Updated for 2022"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this ultimate guide to the ISO 27001 controls we are going to explore the security control requirements. We will go through the ISO 27001 controls, the old version of the ISO 27002: 2013 controls and the new and updated ISO 27002: 2022 control list. What controls do you need to implement? Let\u2019s take a deep dive.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"the-complete-guide-to-iso-27001-controls\"><strong>ISO 27001 Control<\/strong>s Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27001 is the international standard for information security. It has has a check list of ISO 27001 controls. These controls are set out in the ISO 27001 Annex A. Often referred to as ISO 27002.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The list of controls changed in 2022 and is now referenced as ISO 27002: 2022.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I like the controls because they are standard controls that are easy to implement. I have summarized them in the table of contents for ease of navigation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-iso-27001-isms-controls\">ISO 27001 ISMS Controls<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27001 is the standard that you certify against. It is a management framework. Let\u2019s start with a look at the ISO 27001 information security management system controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27001 is divided into clauses which act as domains or groups of related controls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"4-context-of-organisation\">ISO 27001 Clause 4 Context of Organization<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The context of organization controls look at being able to show that you understand the organization and its context. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"5-leadership\">ISO 27001 Clause 5 Leadership<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27001 wants top down leadership and to be able to evidence leadership commitment. We require Information Security Policies that say what we do. We document the organizational roles and responsibilities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"6-planning\">ISO 27001 Clause 6 Planning<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Planning addresses actions to address risks and opportunities. ISO 27001 is a risk based system so risk management is a key part, with risk registers and risk processes in place. We ensure that we have objectives and measure in place for the information security management system.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"7-support\">ISO 27001 Clause 7 Support<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Education and awareness is put in place and a culture of security is implemented. A communication plan is created and followed. Resources are allocated and competency of resources is managed and understood. If it isn\u2019t written down it does not exist so standard operating procedures are documented and documents are controlled.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"8-operation\">ISO 27001 Clause 8 Operation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Operations are managed and controlled and risk assessments undertaken.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"9-performance-evaluation\">ISO 27001 Clause 9 Performance Evaluation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Monitors and measures as well as the processes of analysis and evaluation are implemented. As part of continual improvement audits are planned and executed, management reviews are undertaken following structured agendas.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"10-improvement\">ISO 27001 Clause 10 Improvement<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Improvement is a foundation of The ISO 27001 standard. The ability to adapt and continually improve. We are going to look at how we manage non conformity and corrective actions and our processes for managing continual improvement.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-iso-27002-2022-controls-checklist\">ISO 27002: 2022 Controls Checklist<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"iso-27002-5-organizational-controls\">ISO 27002 5 Organizational controls<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.1&nbsp;<\/em><strong>Policies for information security<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.2&nbsp;<\/em><strong>Information security roles and responsibilities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.3 <\/em><strong>Segregation of duties<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.4<\/em>&nbsp;<strong>Management responsibilities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.5&nbsp;<\/em><strong>Contact with authorities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.6<\/em>&nbsp;<strong>Contact with special interest groups<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.7<\/em>&nbsp;<strong>Threat intelligence <\/strong>\u2013&nbsp;<em><strong>new<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.8<\/em>&nbsp;<strong>Information security in project management<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-purple-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.9<\/em>&nbsp;<strong>Inventory of information and other associated assets<\/strong> \u2013&nbsp;<em><strong>change<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-purple-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.10<\/em>&nbsp;<strong>Acceptable use of information and other associated assets<\/strong> \u2013&nbsp;<em><strong>change<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.11<\/em>&nbsp;<strong>Return of assets<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.12<\/em><strong>&nbsp;Classification of information<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.13<\/em>&nbsp;<strong>Labeling of information<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.14<\/em>&nbsp;<strong>Information transfer<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.15&nbsp;<\/em><strong>Access control<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.16&nbsp;<\/em><strong>Identity management<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\">&nbsp;<em>ISO 27002<\/em>&nbsp;5.17 <strong>Authentication information \u2013<\/strong>&nbsp;<em><strong>new<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-purple-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.18&nbsp;<\/em><strong>Access rights \u2013&nbsp;<em>c<\/em><\/strong><em><strong>hange<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.19&nbsp;<\/em><strong>Information security in supplier relationships<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.20<\/em>&nbsp;<strong>Addressing information security within supplier agreements<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002<\/em>&nbsp;<em>5.21<\/em>&nbsp;<strong>Managing information security in the ICT supply chain&nbsp;<em>\u2013&nbsp;n<\/em><\/strong><em><strong>ew<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-purple-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.22&nbsp;<\/em><strong>Monitoring, review and change management of supplier services \u2013&nbsp;<em>change<\/em><\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.23&nbsp;<\/em><strong>Information security for use of cloud services&nbsp;<em>\u2013<\/em><\/strong><em>&nbsp;<strong>new<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-purple-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.24<\/em>&nbsp;<strong>Information security incident management planning and preparation<\/strong> \u2013&nbsp;<em><strong>change<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.25&nbsp;<\/em><strong>Assessment and decision on information security events&nbsp;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.26&nbsp;<\/em><strong>Response to information security incidents<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.27<\/em><strong>Learning from information security incidents<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.28&nbsp;<\/em><strong>Collection of evidence<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-purple-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.29<\/em><strong>&nbsp;Information security during disruption \u2013&nbsp;<\/strong><em><strong>change<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 5.30&nbsp;<\/em><strong>ICT readiness for business continuity&nbsp;<em>\u2013&nbsp;n<\/em><\/strong><em><strong>ew<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.31&nbsp;<\/em><strong>Identification of legal, statutory, regulatory and contractual requirements<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.32&nbsp;<\/em><strong>Intellectual property rights<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.33<\/em>&nbsp;<strong>Protection of records<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.34&nbsp;<\/em><strong>Privacy and protection of PII<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.35&nbsp;<\/em><strong>Independent review of information security<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.36<\/em>&nbsp;<strong>Compliance with policies and standards for information security<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 5.37&nbsp;<\/em><strong>Documented operating procedures<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"iso-27002-6-people-controls\">ISO 27002 6 People controls<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.1&nbsp;<\/em><strong>Screening<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.2<\/em>&nbsp;<strong>Terms and conditions of employment<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.3&nbsp;<\/em><strong>Information security awareness, education and training<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.4<\/em>&nbsp;<strong>Disciplinary process<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.5<\/em><strong>&nbsp;Responsibilities after termination or change of employment<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.6<\/em><strong>Confidentiality or non-disclosure agreements<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 6.7<\/em><strong> <\/strong><strong>Remote working&nbsp;<em>\u2013&nbsp;new<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 6.8&nbsp;<\/em><strong>Information security event reporting&nbsp;<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"iso-27002-7-physical-controls\">ISO 27002 7 Physical controls<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.1<\/em>&nbsp;<strong>Physical security perimeter<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.2&nbsp;<\/em><strong>Physical entry controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.3<\/em><strong>Securing offices, rooms and facilities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.4&nbsp;<\/em><strong>Physical security monitoring<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.5<\/em>&nbsp;<strong>Protecting against physical and environmental threats<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.6&nbsp;<\/em><strong>Working in secure areas<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.7&nbsp;<\/em><strong>Clear desk and clear screen<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.8<\/em>&nbsp;<strong>Equipment siting and protection<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.9<\/em>&nbsp;<strong>Security of assets off-premises<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 7.10&nbsp;<\/em><strong>Storage media&nbsp;<\/strong><em>\u2013&nbsp;<strong>new<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.11<\/em>&nbsp;<strong>Supporting utilities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.12&nbsp;<\/em><strong>Cabling security<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.13<\/em><strong>Equipment maintenance<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 7.14&nbsp;<\/em><strong>Secure disposal or re-use of equipment<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"iso-27002-8-technological-controls\"><em>ISO 27002 8&nbsp;<\/em>Technological controls<\/h3>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.1<\/em>&nbsp;<strong>User endpoint devices&nbsp;&nbsp;<em>\u2013&nbsp;<\/em><\/strong><em><strong>new<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.2<\/em><strong>&nbsp;Privileged access rights<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.3<\/em><strong>Information access restriction<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.4&nbsp;<\/em><strong>Access to source code<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.5&nbsp;<\/em><strong>Secure authentication<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.6<\/em><strong>&nbsp;Capacity management<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.7<\/em> <strong>Protection against malware<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.8<\/em>&nbsp;<strong>Management of technical vulnerabilities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.9<\/em>&nbsp;<strong>Configuration management<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.10<\/em>&nbsp;<strong>Information deletion&nbsp;<em>\u2013&nbsp;n<\/em><\/strong><em><strong>ew<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.11<\/em><strong>&nbsp;Data masking&nbsp;&nbsp;<em>\u2013&nbsp;ne<\/em><\/strong><em><strong>w<\/strong><\/em><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.12<\/em>&nbsp;<strong>Data leakage prevention&nbsp;&nbsp;<em>\u2013&nbsp;n<\/em><\/strong><em><strong>ew<\/strong><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.13<\/em>&nbsp;<strong>Information backup<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.14<\/em>&nbsp;<strong>Redundancy of information processing facilities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.15<\/em><strong>&nbsp;Logging<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.16<\/em><strong>&nbsp;Monitoring activities<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.17<\/em><strong>&nbsp;Clock synchronization<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.18&nbsp;<\/em><strong>Use of privileged utility programs<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.19<\/em><strong>&nbsp;Installation of software on operational systems<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.20<\/em>&nbsp;<strong>Network controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.21<\/em>&nbsp;<strong>Security of network services<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.22<\/em><strong> <\/strong><strong>Web filtering&nbsp;<em>\u2013&nbsp;new<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.23<\/em>&nbsp;<strong>Segregation in networks<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.24&nbsp;<\/em><strong>Use of cryptography<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.25<\/em> <strong>Secure development lifecycle<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.26&nbsp;<\/em><strong>Application security requirements&nbsp;<em>\u2013&nbsp;new<\/em><\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.27<\/em>&nbsp;<strong>Secure system architecture and engineering principles&nbsp;<em>\u2013&nbsp;new<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.29&nbsp;<\/em><strong>Security testing in development and acceptance<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.30<\/em>&nbsp;<strong>Outsourced development<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.31&nbsp;<\/em><strong>Separation of development, test and production environments<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.32&nbsp;<\/em><strong>Change management<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>ISO 27002 8.33&nbsp;<\/em><strong>Test information<\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color wp-block-paragraph\"><em>ISO 27002 8.34<\/em>&nbsp;<strong>Protection of information systems during audit and testing&nbsp;<em>\u2013&nbsp;n<\/em><\/strong><em><strong>ew<\/strong><\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-iso-27002-2013-controls-checklist\">ISO 27002: 2013 Controls Checklist<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27002: 2013 is the old version of the Annex A controls and was replaced and updated in 2022. As business is still being assessed and certified against ISO 27002: 2013 we will do a deep dive into those controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are 114 controls in the 2013 version of the control list. Lets break them down. Helpfully the controls start at number 5.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-5-information-security-policies\"><em><strong>ISO 27002 2013 \u2013 <\/strong><\/em><strong>5 Information Security Policies<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>| 2 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27001 Policies are your foundation. They say what you do. Not necessarily how you do it. There are 2 controls in Annex A.5 being The Management Setting the direction of Information Security in the organization through having policies for information security and those policies being reviewed. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-6-organisation-of-information-security\">ISO 27002 2013 \u2013 6 Organization of Information Security<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-7-controls\"><strong>| 7 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A management frame work for the implementation and operation of information security makes sense. We work out who is doing what and allocate roles. We seek to remove those conflicts of interest and segregate out those duties. Contact with authorities, that usually means local regulators and law enforcement is established as is contact with special interest groups. Special interest groups could be forums, trade or regulatory associations. As we likely have project management we ensure that information security is included in the lifecycle. Weirdly this annex shoe horns in both remote working and mobile devices for which it expects policies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-7-human-resource-security\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 7 Human resource security<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-6-controls\"><strong>| 6 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ah, where would we be without HR? Here we have 6 controls relating to Human Resources. Taking care of per-employment, screening and background checking, terms and conditions of employment, what happens during employment and information security training. Management responsibilities are included as are the disciplinary process to tie it to security breaches, termination of employment and of responsibilities. The last one we summarize as the starter, leaver, mover process.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-8-asset-management\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 8 Asset management&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-10-controls\"><strong>| 10 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You cannot protect what you do not know so a whopping 10 controls that cover asset management. Nothing earth shattering of new here. We are in the territory of physical asset registers and data asset registers.The asset management policy looks at ownership of assets, acceptable use, return of assets. There are controls on information classification and labeling of information but nothing strenuous. Handling assets and media is covered, the likes of removable media, getting rid or disposing of it properly and physical media transfer it that is still something you do.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-9-access-control\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 9 Access control<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-14-controls\"><strong>| 14 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Still with me? Good good. Access control as you would expect is included. Another large control section but not to be intimated. There are no surprises here. User management with registering and de registering users, provisioning accounts, managing those privilege and admin accounts, password management and of course reviewing the user access rights. Having a secure logon, which is pretty basic, and if applicable restricting those utility programs and applications and proper access to source code.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-10-cryptography\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 10 Cryptography<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-2-controls\">| <strong>2 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2 controls, so how hard can this be. A policy on cryptographic controls and a key management process.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-11-physical-and-environmental-security\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 11 Physical and environmental security<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-15-controls\"><strong>|15 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You are going to manage this mainly by having the right scope and probably out sourcing what is in scope to someone that has ISO 27001 certification and covers this for you. Still, lets take a look at the physical controls. For this you are in to secure perimeters, physical entry controls to secure those offices and server rooms. Protecting against environmental threats like floods and earthquakes, working in areas that need to be more secure, considering loading bays if you have them, making sure equipment is installed properly, looking at your power supplies and utilities. We have more policy on clear desk and clear screen, unattended user equipment and what needs to happen for equipment of site.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-12-operations-security\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 12 Operations security<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-14-controls\"><strong>| 14 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If it isn\u2019t written down it doesn\u2019t exist is a good rule to live life by when it comes to ISO 27001. All that good stuff you no doubt do, needs writing down. Change management, capacity management, anti virus, back ups. All this stuff you do, that you just do, well it needs documenting. Logging and monitoring, clock synchronization, installs of software, managing vulnerabilities and patching. Who can install what. All to write down and document.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-13-communications-security\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 13 Communications security&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-7-controls\"><strong>| 7 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Network security time. There is nothing more that network people like doing than documenting stuff. Wait till you ask them and see how pleased they are. Network diagrams, segregation in networks, information transfer, polices, procedures, documentation. Confidentiality agreements, managing those network suppliers. You have this covered.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-14-system-acquisition-development-and-maintenance\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 14 System acquisition, development and maintenance<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-13-controls\"><strong>| 13 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You do software development as a company. I feel for you. 13 controls for your delight. From documenting requirements in the specifications, securing over networks, protecting service transactions, having and software development lifecycle written down that includes information security requirements. A policy, a system change control, technical reviews, secure engineering principles. Dev, test, live. Testing. Test data. Outsourced development. All to document.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-15-supplier-relationships\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 15 Supplier relationships&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-5-controls\"><strong>| 5 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I am a big fan of this section. Outsource what you can, where you can and make it someone else\u2019s problem. When you do you need controls around supplier registers, selecting suppliers, vetting them, monitoring, measuring them and the associated legal documentation. Have a third party supplier policy and a third party supplier register.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-16-information-security-incident-management\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 16 Information security incident management<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-7-controls\"><strong>| 7 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What happens and what do you do when things go wrong. Controls here on roles and responsibilities, reporting, assessing, responding, and learning from incidents. An incident and corrective action log is a must.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-17-information-security-aspects-of-business-continuity-management\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 17 Information security aspects of business continuity management&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-4-controls\"><strong>| 4 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Having a plan, testing it, proving you tested it and having it all written down is the order of the day here. Business Continuity will keep you going when things go wrong.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iso-27002-2013-18-compliance\"><em><strong>ISO 27002 2013<\/strong><\/em> \u2013 18 Compliance&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"h-8-controls\"><strong>| 8 controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You made it to the last of the ISO 27001 Annex A controls. Compliance is compliance. What legal and regulatory compliance applies? If you document it make sure you can show you meet it. Intellectual property, protecting records, data protection ( GDPR ), regulations on encryption, compliance with all these controls and the standard and then independent reviews by someone who should know what they are doing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-iso-27001-controls-faq\">ISO 27001 Controls FAQ<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Do I need all 114 controls in Annex A?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Or a good reason why you don\u2019t. In reality they are not mandatory so don\u2019t have them for the sake of it. If you don\u2019t have them or need them just document why. Remember this is an international standard based on best practice and years of refinement. We find software development is usually the one that gets left out, for those that don\u2019t do software development of course.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Are the ISO 27001 controls documentation heavy?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. If it is not written down it does not exist. Even though you are doing great things you will have to document what you do and be able to provide evidence that you do it. Sorry.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How do I document the ISO 27001 controls?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using a word processor and a spreadsheet. You can consider a portal or web based application but the cheapest, simplest, fastest and most flexible approach for an SME business is basic office applications. You already know how to use them and you already own them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Are there ISO 27001 controls for cloud?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, the ISO 27001 controls apply to cloud as well as on premise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Are the ISO 27001 controls referred to as Annex A?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. They are an Annex to the ISO 27001 standard. On their own they are referred to as ISO 27002.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What is ISO 27002?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27002 is another name for the list of the 114 ISO 27001 controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How many controls ISO 27001 controls are there?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are 114 controls in ISO 27001.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How many controls are there in ISO 27002?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are 114 controls in ISO 27002.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this ultimate guide to the ISO 27001 controls we are going to explore the security control requirements. We will go through the ISO 27001 controls, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":9000,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[225],"tags":[250,252,253],"class_list":["post-8999","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-governance-risk-and-compliance","tag-grc","tag-isms","tag-iso-27001"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8999","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8999"}],"version-history":[{"count":3,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8999\/revisions"}],"predecessor-version":[{"id":9004,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8999\/revisions\/9004"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/9000"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}