Skip to main content

💼 ISO/IEC 27001:2013

  • ID: /frameworks/iso-iec-27001-2013

Description​

Empty...

Similar​

  • Internal
    • ID: dec-a-e2478d73

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 A.5 Information security policies1no data
　💼 A.5.1 Management direction for information security2no data
　　💼 A.5.1.1 Policies for information securityno data
　　💼 A.5.1.2 Review of the policies for information securityno data
💼 A.6 Organization of information security2no data
　💼 A.6.1 Internal organization5no data
　　💼 A.6.1.1 Information security roles and responsibilitiesno data
　　💼 A.6.1.2 Segregation of dutiesno data
　　💼 A.6.1.3 Contact with authoritiesno data
　　💼 A.6.1.4 Contact with special interest groupsno data
　　💼 A.6.1.5 Information security in project managementno data
　💼 A.6.2 Mobile devices and teleworking2no data
　　💼 A.6.2.1 Mobile device policyno data
　　💼 A.6.2.2 Teleworkingno data
💼 A.7 Human resource security3no data
　💼 A.7.1 Prior to employment2no data
　　💼 A.7.1.1 Screeningno data
　　💼 A.7.1.2 Terms and conditions of employmentno data
　💼 A.7.2 During employment3no data
　　💼 A.7.2.1 Management responsibilitiesno data
　　💼 A.7.2.2 Information security awareness, education and trainingno data
　　💼 A.7.2.3 Disciplinary processno data
　💼 A.7.3 Termination and change of employment1no data
　　💼 A.7.3.1 Termination or change of employment responsibilitiesno data
💼 A.8 Asset management35no data
　💼 A.8.1 Responsibility for assets4no data
　　💼 A.8.1.1 Inventory of assetsno data
　　💼 A.8.1.2 Ownership of assetsno data
　　💼 A.8.1.3 Acceptable use of assetsno data
　　💼 A.8.1.4 Return of assetsno data
　💼 A.8.2 Information classification35no data
　　💼 A.8.2.1 Classification of informationno data
　　💼 A.8.2.2 Labelling of informationno data
　　💼 A.8.2.3 Handling of assets5no data
　💼 A.8.3 Media handling3no data
　　💼 A.8.3.1 Management of removable mediano data
　　💼 A.8.3.2 Disposal of mediano data
　　💼 A.8.3.3 Physical media transferno data
💼 A.9 Access control44658no data
　💼 A.9.1 Business requirements of access control21718no data
　　💼 A.9.1.1 Access control policyno data
　　💼 A.9.1.2 Access to networks and network services1718no data
　💼 A.9.2 User access management61626no data
　　💼 A.9.2.1 User registration and de-registration11no data
　　💼 A.9.2.2 User access provisioning44no data
　　💼 A.9.2.3 Management of privileged access rights312no data
　　💼 A.9.2.4 Management of secret authentication information of users810no data
　　💼 A.9.2.5 Review of user access rights11no data
　　💼 A.9.2.6 Removal or adjustment of access rightsno data
　💼 A.9.3 User responsibilities133no data
　　💼 A.9.3.1 Use of secret authentication information33no data
　💼 A.9.4 System and application access control52022no data
　　💼 A.9.4.1 Information access restriction1920no data
　　💼 A.9.4.2 Secure log-on procedures1no data
　　💼 A.9.4.3 Password management system11no data
　　💼 A.9.4.4 Use of privileged utility programsno data
　　💼 A.9.4.5 Access control to program source codeno data
💼 A.10 Cryptography12731no data
　💼 A.10.1 Cryptographic controls22731no data
　　💼 A.10.1.1 Policy on the use of cryptographic controls1819no data
　　💼 A.10.1.2 Key management912no data
💼 A.11 Physical and environmental security2no data
　💼 A.11.1 Secure areas6no data
　　💼 A.11.1.1 Physical security perimeterno data
　　💼 A.11.1.2 Physical entry controlsno data
　　💼 A.11.1.3 Securing offices, rooms and facilitiesno data
　　💼 A.11.1.4 Protecting against external and environmental threatsno data
　　💼 A.11.1.5 Working in secure areasno data
　　💼 A.11.1.6 Delivery and loading areasno data
　💼 A.11.2 Equipment9no data
　　💼 A.11.2.1 Equipment siting and protectionno data
　　💼 A.11.2.2 Supporting utilitiesno data
　　💼 A.11.2.3 Cabling securityno data
　　💼 A.11.2.4 Equipment maintenanceno data
　　💼 A.11.2.5 Removal of assetsno data
　　💼 A.11.2.6 Security of equipment and assets off-premisesno data
　　💼 A.11.2.7 Secure disposal or reuse of equipmentno data
　　💼 A.11.2.8 Unattended user equipmentno data
　　💼 A.11.2.9 Clear desk and clear screen policyno data
💼 A.12 Operations security72834no data
　💼 A.12.1 Operational procedures and responsibilities4no data
　　💼 A.12.1.1 Documented operating proceduresno data
　　💼 A.12.1.2 Change managementno data
　　💼 A.12.1.3 Capacity managementno data
　　💼 A.12.1.4 Separation of development, testing and operational environmentsno data
　💼 A.12.2 Protection from malware177no data
　　💼 A.12.2.1 Controls against malware77no data
　💼 A.12.3 Backup11no data
　　💼 A.12.3.1 Information backup1no data
　💼 A.12.4 Logging and monitoring41621no data
　　💼 A.12.4.1 Event logging1518no data
　　💼 A.12.4.2 Protection of log information13no data
　　💼 A.12.4.3 Administrator and operator logs78no data
　　💼 A.12.4.4 Clock synchronisationno data
　💼 A.12.5 Control of operational software155no data
　　💼 A.12.5.1 Installation of software on operational systems55no data
　💼 A.12.6 Technical vulnerability management277no data
　　💼 A.12.6.1 Management of technical vulnerabilities77no data
　　💼 A.12.6.2 Restrictions on software installationno data
　💼 A.12.7 Information systems audit considerations1no data
　　💼 A.12.7.1 Information systems audit controlsno data
💼 A.13 Communications security223no data
　💼 A.13.1 Network security management322no data
　　💼 A.13.1.1 Network controls21no data
　　💼 A.13.1.2 Security of network servicesno data
　　💼 A.13.1.3 Segregation in networks1no data
　💼 A.13.2 Information transfer41no data
　　💼 A.13.2.1 Information transfer policies and procedures1no data
　　💼 A.13.2.2 Agreements on information transferno data
　　💼 A.13.2.3 Electronic messagingno data
　　💼 A.13.2.4 Confidentiality or nondisclosure agreementsno data
💼 A.14 System acquisition, development and maintenance31621no data
　💼 A.14.1 Security requirements of information systems31621no data
　　💼 A.14.1.1 Information security requirements analysis and specification66no data
　　💼 A.14.1.2 Securing application services on public networks55no data
　　💼 A.14.1.3 Protecting application services transactions1015no data
　💼 A.14.2 Security in development and support processes9no data
　　💼 A.14.2.1 Secure development policyno data
　　💼 A.14.2.2 System change control proceduresno data
　　💼 A.14.2.3 Technical review of applications after operating platform changesno data
　　💼 A.14.2.4 Restrictions on changes to software packagesno data
　　💼 A.14.2.5 Secure system engineering principlesno data
　　💼 A.14.2.6 Secure development environmentno data
　　💼 A.14.2.7 Outsourced developmentno data
　　💼 A.14.2.8 System security testingno data
　　💼 A.14.2.9 System acceptance testingno data
　💼 A.14.3 Test data1no data
　　💼 A.14.3.1 Protection of test datano data
💼 A.15 Supplier relationships2no data
　💼 A.15.1 Information security in supplier relationships3no data
　　💼 A.15.1.1 Information security policy for supplier relationshipsno data
　　💼 A.15.1.2 Addressing security within supplier agreementsno data
　　💼 A.15.1.3 Information and communication technology supply chainno data
　💼 A.15.2 Supplier service delivery management2no data
　　💼 A.15.2.1 Monitoring and review of supplier servicesno data
　　💼 A.15.2.2 Managing changes to supplier servicesno data
💼 A.16 Information security incident management1911no data
　💼 A.16.1 Management of information security incidents and improvements7911no data
　　💼 A.16.1.1 Responsibilities and proceduresno data
　　💼 A.16.1.2 Reporting information security events910no data
　　💼 A.16.1.3 Reporting information security weaknessesno data
　　💼 A.16.1.4 Assessment of and decision on information security eventsno data
　　💼 A.16.1.5 Response to information security incidentsno data
　　💼 A.16.1.6 Learning from information security incidentsno data
　　💼 A.16.1.7 Collection of evidence1no data
💼 A.17 Information security aspects of business continuity management233no data
　💼 A.17.1 Information security continuity333no data
　　💼 A.17.1.1 Planning information security continuityno data
　　💼 A.17.1.2 Implementing information security continuity33no data
　　💼 A.17.1.3 Verify, review and evaluate information security continuity11no data
　💼 A.17.2 Redundancies1no data
　　💼 A.17.2.1 Availability of information processing facilitiesno data
💼 A.18 Compliance214no data
　💼 A.18.1 Compliance with legal and contractual requirements514no data
　　💼 A.18.1.1 Identification of applicable legislation and contractual requirementsno data
　　💼 A.18.1.2 Intellectual property rightsno data
　　💼 A.18.1.3 Protection of records14no data
　　💼 A.18.1.4 Privacy and protection of personally identifiable informationno data
　　💼 A.18.1.5 Regulation of cryptographic controlsno data
　💼 A.18.2 Information security reviews3no data
　　💼 A.18.2.1 Independent review of information securityno data
　　💼 A.18.2.2 Compliance with security policies and standardsno data
　　💼 A.18.2.3 Technical compliance reviewno data