Scribd Logo
Upload

Welcome to Scribd!

  • 4K views

    ISO 27001 Control Clauses List

    Uploaded by

    rohitas83

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    ISO 27001 Control Clauses List

    Uploaded by

    rohitas83
    4K views7 pages

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    4K views7 pages

    ISO 27001 Control Clauses List

    Uploaded by

    rohitas83

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 7
    At a glance
    Powered by AI
    The document outlines the 133 controls across 11 security domains and 39 control objectives as per Annexure A of ISO/IEC 27001:2005, which is an international standard for information security.

    The eleven security domains covered are: 1) Security Policy, 2) Organization of Information Security, 3) Asset Management, 4) Human Resources Security, 5) Physical and Environmental Security, 6) Communications and Operations Management, 7) Access Control, 8) Information Systems Acquisition, Development and Maintenance, 9) Information Security Incident Management, 10) Business Continuity Management, and 11) Compliance.

    Some of the controls listed under the 'Human Resources Security' domain include screening employees prior to employment, providing security awareness training to employees, and establishing disciplinary processes.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    Delegates Manual Controls List Page 1 of 7

    V.1.1

    Copyright 7 S Consulting International, 2006.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    LIST OF ELEVEN SECUIRTY DOMAINS, 39 CONTROL OBJECTIVES AND 133 CONTROLS AS PER ANNEXURE A OF ISO/IEC 27001:2005 1.A.5 SECURITY POLICY
    1.A.5.1 INFORMATION SECURITY POLICY
    A. 5.1.1 Information security policy document A.5.1.2 Review of the information security policy

    2.A. 6 ORGANIZATION OF INFORMATION SECURITY


    2.A. 6.1 INTERNAL ORGANIZATION
    A. 6.1.1 Management commitment to information security A. 6.1.2 Information security co-ordination A. 6.1.3 Allocation of information security responsibilities A. 6.1.4 Authorization process for information processing facilities A. 6.1.5 Confidentiality agreements A. 6.1.6 Contact with authorities A. 6.1.7 Contact with special interest groups A. 6.1.8 Independent review of information security

    3.A. 6.2 EXTERNAL PARTIES


    A. 6.2.1 Identification of risks related to external parties A. 6.2.2 Addressing security when dealing with customers A. 6.2.3 Addressing security in third party agreements

    3.A. 7 ASSET MANAGEMENT


    4.A. 7.1 RESPONSIBILITY FOR ASSETS
    A. 7.1.1 Inventory of assets A. 7.1.2 Ownership of assets A. 7.1.3 Acceptable use of assets

    5.A. 7.2 INFORMATION CLASSIFICATION


    A. 7.2.1 Classification guidelines A. 7.2.2 Information labeling and handling

    Delegates Manual Controls List Page 2 of 7

    V.1.1

    Copyright 7 S Consulting International, 2006.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    4.A. 8 HUMAN RESOURCES SECURITY


    6.A. 8.1 PRIOR TO EMPLOYMENT
    A. 8.1.1 Roles and responsibilities A. 8.1.2 Screening A. 8.1.3 Terms and conditions of employment

    7.A. 8.2 DURING EMPLOYMENT


    A. 8.2.1 Management responsibilities A. 8.2.2 Information security awareness, education, and training A. 8.2.3 Disciplinary process

    8.A. 8.3 TERMINATION OR CHANGE OF EMPLOYMENT


    A. 8.3.1 Termination responsibilities A. 8.3.2 Return of assets A. 8.3.3 Removal of access rights

    5.A. 9 PHYSICAL AND ENVIRONMENTAL SECURITY


    9.A. 9.1 SECURE AREAS
    A. 9.1.1 Physical security perimeter A. 9.1.2 Physical entry controls A. 9.1.3 Securing offices, rooms, and facilities A. 9.1.4 Protecting against external and environmental threats A. 9.1.5 Working in secure areas A. 9.1.6 Public access, delivery, and loading areas

    10.A. 9.2 EQUIPMENT SECURITY


    A. 9.2.1 Equipment siting and protection A. 9.2.2 Supporting utilities A. 9.2.3 Cabling security A. 9.2.4 Equipment maintenance A. 9.2.5 Security of equipment off-premises A. 9.2.6 Secure disposal or re-use of equipment A. 9.2.7 Removal of property

    6.A. 10 COMMUNICATIONS AND OPERATIONS MANAGEMENT


    11.A. 10.1 OPERATIONAL PROCEDURES AND RESPONSIBILITIES
    A. 10.1.1 Documented operating procedures A. 10.1.2 Change management A. 10.1.3 Segregation of duties A. 10.1.4 Separation of development, test, and operational facilities

    Delegates Manual Controls List Page 3 of 7

    V.1.1

    Copyright 7 S Consulting International, 2006.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    12.A. 10.2 THIRD PARTY SERVICE DELIVERY MANAGEMENT


    A. 10.2.1 Service delivery A. 10.2.2 Monitoring and review of third party services A. 10.2.3 Managing changes to third party services

    13.A. 10.3 SYSTEM PLANNING AND ACCEPTANCE


    A. 10.3.1 Capacity management A. 10.3.2 System acceptance

    14.A. 10.4 PROTECTION AGAINST MALICIOUS AND MOBILE CODE


    A. 10.4.1 Controls against malicious code A. 10.4.2 Controls against mobile code

    15A. 10.5 BACK-UP


    A. 10.5.1 Information back-up

    16.A. 10.6 NETWORK SECURITY MANAGEMENT


    A. 10.6.1 Network controls A. 10.6.2 Security of network services

    17.A. 10.7 MEDIA HANDLING


    A. 10.7.1 Management of removable media A. 10.7.2 Disposal of media A. 10.7.3 Information handling procedures A. 10.7.4 Security of system documentation

    18.A. 10.8 EXCHANGE OF INFORMATION


    A. 10.8.1 Information exchange policies and procedures A. 10.8.2 Exchange agreements A. 10.8.3 Physical media in transit A. 10.8.4 Electronic messaging A. 10.8.5 Business information systems

    19.A. 10.9 ELECTRONIC COMMERCE SERVICES


    A. 10.9.1 Electronic commerce A. 10.9.2 On-Line Transactions A. A. 10.9.3 Publicly available information

    20.A. 10.10 MONITORING


    A. 10.10.1 Audit logging A. 10.10.2 Monitoring system use A. 10.10.3 Protection of log information A. 10.10.4 Administrator and operator logs A. 10.10.5 Fault logging A. 10.10.6 Clock synchronization
    Delegates Manual Controls List Page 4 of 7 V.1.1 Copyright 7 S Consulting International, 2006.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    7.A. 11 ACCESS CONTROL


    21.A. 11.1 BUSINESS REQUIREMENT FOR ACCESS CONTROL
    A. 11.1.1 Access control policy

    22.A. 11.2 USER ACCESS MANAGEMENT


    A. 11.2.1 User registration A. 11.2.2 Privilege management A. 11.2.3 User password management A. 11.2.4 Review of user access rights

    23.A. 11.3 USER RESPONSIBILITIES


    A. 11.3.1 Password use A. 11.3.2 Unattended user equipment . A. 11.3.3 Clear desk and clear screen policy

    24.A. 11.4 NETWORK ACCESS CONTROL


    A. 11.4.1 Policy on use of network services A. 11.4.2 User authentication for external connections A. 11.4.3 Equipment identification in networks A. 11.4.4 Remote diagnostic and configuration port protection A. 11.4.5 Segregation in networks A. 11.4.6 Network connection control A. 11.4.7 Network routing control

    25..A. 11.5 OPERATING SYSTEM ACCESS CONTROL


    A. 11.5.1 Secure log-on procedures A. 11.5.2 User identification and authentication . A. 11.5.3 Password management system A. 11.5.4 Use of system utilities A. 11.5.5 Session time-out A. 11.5.6 Limitation of connection time

    26.A. 11.6 APPLICATION AND INFORMATION ACCESS CONTROL


    A. 11.6.1 Information access restriction A. 11.6.2 Sensitive system isolation

    27A. 11.7 MOBILE COMPUTING AND TELEWORKING


    A. 11.7.1 Mobile computing and communications A. 11.7.2 Teleworking

    Delegates Manual Controls List Page 5 of 7

    V.1.1

    Copyright 7 S Consulting International, 2006.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    8.A. 12 INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE


    28.A. 12.1 SECURITY REQUIREMENTS OF INFORMATION SYSTEMS
    A. 12.1.1 Security requirements analysis and specification

    29.A. 12.2 CORRECT PROCESSING IN APPLICATIONS


    A. 12.2.1 Input data validation A. 12.2.2 Control of internal processing A. 12.2.3 Message integrity A. 12.2.4 Output data validation

    30.A. 12.3 CRYPTOGRAPHIC CONTROLS


    A. 12.3.1 Policy on the use of cryptographic controls A. 12.3.2 Key management

    31.A. 12.4 SECURITY OF SYSTEM FILES


    A. 12.4.1 Control of operational software A. 12.4.2 Protection of system test data A. 12.4.3 Access control to program source code

    32.A. 12.5 SECURITY IN DEVELOPMENT AND SUPPORT PROCESSES


    A. 12.5.1 Change control procedures A. 12.5.2 Technical review of applications after operating system changes A. 12.5.3 Restrictions on changes to software packages A. 12.5.4 Information leakage A. 12.5.5 Outsourced software development

    33.A. 12.6 TECHNICAL VULNERABILITY MANAGEMENT


    A. 12.6.1 Control of technical vulnerabilities

    Delegates Manual Controls List Page 6 of 7

    V.1.1

    Copyright 7 S Consulting International, 2006.

    THE ROADMAP TO INFORMATION SECURITY WITH ISO 17799:2005 and ISO 27001:2005

    9.A. 13 INFORMATION SECURITY INCIDENT MANAGEMENT


    34A. 13.1 REPORTING INFORMATION SECURITY EVENTS AND WEAKNESSES
    A. 13.1.1 Reporting information security events A. 13.1.2 Reporting security weaknesses

    35.A. 13.2 MANAGEMENT OF INFORMATION SECURITY INCIDENTS AND IMPROVEMENTS


    A. 13.2.1 Responsibilities and procedures A. 13.2.2 Learning from information security incidents A. 13.2.3 Collection of evidence

    10.A. 14 BUSINESS CONTINUITY MANAGEMENT


    36A. 14.1 INFORMATION SECURITY ASPECTS OF BUSINESS CONTINUITY MANAGEMENT
    A. 14.1.1 Including information security in the business continuity management process A. 14.1.2 Business continuity and risk assessment A. 14.1.3 Developing and implementing continuity plans including information security A. 14.1.4 Business continuity planning framework A. 14.1.5 Testing, maintaining and re-assessing business continuity plans

    11.A. 15 COMPLIANCE
    37.A. 15.1 COMPLIANCE WITH LEGAL REQUIREMENTS
    A. 15.1.1 Identification of applicable legislation A. 15.1.2 Intellectual property rights (IPR) A. 15.1.3 Protection of organizational records A. 15.1.4 Data protection and privacy of personal information A. 15.1.5 Prevention of misuse of information processing facilities A. 15.1.6 Regulation of cryptographic controls

    38.A. 15.2 COMPLIANCE WITH SECURITY POLICIES AND STANDARDS, AND TECHNICAL COMPLIANCE
    A. 15.2.1 Compliance with security policies and standards A. 15.2.2 Technical compliance checking

    39A. 15.3 INFORMATION SYSTEMS AUDIT CONSIDERATIONS


    A. 15.3.1 Information systems audit controls A. 15.3.2 Protection of information systems audit tools

    Delegates Manual Controls List Page 7 of 7

    V.1.1

    Copyright 7 S Consulting International, 2006.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy