ISO/IEC 27001 Guidance Catalog

This page renders a Gemara GuidanceCatalog that re-expresses the structure of ISO/IEC 27001:2022 — its management-system clauses and Annex A controls — as guidelines with stable identifiers such as iso27001-6.1.2 and iso27001-A.8.25. Controls, policies and evaluations elsewhere in this site can cite those identifiers instead of restating requirements.

Paraphrase, not normative text

Statement text is a non-authoritative paraphrase written for interoperability. It does not reproduce ISO normative wording and is not a substitute for a licensed copy of ISO/IEC 27001:2022. For the requirement-by-requirement comparison against Ten Factor Governance, see the ISO/IEC 27001 Analysis.

GuidanceCatalogStandardv0.1.0draft

This catalog re-expresses the structure of ISO/IEC 27001:2022 as Gemara guidelines so that Governance Twins, controls, policies and evaluations can cite stable identifiers (for example iso27001-6.1.2 or iso27001-A.8.25). COPYRIGHT NOTICE: ISO/IEC 27001 is a copyrighted ISO/IEC publication. This file intentionally uses paraphrased objectives and statements rather than copying normative ISO text. For conformity assessment and audit, always consult a licensed copy of ISO/IEC 27001:2022 (and applicable amendments). Annex A control titles follow the publicly documented 2022 control set; control purposes here are concise paraphrases suitable for machine-readable mapping, not ISO control wording. Scope of this catalog: Clauses 4–10 management-system requirements and the 93 Annex A reference controls. Clauses 1–3 (scope, normative references, terms) are omitted as they do not define operable guidelines.

Exemptions

Clauses 1–3 (Scope, Normative references, Terms and definitions)

These clauses define document scope and vocabulary rather than operable ISMS guidelines; terms should live in a shared lexicon if needed.

Detailed risk-methodology guidance

ISO/IEC 27005 elaborates risk assessment and treatment method detail; represent that as a companion GuidanceCatalog or RiskAssessment profile rather than expanding this catalog.

Redirect: ISO/IEC 27005:2022

Showing 123 of 123

Context of the organization

Clause 4 — organisational context, interested parties, ISMS scope and the ISMS itself.

iso27001-4.1Understanding the organization and its context

Objective

Determine internal and external issues relevant to the organisation's purpose and to achieving the intended outcomes of the ISMS.

Statements

• iso27001-4.1.1

  Identify and maintain awareness of internal and external issues that affect information security and the ISMS.

iso27001-4.2Understanding the needs and expectations of interested parties

Objective

Identify interested parties relevant to the ISMS and determine which of their requirements are addressed through the ISMS.

Statements

• iso27001-4.2.1

  Identify interested parties relevant to the ISMS.

• iso27001-4.2.2

  Determine which interested-party requirements are relevant to information security and will be addressed through the ISMS.

iso27001-4.3Determining the scope of the information security management system

Objective

Define and document the boundaries and applicability of the ISMS, considering organisational context, interested-party requirements and interfaces/dependencies.

Statements

• iso27001-4.3.1

  Determine the ISMS scope considering context, interested-party requirements and interfaces/dependencies with other organisations.

• iso27001-4.3.2

  Make the ISMS scope available as documented information.

iso27001-4.4Information security management system

Objective

Establish, implement, maintain and continually improve an ISMS in accordance with the requirements of ISO/IEC 27001.

Statements

• iso27001-4.4.1

  Establish, implement, maintain and continually improve the ISMS, including the processes needed and their interactions.

Leadership

Clause 5 — leadership commitment, information security policy, and roles/responsibilities/authorities.

iso27001-5.1Leadership and commitment

Objective

Top management demonstrates leadership and commitment with respect to the ISMS.

Statements

• iso27001-5.1.1

  Ensure the information security policy and objectives are established and compatible with the strategic direction of the organisation.

• iso27001-5.1.2

  Ensure ISMS requirements are integrated into the organisation's processes.

• iso27001-5.1.3

  Ensure resources needed for the ISMS are available.

• iso27001-5.1.4

  Communicate the importance of effective information security management and of conforming to ISMS requirements.

• iso27001-5.1.5

  Ensure the ISMS achieves its intended outcomes.

• iso27001-5.1.6

  Direct and support persons to contribute to the effectiveness of the ISMS.

• iso27001-5.1.7

  Promote continual improvement and support other relevant management roles.

iso27001-5.2Policy

Objective

Top management establishes an information security policy appropriate to the organisation's purpose.

Statements

• iso27001-5.2.1

  Establish an information security policy that is appropriate to the purpose of the organisation.

• iso27001-5.2.2

  Include a commitment to satisfy applicable information-security requirements.

• iso27001-5.2.3

  Include a commitment to continual improvement of the ISMS.

• iso27001-5.2.4

  Make the policy available as documented information, communicate it within the organisation, and make it available to interested parties as appropriate.

iso27001-5.3Organizational roles, responsibilities and authorities

Objective

Top management ensures that responsibilities and authorities for roles relevant to information security are assigned and communicated.

Statements

• iso27001-5.3.1

  Assign and communicate responsibilities and authorities for roles relevant to information security.

• iso27001-5.3.2

  Assign responsibility and authority for ensuring the ISMS conforms to ISO/IEC 27001 requirements.

• iso27001-5.3.3

  Assign responsibility and authority for reporting on ISMS performance to top management.

Planning

Clause 6 — risks and opportunities, risk assessment and treatment, objectives, and planned changes.

iso27001-6.1.1Actions to address risks and opportunities — General

Objective

When planning the ISMS, determine risks and opportunities that need to be addressed so the ISMS can achieve intended outcomes, prevent undesired effects and achieve continual improvement.

Statements

• iso27001-6.1.1.1

  Determine risks and opportunities that need to be addressed for the ISMS.

• iso27001-6.1.1.2

  Plan actions to address these risks and opportunities.

• iso27001-6.1.1.3

  Plan how to integrate and implement the actions into ISMS processes, and how to evaluate their effectiveness.

iso27001-6.1.2Information security risk assessment

Objective

Define and apply an information security risk assessment process that establishes risk criteria, ensures consistent and valid results, and identifies, analyses and evaluates information security risks.

Statements

• iso27001-6.1.2.1
  Risk criteria

  Establish and maintain information security risk criteria that include risk-acceptance criteria and criteria for performing assessments.

• iso27001-6.1.2.2
  Consistency

  Ensure that repeated assessments produce consistent, valid and comparable results.

• iso27001-6.1.2.3
  Risk identification

  Identify information security risks associated with loss of confidentiality, integrity and/or availability, and identify risk owners.

• iso27001-6.1.2.4
  Risk analysis

  Analyse risks by assessing potential consequences, realistic likelihood, and determining levels of risk.

• iso27001-6.1.2.5
  Risk evaluation

  Compare analysis results with risk criteria and prioritise analysed risks for treatment.

• iso27001-6.1.2.6
  Documented information

  Retain documented information about the information security risk assessment process.

iso27001-6.1.3Information security risk treatment

Objective

Define and apply an information security risk treatment process that selects options, determines necessary controls, compares them with Annex A, produces a Statement of Applicability, formulates a treatment plan, and obtains risk-owner approval of residual risk.

Statements

• iso27001-6.1.3.1
  Treatment options

  Select appropriate information security risk treatment options, taking account of assessment results.

• iso27001-6.1.3.2
  Necessary controls

  Determine all controls necessary to implement the chosen treatment options.

• iso27001-6.1.3.3
  Annex A comparison

  Compare necessary controls with those in Annex A and verify that no necessary controls have been omitted.

• iso27001-6.1.3.4
  Statement of Applicability

  Produce a Statement of Applicability that contains necessary controls, justification for inclusion, whether implemented, and justification for exclusions of Annex A controls.

• iso27001-6.1.3.5
  Treatment plan

  Formulate an information security risk treatment plan.

• iso27001-6.1.3.6
  Risk-owner approval

  Obtain risk owners' approval of the treatment plan and acceptance of residual information security risks.

• iso27001-6.1.3.7
  Documented information

  Retain documented information about the information security risk treatment process.

Recommendations

• Represent the Statement of Applicability as an ApplicabilityProfile over Annex A guidelines.
• Map chosen controls to iso27001-A.* guideline IDs in this catalog.

iso27001-6.2Information security objectives and planning to achieve them

Objective

Establish information security objectives at relevant functions and levels that are consistent with the policy, measurable where practicable, monitored, communicated and updated.

Statements

• iso27001-6.2.1

  Establish information security objectives consistent with the information security policy.

• iso27001-6.2.2

  Ensure objectives are measurable (if practicable), take account of requirements and risk-assessment/treatment results, are monitored, communicated and updated as appropriate.

• iso27001-6.2.3

  When planning how to achieve objectives, determine what will be done, what resources will be required, who will be responsible, when it will be completed, and how results will be evaluated.

• iso27001-6.2.4

  Retain documented information on the information security objectives.

iso27001-6.3Planning of changes

Objective

When the organisation determines the need for changes to the ISMS, the changes are carried out in a planned manner.

Statements

• iso27001-6.3.1

  Carry out changes to the ISMS in a planned manner.

Support

Clause 7 — resources, competence, awareness, communication and documented information.

iso27001-7.1Resources

Objective

Determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS.

Statements

• iso27001-7.1.1

  Determine and provide the resources needed for the ISMS.

iso27001-7.2Competence

Objective

Ensure persons doing work under the organisation's control that affects information-security performance are competent on the basis of appropriate education, training or experience.

Statements

• iso27001-7.2.1

  Determine the necessary competence of persons doing work under the organisation's control that affects its information security performance.

• iso27001-7.2.2

  Ensure these persons are competent on the basis of appropriate education, training or experience.

• iso27001-7.2.3

  Where applicable, take actions to acquire the necessary competence and evaluate the effectiveness of the actions taken.

• iso27001-7.2.4

  Retain appropriate documented information as evidence of competence.

iso27001-7.3Awareness

Objective

Persons doing work under the organisation's control are aware of the information security policy, their contribution to ISMS effectiveness, and implications of not conforming with ISMS requirements.

Statements

• iso27001-7.3.1

  Ensure relevant persons are aware of the information security policy.

• iso27001-7.3.2

  Ensure relevant persons are aware of their contribution to the effectiveness of the ISMS, including benefits of improved information security performance.

• iso27001-7.3.3

  Ensure relevant persons are aware of the implications of not conforming with the ISMS requirements.

iso27001-7.4Communication

Objective

Determine the need for internal and external communications relevant to the ISMS, including what, when, with whom, how and who communicates.

Statements

• iso27001-7.4.1

  Determine what to communicate, when to communicate, with whom to communicate, how to communicate, and who communicates, for communications relevant to the ISMS.

iso27001-7.5.1Documented information — General

Objective

The organisation's ISMS includes documented information required by ISO/IEC 27001 and documented information determined by the organisation as necessary for ISMS effectiveness.

Statements

• iso27001-7.5.1.1

  Include documented information required by ISO/IEC 27001.

• iso27001-7.5.1.2

  Include documented information determined by the organisation as being necessary for the effectiveness of the ISMS.

iso27001-7.5.2Creating and updating

Objective

When creating and updating documented information, ensure appropriate identification, format, and review and approval for suitability and adequacy.

Statements

• iso27001-7.5.2.1

  Ensure appropriate identification and description (for example title, date, author, reference number).

• iso27001-7.5.2.2

  Ensure appropriate format (for example language, software version, graphics) and media (for example paper, electronic).

• iso27001-7.5.2.3

  Ensure review and approval for suitability and adequacy.

iso27001-7.5.3Control of documented information

Objective

Control documented information required by the ISMS and by ISO/IEC 27001 to ensure it is available, suitable, and adequately protected.

Statements

• iso27001-7.5.3.1

  Ensure documented information is available and suitable for use, where and when it is needed.

• iso27001-7.5.3.2

  Ensure documented information is adequately protected (for example from loss of confidentiality, improper use, or loss of integrity).

• iso27001-7.5.3.3

  Address distribution, access, retrieval, use, storage, preservation, control of changes, retention and disposition as applicable.

• iso27001-7.5.3.4

  Identify and control documented information of external origin determined by the organisation to be necessary for the planning and operation of the ISMS.

Operation

Clause 8 — operational planning and control, and operational risk assessment and treatment.

iso27001-8.1Operational planning and control

Objective

Plan, implement and control the processes needed to meet information-security requirements and to implement actions determined in Clause 6, including criteria, control of planned changes, and control of outsourced processes.

Statements

• iso27001-8.1.1

  Plan, implement and control processes needed to meet information security requirements and to implement Clause 6 actions.

• iso27001-8.1.2

  Establish criteria for the processes and implement control of the processes in accordance with the criteria.

• iso27001-8.1.3

  Keep documented information to the extent necessary to have confidence that processes have been carried out as planned.

• iso27001-8.1.4

  Control planned changes and review the consequences of unintended changes, taking action to mitigate adverse effects as necessary.

• iso27001-8.1.5

  Ensure that outsourced processes are determined and controlled.

iso27001-8.2Information security risk assessment (operation)

Objective

Perform information security risk assessments at planned intervals and when significant changes are proposed or occur, retaining results of those assessments.

Statements

• iso27001-8.2.1

  Perform information security risk assessments at planned intervals.

• iso27001-8.2.2

  Perform information security risk assessments when significant changes are proposed or occur.

• iso27001-8.2.3

  Retain documented information of the results of the information security risk assessments.

iso27001-8.3Information security risk treatment (operation)

Objective

Implement the information security risk treatment plan and retain documented information of the results of treatment.

Statements

• iso27001-8.3.1

  Implement the information security risk treatment plan.

• iso27001-8.3.2

  Retain documented information of the results of information security risk treatment.

Performance evaluation

Clause 9 — monitoring/measurement, internal audit and management review.

iso27001-9.1Monitoring, measurement, analysis and evaluation

Objective

Determine what needs to be monitored and measured, the methods, when monitoring/measurement is performed, when results are analysed and evaluated, and evaluate information security performance and ISMS effectiveness.

Statements

• iso27001-9.1.1

  Determine what needs to be monitored and measured, including information security processes and controls.

• iso27001-9.1.2

  Determine the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results.

• iso27001-9.1.3

  Determine when monitoring and measuring is performed, and when results are analysed and evaluated.

• iso27001-9.1.4

  Evaluate information security performance and the effectiveness of the ISMS.

• iso27001-9.1.5

  Retain appropriate documented information as evidence of the monitoring and measurement results.

iso27001-9.2.1Internal audit — General

Objective

Conduct internal audits at planned intervals to provide information on whether the ISMS conforms to the organisation's own requirements and to ISO/IEC 27001, and is effectively implemented and maintained.

Statements

• iso27001-9.2.1.1

  Conduct internal audits at planned intervals.

• iso27001-9.2.1.2

  Determine whether the ISMS conforms to the organisation's own requirements for its ISMS and to the requirements of ISO/IEC 27001.

• iso27001-9.2.1.3

  Determine whether the ISMS is effectively implemented and maintained.

iso27001-9.2.2Internal audit programme

Objective

Plan, establish, implement and maintain an audit programme including frequency, methods, responsibilities, planning requirements and reporting.

Statements

• iso27001-9.2.2.1

  Plan, establish, implement and maintain an audit programme including the frequency, methods, responsibilities, planning requirements and reporting.

• iso27001-9.2.2.2

  Take into consideration the importance of the processes concerned and the results of previous audits when establishing the audit programme.

• iso27001-9.2.2.3

  Define the audit criteria and scope for each audit.

• iso27001-9.2.2.4

  Select auditors and conduct audits that ensure objectivity and the impartiality of the audit process.

• iso27001-9.2.2.5

  Ensure that the results of the audits are reported to relevant management.

• iso27001-9.2.2.6

  Retain documented information as evidence of the implementation of the audit programme and the audit results.

iso27001-9.3.1Management review — General

Objective

Top management reviews the organisation's ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

Statements

• iso27001-9.3.1.1

  Top management reviews the ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

iso27001-9.3.2Management review inputs

Objective

Management review considers prior actions, changes in context and interested-party needs, information-security performance, risk results and improvement opportunities.

Statements

• iso27001-9.3.2.1

  Consider the status of actions from previous management reviews.

• iso27001-9.3.2.2

  Consider changes in external and internal issues relevant to the ISMS.

• iso27001-9.3.2.3

  Consider changes in needs and expectations of interested parties that are relevant to the ISMS.

• iso27001-9.3.2.4

  Consider information on information security performance, including nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of information security objectives.

• iso27001-9.3.2.5

  Consider feedback from interested parties.

• iso27001-9.3.2.6

  Consider results of risk assessment and status of the risk treatment plan.

• iso27001-9.3.2.7

  Consider opportunities for continual improvement.

iso27001-9.3.3Management review results

Objective

The results of the management review include decisions related to continual improvement opportunities and any need for changes to the ISMS.

Statements

• iso27001-9.3.3.1

  Include decisions related to continual improvement opportunities.

• iso27001-9.3.3.2

  Include any need for changes to the ISMS.

• iso27001-9.3.3.3

  Retain documented information as evidence of the results of management reviews.

Improvement

Clause 10 — continual improvement and nonconformity/corrective action.

iso27001-10.1Continual improvement

Objective

Continually improve the suitability, adequacy and effectiveness of the ISMS.

Statements

• iso27001-10.1.1

  Continually improve the suitability, adequacy and effectiveness of the ISMS.

iso27001-10.2Nonconformity and corrective action

Objective

When a nonconformity occurs, react to it, evaluate the need for action to eliminate causes, implement needed action, review effectiveness, and make changes to the ISMS if necessary.

Statements

• iso27001-10.2.1

  React to the nonconformity and, as applicable, take action to control and correct it and deal with the consequences.

• iso27001-10.2.2

  Evaluate the need for action to eliminate the causes of the nonconformity so that it does not recur or occur elsewhere.

• iso27001-10.2.3

  Implement any action needed.

• iso27001-10.2.4

  Review the effectiveness of any corrective action taken.

• iso27001-10.2.5

  Make changes to the ISMS, if necessary.

• iso27001-10.2.6

  Ensure corrective actions are appropriate to the effects of the nonconformities encountered.

• iso27001-10.2.7

  Retain documented information as evidence of the nature of the nonconformities, subsequent actions taken, and results of corrective action.

Annex A — Organisational controls

Annex A theme: organisational information security controls (A.5.1–A.5.37).

iso27001-A.5.1A.5.1 Policies for information security

Objective

Define, approve, communicate and review information security policies.

Statements

• iso27001-A.5.1.1
  Control purpose

  Define, approve, communicate and review information security policies.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.2A.5.2 Information security roles and responsibilities

Objective

Define and allocate information security roles and responsibilities according to organisational needs.

Statements

• iso27001-A.5.2.1
  Control purpose

  Define and allocate information security roles and responsibilities according to organisational needs.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.3A.5.3 Segregation of duties

Objective

Segregate conflicting duties and areas of responsibility to reduce opportunities for unauthorised or unintentional misuse.

Statements

• iso27001-A.5.3.1
  Control purpose

  Segregate conflicting duties and areas of responsibility to reduce opportunities for unauthorised or unintentional misuse.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.4A.5.4 Management responsibilities

Objective

Require management to ensure personnel apply information security in accordance with established policy and procedures.

Statements

• iso27001-A.5.4.1
  Control purpose

  Require management to ensure personnel apply information security in accordance with established policy and procedures.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.5A.5.5 Contact with authorities

Objective

Establish and maintain appropriate contact with relevant authorities.

Statements

• iso27001-A.5.5.1
  Control purpose

  Establish and maintain appropriate contact with relevant authorities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.6A.5.6 Contact with special interest groups

Objective

Establish and maintain appropriate contact with special interest groups and other specialist security forums.

Statements

• iso27001-A.5.6.1
  Control purpose

  Establish and maintain appropriate contact with special interest groups and other specialist security forums.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.7A.5.7 Threat intelligence

Objective

Collect and analyse information relating to information security threats to produce threat intelligence.

Statements

• iso27001-A.5.7.1
  Control purpose

  Collect and analyse information relating to information security threats to produce threat intelligence.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.8A.5.8 Information security in project management

Objective

Integrate information security into project management.

Statements

• iso27001-A.5.8.1
  Control purpose

  Integrate information security into project management.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.9A.5.9 Inventory of information and other associated assets

Objective

Develop and maintain an inventory of information and other associated assets, including owners.

Statements

• iso27001-A.5.9.1
  Control purpose

  Develop and maintain an inventory of information and other associated assets, including owners.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.10A.5.10 Acceptable use of information and other associated assets

Objective

Identify, document and implement rules for acceptable use and procedures for handling information and other associated assets.

Statements

• iso27001-A.5.10.1
  Control purpose

  Identify, document and implement rules for acceptable use and procedures for handling information and other associated assets.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.11A.5.11 Return of assets

Objective

Ensure personnel and other interested parties return organisational assets upon change or termination of employment, contract or agreement.

Statements

• iso27001-A.5.11.1
  Control purpose

  Ensure personnel and other interested parties return organisational assets upon change or termination of employment, contract or agreement.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.12A.5.12 Classification of information

Objective

Classify information according to information security needs based on confidentiality, integrity, availability and relevant interested-party requirements.

Statements

• iso27001-A.5.12.1
  Control purpose

  Classify information according to information security needs based on confidentiality, integrity, availability and relevant interested-party requirements.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.13A.5.13 Labelling of information

Objective

Develop and implement procedures for labelling information according to the organisation's classification scheme.

Statements

• iso27001-A.5.13.1
  Control purpose

  Develop and implement procedures for labelling information according to the organisation's classification scheme.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.14A.5.14 Information transfer

Objective

Establish information transfer rules, procedures or agreements for transfers within the organisation and with other parties.

Statements

• iso27001-A.5.14.1
  Control purpose

  Establish information transfer rules, procedures or agreements for transfers within the organisation and with other parties.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.15A.5.15 Access control

Objective

Establish rules to control physical and logical access to information and other associated assets based on business and information security requirements.

Statements

• iso27001-A.5.15.1
  Control purpose

  Establish rules to control physical and logical access to information and other associated assets based on business and information security requirements.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.16A.5.16 Identity management

Objective

Manage the full lifecycle of identities.

Statements

• iso27001-A.5.16.1
  Control purpose

  Manage the full lifecycle of identities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.17A.5.17 Authentication information

Objective

Control allocation and management of authentication information, including advising personnel on appropriate handling.

Statements

• iso27001-A.5.17.1
  Control purpose

  Control allocation and management of authentication information, including advising personnel on appropriate handling.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.18A.5.18 Access rights

Objective

Provision, review, modify and remove access rights in accordance with the organisation's access-control policy.

Statements

• iso27001-A.5.18.1
  Control purpose

  Provision, review, modify and remove access rights in accordance with the organisation's access-control policy.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.19A.5.19 Information security in supplier relationships

Objective

Define and implement processes to manage information security risks associated with supplier products or services.

Statements

• iso27001-A.5.19.1
  Control purpose

  Define and implement processes to manage information security risks associated with supplier products or services.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.20A.5.20 Addressing information security within supplier agreements

Objective

Establish and agree relevant information security requirements with each supplier based on the type of relationship.

Statements

• iso27001-A.5.20.1
  Control purpose

  Establish and agree relevant information security requirements with each supplier based on the type of relationship.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.21A.5.21 Managing information security in the ICT supply chain

Objective

Define and implement processes to manage information security risks in the ICT products and services supply chain.

Statements

• iso27001-A.5.21.1
  Control purpose

  Define and implement processes to manage information security risks in the ICT products and services supply chain.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.22A.5.22 Monitoring, review and change management of supplier services

Objective

Regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

Statements

• iso27001-A.5.22.1
  Control purpose

  Regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.23A.5.23 Information security for use of cloud services

Objective

Establish processes for acquisition, use, management and exit from cloud services aligned to information security requirements.

Statements

• iso27001-A.5.23.1
  Control purpose

  Establish processes for acquisition, use, management and exit from cloud services aligned to information security requirements.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.24A.5.24 Information security incident management planning and preparation

Objective

Plan and prepare for managing information security incidents by defining processes, roles and responsibilities.

Statements

• iso27001-A.5.24.1
  Control purpose

  Plan and prepare for managing information security incidents by defining processes, roles and responsibilities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.25A.5.25 Assessment and decision on information security events

Objective

Assess information security events and decide whether they are information security incidents.

Statements

• iso27001-A.5.25.1
  Control purpose

  Assess information security events and decide whether they are information security incidents.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.26A.5.26 Response to information security incidents

Objective

Respond to information security incidents in accordance with documented procedures.

Statements

• iso27001-A.5.26.1
  Control purpose

  Respond to information security incidents in accordance with documented procedures.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.27A.5.27 Learning from information security incidents

Objective

Use knowledge gained from information security incidents to strengthen and improve controls.

Statements

• iso27001-A.5.27.1
  Control purpose

  Use knowledge gained from information security incidents to strengthen and improve controls.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.28A.5.28 Collection of evidence

Objective

Establish and implement procedures for identification, collection, acquisition and preservation of evidence related to information security events.

Statements

• iso27001-A.5.28.1
  Control purpose

  Establish and implement procedures for identification, collection, acquisition and preservation of evidence related to information security events.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.29A.5.29 Information security during disruption

Objective

Plan how to maintain information security at an appropriate level during disruption.

Statements

• iso27001-A.5.29.1
  Control purpose

  Plan how to maintain information security at an appropriate level during disruption.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.30A.5.30 ICT readiness for business continuity

Objective

Plan, implement, maintain and test ICT readiness based on business continuity objectives and ICT continuity requirements.

Statements

• iso27001-A.5.30.1
  Control purpose

  Plan, implement, maintain and test ICT readiness based on business continuity objectives and ICT continuity requirements.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.31A.5.31 Legal, statutory, regulatory and contractual requirements

Objective

Identify, document and keep up to date applicable legal, statutory, regulatory and contractual information-security requirements and the approach to meet them.

Statements

• iso27001-A.5.31.1
  Control purpose

  Identify, document and keep up to date applicable legal, statutory, regulatory and contractual information-security requirements and the approach to meet them.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.32A.5.32 Intellectual property rights

Objective

Implement procedures to protect intellectual property rights.

Statements

• iso27001-A.5.32.1
  Control purpose

  Implement procedures to protect intellectual property rights.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.33A.5.33 Protection of records

Objective

Protect records against loss, destruction, falsification, unauthorised access and unauthorised release.

Statements

• iso27001-A.5.33.1
  Control purpose

  Protect records against loss, destruction, falsification, unauthorised access and unauthorised release.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.34A.5.34 Privacy and protection of PII

Objective

Meet applicable requirements for privacy and protection of personally identifiable information.

Statements

• iso27001-A.5.34.1
  Control purpose

  Meet applicable requirements for privacy and protection of personally identifiable information.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.35A.5.35 Independent review of information security

Objective

Independently review the organisation's approach to managing information security and its implementation at planned intervals or when significant changes occur.

Statements

• iso27001-A.5.35.1
  Control purpose

  Independently review the organisation's approach to managing information security and its implementation at planned intervals or when significant changes occur.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.36A.5.36 Compliance with policies, rules and standards for information security

Objective

Regularly review compliance with the organisation's information security policy, topic-specific policies, rules and standards.

Statements

• iso27001-A.5.36.1
  Control purpose

  Regularly review compliance with the organisation's information security policy, topic-specific policies, rules and standards.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.5.37A.5.37 Documented operating procedures

Objective

Make operating procedures for information processing facilities available and maintain them as documented information.

Statements

• iso27001-A.5.37.1
  Control purpose

  Make operating procedures for information processing facilities available and maintain them as documented information.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

Annex A — People controls

Annex A theme: people controls (A.6.1–A.6.8).

iso27001-A.6.1A.6.1 Screening

Objective

Perform background verification checks on candidates prior to joining, proportionate to business requirements, information classification and perceived risks.

Statements

• iso27001-A.6.1.1
  Control purpose

  Perform background verification checks on candidates prior to joining, proportionate to business requirements, information classification and perceived risks.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.2A.6.2 Terms and conditions of employment

Objective

State information security responsibilities in contractual agreements with personnel and other interested parties.

Statements

• iso27001-A.6.2.1
  Control purpose

  State information security responsibilities in contractual agreements with personnel and other interested parties.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.3A.6.3 Information security awareness, education and training

Objective

Provide appropriate information security awareness, education and training, and regular updates, to personnel and relevant interested parties.

Statements

• iso27001-A.6.3.1
  Control purpose

  Provide appropriate information security awareness, education and training, and regular updates, to personnel and relevant interested parties.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.4A.6.4 Disciplinary process

Objective

Formalise and communicate a disciplinary process for information security policy violations.

Statements

• iso27001-A.6.4.1
  Control purpose

  Formalise and communicate a disciplinary process for information security policy violations.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.5A.6.5 Responsibilities after termination or change of employment

Objective

Define, enforce and communicate information security responsibilities that remain valid after termination or change of employment.

Statements

• iso27001-A.6.5.1
  Control purpose

  Define, enforce and communicate information security responsibilities that remain valid after termination or change of employment.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.6A.6.6 Confidentiality or non-disclosure agreements

Objective

Identify, document, regularly review and conclude confidentiality or non-disclosure agreements reflecting protection needs.

Statements

• iso27001-A.6.6.1
  Control purpose

  Identify, document, regularly review and conclude confidentiality or non-disclosure agreements reflecting protection needs.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.7A.6.7 Remote working

Objective

Implement security measures for remote working to protect information accessed, processed or stored outside organisational premises.

Statements

• iso27001-A.6.7.1
  Control purpose

  Implement security measures for remote working to protect information accessed, processed or stored outside organisational premises.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.6.8A.6.8 Information security event reporting

Objective

Provide a mechanism for personnel to report observed or suspected information security events promptly through appropriate channels.

Statements

• iso27001-A.6.8.1
  Control purpose

  Provide a mechanism for personnel to report observed or suspected information security events promptly through appropriate channels.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

Annex A — Physical controls

Annex A theme: physical controls (A.7.1–A.7.14).

iso27001-A.7.1A.7.1 Physical security perimeters

Objective

Define security perimeters and use them to protect areas that contain information and other associated assets.

Statements

• iso27001-A.7.1.1
  Control purpose

  Define security perimeters and use them to protect areas that contain information and other associated assets.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.2A.7.2 Physical entry

Objective

Secure sites and buildings with appropriate entry controls, and protect secure areas with appropriate entry controls and access points.

Statements

• iso27001-A.7.2.1
  Control purpose

  Secure sites and buildings with appropriate entry controls, and protect secure areas with appropriate entry controls and access points.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.3A.7.3 Securing offices, rooms and facilities

Objective

Design and implement physical security for offices, rooms and facilities.

Statements

• iso27001-A.7.3.1
  Control purpose

  Design and implement physical security for offices, rooms and facilities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.4A.7.4 Physical security monitoring

Objective

Continuously monitor premises for unauthorised physical access.

Statements

• iso27001-A.7.4.1
  Control purpose

  Continuously monitor premises for unauthorised physical access.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.5A.7.5 Protecting against physical and environmental threats

Objective

Design and implement protection against physical and environmental threats to infrastructure.

Statements

• iso27001-A.7.5.1
  Control purpose

  Design and implement protection against physical and environmental threats to infrastructure.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.6A.7.6 Working in secure areas

Objective

Design and implement security measures for working in secure areas.

Statements

• iso27001-A.7.6.1
  Control purpose

  Design and implement security measures for working in secure areas.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.7A.7.7 Clear desk and clear screen

Objective

Define and enforce clear desk rules for papers and removable storage media, and clear screen rules for information processing facilities.

Statements

• iso27001-A.7.7.1
  Control purpose

  Define and enforce clear desk rules for papers and removable storage media, and clear screen rules for information processing facilities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.8A.7.8 Equipment siting and protection

Objective

Site and protect equipment securely.

Statements

• iso27001-A.7.8.1
  Control purpose

  Site and protect equipment securely.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.9A.7.9 Security of assets off-premises

Objective

Protect off-site assets taking account of the different risks of working outside organisational premises.

Statements

• iso27001-A.7.9.1
  Control purpose

  Protect off-site assets taking account of the different risks of working outside organisational premises.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.10A.7.10 Storage media

Objective

Manage storage media through acquisition, use, transportation and disposal in accordance with classification and handling requirements.

Statements

• iso27001-A.7.10.1
  Control purpose

  Manage storage media through acquisition, use, transportation and disposal in accordance with classification and handling requirements.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.11A.7.11 Supporting utilities

Objective

Protect information processing facilities from power failures and other disruptions caused by failures in supporting utilities.

Statements

• iso27001-A.7.11.1
  Control purpose

  Protect information processing facilities from power failures and other disruptions caused by failures in supporting utilities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.12A.7.12 Cabling security

Objective

Protect cables carrying power, data or supporting information services from interception, interference or damage.

Statements

• iso27001-A.7.12.1
  Control purpose

  Protect cables carrying power, data or supporting information services from interception, interference or damage.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.13A.7.13 Equipment maintenance

Objective

Maintain equipment correctly to ensure availability, integrity and confidentiality of information.

Statements

• iso27001-A.7.13.1
  Control purpose

  Maintain equipment correctly to ensure availability, integrity and confidentiality of information.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.7.14A.7.14 Secure disposal or re-use of equipment

Objective

Verify equipment containing storage media is wiped or securely overwritten prior to disposal or re-use.

Statements

• iso27001-A.7.14.1
  Control purpose

  Verify equipment containing storage media is wiped or securely overwritten prior to disposal or re-use.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

Annex A — Technological controls

Annex A theme: technological controls (A.8.1–A.8.34).

iso27001-A.8.1A.8.1 User endpoint devices

Objective

Protect information stored on, processed by or accessible via user endpoint devices.

Statements

• iso27001-A.8.1.1
  Control purpose

  Protect information stored on, processed by or accessible via user endpoint devices.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.2A.8.2 Privileged access rights

Objective

Restrict and manage the allocation and use of privileged access rights.

Statements

• iso27001-A.8.2.1
  Control purpose

  Restrict and manage the allocation and use of privileged access rights.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.3A.8.3 Information access restriction

Objective

Restrict access to information and other associated assets in accordance with the access-control policy.

Statements

• iso27001-A.8.3.1
  Control purpose

  Restrict access to information and other associated assets in accordance with the access-control policy.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.4A.8.4 Access to source code

Objective

Manage read and write access to source code, development tools and software libraries appropriately.

Statements

• iso27001-A.8.4.1
  Control purpose

  Manage read and write access to source code, development tools and software libraries appropriately.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.5A.8.5 Secure authentication

Objective

Implement secure authentication technologies and procedures based on access restrictions and access-control policy.

Statements

• iso27001-A.8.5.1
  Control purpose

  Implement secure authentication technologies and procedures based on access restrictions and access-control policy.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.6A.8.6 Capacity management

Objective

Monitor and adjust resource use, and project future capacity requirements to ensure required system performance.

Statements

• iso27001-A.8.6.1
  Control purpose

  Monitor and adjust resource use, and project future capacity requirements to ensure required system performance.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.7A.8.7 Protection against malware

Objective

Implement protection against malware, supported by appropriate user awareness.

Statements

• iso27001-A.8.7.1
  Control purpose

  Implement protection against malware, supported by appropriate user awareness.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.8A.8.8 Management of technical vulnerabilities

Objective

Obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures.

Statements

• iso27001-A.8.8.1
  Control purpose

  Obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.9A.8.9 Configuration management

Objective

Establish, document, implement, monitor and review configurations, including security configurations, of hardware, software, services and networks.

Statements

• iso27001-A.8.9.1
  Control purpose

  Establish, document, implement, monitor and review configurations, including security configurations, of hardware, software, services and networks.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.10A.8.10 Information deletion

Objective

Delete information stored in information systems, devices or other storage media when no longer required.

Statements

• iso27001-A.8.10.1
  Control purpose

  Delete information stored in information systems, devices or other storage media when no longer required.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.11A.8.11 Data masking

Objective

Use data masking in accordance with access-control and related policies, business requirements and applicable legislation.

Statements

• iso27001-A.8.11.1
  Control purpose

  Use data masking in accordance with access-control and related policies, business requirements and applicable legislation.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.12A.8.12 Data leakage prevention

Objective

Apply data leakage prevention measures to systems, networks and devices that process, store or transmit sensitive information.

Statements

• iso27001-A.8.12.1
  Control purpose

  Apply data leakage prevention measures to systems, networks and devices that process, store or transmit sensitive information.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.13A.8.13 Information backup

Objective

Maintain backup copies of information, software and systems, and test them regularly in accordance with backup policy.

Statements

• iso27001-A.8.13.1
  Control purpose

  Maintain backup copies of information, software and systems, and test them regularly in accordance with backup policy.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.14A.8.14 Redundancy of information processing facilities

Objective

Implement information processing facilities with redundancy sufficient to meet availability requirements.

Statements

• iso27001-A.8.14.1
  Control purpose

  Implement information processing facilities with redundancy sufficient to meet availability requirements.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.15A.8.15 Logging

Objective

Produce, store, protect and analyse logs that record activities, exceptions, faults and other relevant events.

Statements

• iso27001-A.8.15.1
  Control purpose

  Produce, store, protect and analyse logs that record activities, exceptions, faults and other relevant events.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.16A.8.16 Monitoring activities

Objective

Monitor networks, systems and applications for anomalous behaviour and take appropriate action regarding potential incidents.

Statements

• iso27001-A.8.16.1
  Control purpose

  Monitor networks, systems and applications for anomalous behaviour and take appropriate action regarding potential incidents.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.17A.8.17 Clock synchronization

Objective

Synchronise clocks of information processing systems to approved time sources.

Statements

• iso27001-A.8.17.1
  Control purpose

  Synchronise clocks of information processing systems to approved time sources.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.18A.8.18 Use of privileged utility programs

Objective

Restrict and tightly control utility programs that can override system and application controls.

Statements

• iso27001-A.8.18.1
  Control purpose

  Restrict and tightly control utility programs that can override system and application controls.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.19A.8.19 Installation of software on operational systems

Objective

Implement procedures and measures to securely manage software installation on operational systems.

Statements

• iso27001-A.8.19.1
  Control purpose

  Implement procedures and measures to securely manage software installation on operational systems.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.20A.8.20 Networks security

Objective

Secure, manage and control networks and network devices to protect information in systems and applications.

Statements

• iso27001-A.8.20.1
  Control purpose

  Secure, manage and control networks and network devices to protect information in systems and applications.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.21A.8.21 Security of network services

Objective

Identify, implement and monitor security mechanisms, service levels and service requirements of network services.

Statements

• iso27001-A.8.21.1
  Control purpose

  Identify, implement and monitor security mechanisms, service levels and service requirements of network services.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.22A.8.22 Segregation of networks

Objective

Segregate groups of information services, users and information systems in the organisation's networks.

Statements

• iso27001-A.8.22.1
  Control purpose

  Segregate groups of information services, users and information systems in the organisation's networks.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.23A.8.23 Web filtering

Objective

Manage access to external websites to reduce exposure to malicious content.

Statements

• iso27001-A.8.23.1
  Control purpose

  Manage access to external websites to reduce exposure to malicious content.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.24A.8.24 Use of cryptography

Objective

Define and implement rules for effective use of cryptography, including cryptographic key management.

Statements

• iso27001-A.8.24.1
  Control purpose

  Define and implement rules for effective use of cryptography, including cryptographic key management.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.25A.8.25 Secure development life cycle

Objective

Establish and apply rules for the secure development of software and systems.

Statements

• iso27001-A.8.25.1
  Control purpose

  Establish and apply rules for the secure development of software and systems.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.26A.8.26 Application security requirements

Objective

Identify, specify and approve information security requirements when developing or acquiring applications.

Statements

• iso27001-A.8.26.1
  Control purpose

  Identify, specify and approve information security requirements when developing or acquiring applications.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.27A.8.27 Secure system architecture and engineering principles

Objective

Establish, document, maintain and apply principles for engineering secure systems across development activities.

Statements

• iso27001-A.8.27.1
  Control purpose

  Establish, document, maintain and apply principles for engineering secure systems across development activities.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.28A.8.28 Secure coding

Objective

Apply secure coding principles to software development.

Statements

• iso27001-A.8.28.1
  Control purpose

  Apply secure coding principles to software development.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.29A.8.29 Security testing in development and acceptance

Objective

Define and implement security testing processes in the development life cycle.

Statements

• iso27001-A.8.29.1
  Control purpose

  Define and implement security testing processes in the development life cycle.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.30A.8.30 Outsourced development

Objective

Direct, monitor and review activities related to outsourced system development.

Statements

• iso27001-A.8.30.1
  Control purpose

  Direct, monitor and review activities related to outsourced system development.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.31A.8.31 Separation of development, test and production environments

Objective

Separate and secure development, testing and production environments.

Statements

• iso27001-A.8.31.1
  Control purpose

  Separate and secure development, testing and production environments.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.32A.8.32 Change management

Objective

Subject changes to information processing facilities and information systems to change management procedures.

Statements

• iso27001-A.8.32.1
  Control purpose

  Subject changes to information processing facilities and information systems to change management procedures.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.33A.8.33 Test information

Objective

Select, protect and manage test information appropriately.

Statements

• iso27001-A.8.33.1
  Control purpose

  Select, protect and manage test information appropriately.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.

iso27001-A.8.34A.8.34 Protection of information systems during audit testing

Objective

Plan and agree audit tests and other assurance activities involving operational systems between tester and appropriate management.

Statements

• iso27001-A.8.34.1
  Control purpose

  Plan and agree audit tests and other assurance activities involving operational systems between tester and appropriate management.

Recommendations

• Select this control via risk treatment and record applicability in the Statement of Applicability.
• Implement assessment requirements as Gemara Control Catalog entries mapped to this guideline.