Annex A theme 5: the 37 organizational controls, from policies, roles and threat intelligence through assets, access, suppliers and cloud, incident management and continuity to legal compliance and independent review.
The information security policy and the topic-specific policies under it: who approves them, how they are communicated and acknowledged, and the review cycle an auditor checks, as distinct from the clause 5.2 top-level policy requirement.
Defining and allocating information security roles and responsibilities across the organization: role descriptions, named owners for assets and processes, and how these are recorded, building on the clause 5.3 assignment of ISMS authority.
Separating conflicting duties and areas of responsibility so that no one person can misuse or bypass controls alone: identifying conflicting roles, enforcing separation in access and change approval, and compensating controls where separation is not practical.
How management requires all personnel to apply information security in line with the policy, topic-specific policies and procedures: briefings, acknowledgements, objectives and follow-through, as distinct from top management's clause 5.1 leadership duties.
Establishing and maintaining contact with relevant authorities such as regulators, supervisory bodies and law enforcement: who holds the contacts, when the organization reaches out, and how this ties into incident reporting duties.
Keeping contact with special interest groups, security forums and professional associations to stay informed about threats, vulnerabilities and good practice, and how that information feeds the ISMS.
Collecting and analyzing information about information security threats to produce threat intelligence the organization acts on: sources, analysis, distribution to the people who need it, and links to risk assessment and detection. New in the 2022 revision.
Integrating information security into project management whatever the type of project: security requirements and risks identified early, reviewed at project stages and carried through delivery, rather than added at the end.
Developing and maintaining an inventory of information and other associated assets, including their owners: what belongs in it, how it stays accurate, and how auditors sample it against reality.
Rules for acceptable use and procedures for handling information and other associated assets, communicated to the people who use them, covering handling at each classification level as well as everyday use.
Making sure personnel and other interested parties hand back the organization's assets when their employment, contract or agreement changes or ends, including devices, media and information held on personal equipment.
Classifying information according to the organization's security needs, based on confidentiality, integrity, availability and interested party requirements: the scheme, who assigns levels, and how classification drives handling.
Procedures for labelling information in line with the classification scheme, for documents, systems, metadata and physical media, so that people and tools can recognize how information must be handled.
Rules, procedures or agreements for every kind of information transfer, inside the organization and with other parties: electronic transfer and messaging, physical media and verbal communication.
The rules for controlling physical and logical access to information and other associated assets, based on business and information security requirements: the access control policy that the identity, authentication and access rights controls implement.
Managing the full life cycle of identities for people and systems: creation, unique assignment, changes and removal, including shared and non-human identities, as the base on which access rights are granted.
Allocating and managing authentication information such as passwords, keys and tokens through a controlled process, and advising personnel on handling it, as distinct from the technical authentication mechanisms covered by A.8.5.
Provisioning, reviewing, changing and removing access rights in line with the access control rules: joiner, mover and leaver handling and periodic access reviews, the evidence auditors sample most often in this theme.
Processes for managing the information security risks of using suppliers' products and services: supplier categories, risk-based due diligence and the overall approach that the agreement, supply chain and monitoring controls build on.
Agreeing information security requirements with each supplier according to the type of relationship and writing them into contracts: security clauses, right to audit, incident notification and obligations at the end of the contract.
Managing information security risks that come through the supply chain for ICT products and services, beyond direct suppliers: component provenance, sub-supplier requirements and software or hardware integrity.
Regularly monitoring, reviewing and evaluating suppliers' information security practices and service delivery, and managing changes to supplier services: service reviews, reports, audits and reassessment when things change.
Processes for acquiring, using, managing and exiting cloud services in line with the organization's information security requirements, including the split of responsibilities with the provider. New in the 2022 revision.
Planning and preparing for incidents before they happen: the incident management process, roles and responsibilities, contact lists, reporting routes and training that the event assessment, response and lessons-learned controls rely on.
Assessing reported information security events and deciding whether each one is an incident: triage criteria, categorization and prioritization, and the record of each decision, as the hinge between detection and response.
Responding to information security incidents according to documented procedures: containment, escalation, communication, recovery and closure, and the records that show the procedures were followed.
Using what incidents teach to strengthen controls: post-incident reviews, root cause analysis, trend analysis and the follow-up actions that close the loop, linked to the ISMS improvement clause.
Procedures for identifying, collecting, acquiring and preserving evidence related to information security events, so that it stays usable for disciplinary or legal action: chain of custody, integrity and handling of logs and forensic images.
Planning how to keep information security at an appropriate level during a disruption, including whether continuity arrangements keep or adapt security controls, as distinct from the ICT readiness covered by A.5.30.
Planning, implementing, maintaining and testing ICT readiness based on business continuity objectives and ICT continuity requirements, so systems can be recovered when the business needs them. New in the 2022 revision.
Identifying, documenting and keeping up to date the legal, statutory, regulatory and contractual requirements relevant to information security, and the organization's approach to meeting them, including rules on cryptography.
Procedures to protect intellectual property rights, both the organization's own and those of others it uses, with software licensing compliance as the most common evidence area.
Protecting records from loss, destruction, falsification, unauthorized access and unauthorized release: retention schedules, storage, integrity and disposal for the records the organization must keep.
Identifying and meeting requirements for preserving privacy and protecting personally identifiable information under applicable laws, regulations and contracts, and how this control relates to a separate privacy management system.
Independent review, at planned intervals or after significant changes, of how the organization manages information security and implements it across people, processes and technology, by reviewers outside the area being reviewed.
Regularly reviewing compliance with the information security policy, topic-specific policies, rules and standards, by managers and through technical compliance checks, and acting on what the reviews find.
Documenting operating procedures for information processing facilities and making them available to the personnel who need them: what to document, keeping procedures current, and where auditors expect to find them.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.