A.8.1 User endpoint devices
Protecting information stored on, processed by or reachable through laptops, phones and other user endpoint devices: registration, hardening, encryption, remote wipe and rules for personal devices.
Technological controls
Annex A theme 8: technical controls for endpoints, access, cryptography, logging, monitoring, networks and secure development.
A.8.2 Privileged access rights
Restricting and managing the allocation and use of privileged access rights: who gets administrative rights, separate admin accounts, time-limited elevation and periodic review.
A.8.3 Information access restriction
Restricting access to information and other assets according to the access control policy, through application permissions, data-level controls and dynamic access management.
A.8.4 Access to source code
Managing read and write access to source code, development tools and software libraries, so that code changes are authorized and repositories are protected.
A.8.5 Secure authentication
Secure authentication technologies and procedures matched to access restrictions: multi-factor authentication, log-on procedures, lockout and protection of credentials in transit.
A.8.6 Capacity management
Monitoring resource use and adjusting it to current and expected capacity needs, covering processing, storage, network and human capacity, with forecasting and alerts.
A.8.7 Protection against malware
Protection against malware that combines technical controls with user awareness: detection and repair software, allowlisting, blocking malicious websites and handling infections.
A.8.8 Management of technical vulnerabilities
Obtaining information on technical vulnerabilities, assessing exposure and acting on it: asset-based tracking, scanning, patch timelines, risk acceptance and coordinated disclosure.
A.8.9 Configuration management
Establishing, documenting, implementing, monitoring and reviewing configurations, including security settings, of hardware, software, services and networks; a control that was new in the 2022 revision.
A.8.10 Information deletion
Deleting information held in systems, devices and storage media once it is no longer needed: retention rules, deletion methods, deletion by service providers and evidence that deletion happened. New in 2022.
A.8.11 Data masking
Masking data such as personal information through pseudonymization, anonymization and similar techniques in line with access control policy and legal requirements; new in the 2022 revision.
A.8.12 Data leakage prevention
Data leakage prevention for systems, networks and devices that handle sensitive information: identifying and classifying data, monitoring leakage channels and blocking unauthorized transfers. New in 2022.
A.8.13 Information backup
Keeping backup copies of information, software and systems and testing them regularly under a backup policy: scope, frequency, retention, protection of backups and restore tests.
A.8.14 Redundancy of information processing facilities
Building enough redundancy into information processing facilities to meet availability requirements: redundant components, sites and suppliers, and failover testing.
A.8.15 Logging
Producing, storing, protecting and analyzing logs of activities, exceptions, faults and other relevant events, including administrator and operator activity, log integrity and retention.
A.8.16 Monitoring activities
Monitoring networks, systems and applications for anomalous behavior and acting on what monitoring finds: scope, baselines, alerting, review and the evidence an auditor expects.
A.8.17 Clock synchronization
Synchronizing system clocks to approved time sources so that logs and events can be correlated across systems, with reference time sources, protocols and checks for drift.
A.8.18 Use of privileged utility programs
Restricting and tightly controlling utility programs that can override system and application controls, with authorization, logging, segregation from applications and removal of unneeded utilities.
A.8.19 Installation of software on operational systems
Securely managing software installation on operational systems: who may install, approved software, testing and rollback before installation, and preventing unauthorized installs by users.
A.8.20 Networks security
Securing, managing and controlling networks and network devices to protect information in systems and applications: network documentation, device hardening, administration and monitoring.
A.8.21 Security of network services
Identifying, implementing and monitoring the security mechanisms, service levels and requirements of network services, whether provided in house or by external providers.
A.8.22 Segregation of networks
Splitting networks into separate domains for groups of services, users and systems, with controlled gateways between them, including wireless and cloud networks.
A.8.23 Web filtering
Managing access to external websites to reduce exposure to malicious content: blocking known-bad and unauthorized sites, filtering rules and user guidance; new in the 2022 revision.
A.8.24 Use of cryptography
Defining and implementing rules for effective use of cryptography, including key management across the key life cycle, choice of algorithms and strength, and legal restrictions on cryptography.
A.8.25 Secure development life cycle
Establishing and applying rules for secure development of software and systems across the life cycle: separated environments, security in each phase, secure repositories and developer competence.
A.8.26 Application security requirements
Identifying, specifying and approving information security requirements when developing or acquiring applications, including applications offered over public networks and transaction services.
A.8.27 Secure system architecture and engineering principles
Establishing, documenting, maintaining and applying principles for engineering secure systems, such as security by design and defense in depth, across all system development activities.
A.8.28 Secure coding
Applying secure coding principles in software development: coding standards, review and testing, and governance of external and open-source components; new in the 2022 revision.
A.8.29 Security testing in development and acceptance
Defining and implementing security testing within the development life cycle, including acceptance testing of new systems, upgrades and new versions against security requirements.
A.8.30 Outsourced development
Directing, monitoring and reviewing outsourced system development: contract terms, secure development requirements, acceptance testing, evidence from the supplier and rights to audit.
A.8.31 Separation of development, test and production environments
Separating and securing development, test and production environments, controlling promotion between them and restricting production access and production data in non-production environments.
A.8.32 Change management
Applying change management procedures to changes in information processing facilities and systems: request, impact assessment, authorization, testing, rollback planning and records.
A.8.33 Test information
Selecting, protecting and managing information used for testing, including limits on copying production or personal data into test environments and deleting it after testing.
A.8.34 Protection of information systems during audit testing
Planning and agreeing audit tests and other assurance activities on operational systems between the tester and management, so that they do not disrupt business processes.
