# Information Security Controls

Author: Dr. Oliver Eidel
Published: 2024-05-24
Updated: 2024-05-24
Source: https://openregulatory.com/document_templates/information-security-controls

---

Information Security Controls
ISO 27001:2023 Section	Document Section	
6.1.3	(All)	
Annex A (normative) Information security controls reference	(All)	
Summary
This document lists the information security controls as specified in Annex A of ISO/IEC 27001:2023. These
controls are intended to support the implementation of the Information Security Management System (ISMS)
within <your company name> and to address information security risks tailored to the needs of the
organization.
Overview Over Information Security Controls
The following table summarizes the controls from Annex A that are applicable to the ISMS. These controls are
grouped by categories as defined in the standard. For more details on each security control, see the
implementation section below this overview table.
Note that you don't have to comply with all controls listed below. Here's what you do instead: For each
control, mark it as applicable (yes or no). If you selected "yes", then add some notes on how you
implemented it in the sections below this table (scroll down). If you selected "no", add a comment in the
"Comment" column on why it's not applicable, and in the "In Compliance?" column, select "n/a".
Section	Control Category	Control Title	Applicable?	In Compliance?	Comment	
5.1	Organizational	Policies for information security	yes / no	yes / no / n/a		
5.2	Organizational	Information security roles and responsibilities				
5.3	Organizational	Segregation of duties				
5.4	Organizational	Management responsibilities				
5.5	Organizational	Contact with authorities				
5.6	Organizational	Contact with special interest groups				
5.7	Organizational	Threat intelligence				
5.8	Organizational	Information security in project management				
5.9	Organizational	Inventory of information and other associated assets				
5.10	Organizational	Acceptable use of information and other associated assets				
5.11	Organizational	Return of assets				
5.12	Organizational	Classification of information				
5.13	Organizational	Labelling of information				
5.14	Organizational	Information transfer				
5.15	Organizational	Access control				
5.16	Organizational	Identity management				
5.17	Organizational	Authentication information				
5.18	Organizational	Access rights				
5.19	Organizational	Information security in supplier relationships				
5.20	Organizational	Addressing information security within supplier agreements				
5.21	Organizational	Managing information security in the ICT supply chain				
5.22	Organizational	Monitoring, review, and change management of supplier services				
5.23	Organizational	Information security for use of cloud services				
5.24	Organizational	Information security incident management planning and preparation				
5.25	Organizational	Assessment and decision on information security events				
5.26	Organizational	Response to information security incidents				
5.27	Organizational	Learning from information security incidents				
5.28	Organizational	Collection of evidence				
5.29	Organizational	Information security during disruption				
5.30	Organizational	ICT readiness for business continuity				
5.31	Organizational	Legal, statutory, regulatory, and contractual requirements				
5.32	Organizational	Intellectual property rights				
5.33	Organizational	Protection of records				
5.34	Organizational	Privacy and protection of personal identifiable information (PII)				
5.35	Organizational	Independent review of information security				
5.36	Organizational	Compliance with policies, rules, and standards for information security				
5.37	Organizational	Documented operating procedures				
6.1	People	Background verification checks				
6.2	People	Terms and conditions of employment				
6.3	People	Information security awareness, education, and training				
6.4	People	Disciplinary process				
6.5	People	Responsibilities after termination or change of employment				
6.6	People	Confidentiality or non-disclosure agreements				
6.7	People	Remote working				
6.8	People	Information security event reporting				
7.1	Physical	Physical security perimeters				
7.2	Physical	Physical entry				
7.3	Physical	Securing offices, rooms, and facilities				
7.4	Physical	Physical security monitoring				
7.5	Physical	Protecting against physical and environmental threats				
7.6	Physical	Working in secure areas				
7.7	Physical	Clear desk and clear screen				
7.8	Physical	Equipment siting and protection				
7.9	Physical	Security of assets off-premises				
7.10	Physical	Storage media				
7.11	Physical	Supporting utilities				
7.12	Physical	Cabling security				
7.13	Physical	Equipment maintenance				
7.14	Physical	Secure disposal or re-use of equipment				
8.1	Technological	User end point devices				
8.2	Technological	Privileged access rights				
8.3	Technological	Information access restriction				
8.4	Technological	Access to source code				
8.5	Technological	Secure authentication				
8.6	Technological	Capacity management				
8.7	Technological	Protection against malware				
8.8	Technological	Management of technical vulnerabilities				
8.9	Technological	Configuration management				
8.10	Technological	Information deletion				
8.11	Technological	Data masking				
8.12	Technological	Data leakage prevention				
8.13	Technological	Information backup				
8.14	Technological	Redundancy of information processing facilities				
8.15	Technological	Logging				
8.16	Technological	Monitoring activities				
8.17	Technological	Clock synchronization				
8.18	Technological	Use of privileged utility programs				
8.19	Technological	Installation of software on operational systems				
8.20	Technological	Networks security				
8.21	Technological	Security of network services				
8.22	Technological	Segregation of networks				
8.23	Technological	Web filtering				
8.24	Technological	Use of cryptography				
8.25	Technological	Secure development life cycle				
8.26	Technological	Application security requirements				
8.27	Technological	Secure system architecture and engineering principles				
8.28	Technological	Secure coding				
8.29	Technological	Security testing in development and acceptance				
8.30	Technological	Outsourced development				
8.31	Technological	Separation of development, test and production environments				
8.32	Technological	Change management				
8.33	Technological	Test information				
8.34	Technological	Protection of information systems during audit testing				
Implementation Of Information Security Controls
5.1 Policies for information security
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.2 Information security roles and responsibilities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.3 Segregation of duties
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.4 Management responsibilities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.5 Contact with authorities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.6 Contact with special interest groups
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.7 Threat intelligence
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.8 Information security in project management
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.9 Inventory of information and other associated assets
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.10 Acceptable use of information and other associated assets
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.11 Return of assets
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.12 Classification of information
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.13 Labelling of information
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.14 Information transfer
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.15 Access control
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.16 Identity management
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.17 Authentication information
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.18 Access rights
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.19 Information security in supplier relationships
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.20 Addressing information security within supplier agreements
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.21 Managing information security in the ICT supply chain
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.22 Monitoring, review, and change management of supplier services
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.23 Information security for use of cloud services
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.24 Information security incident management planning and preparation
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.25 Assessment and decision on information security events
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.26 Response to information security incidents
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.27 Learning from information security incidents
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.28 Collection of evidence
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.29 Information security during disruption
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.30 ICT readiness for business continuity
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.31 Legal, statutory, regulatory, and contractual requirements
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.32 Intellectual property rights
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.33 Protection of records
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.34 Privacy and protection of personal identifiable information (PII)
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.35 Independent review of information security
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.36 Compliance with policies, rules, and standards for information security
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
5.37 Documented operating procedures
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.1 Background verification checks
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.2 Terms and conditions of employment
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.3 Information security awareness, education, and training
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.4 Disciplinary process
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.5 Responsibilities after termination or change of employment
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.6 Confidentiality or non-disclosure agreements
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.7 Remote working
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
6.8 Information security event reporting
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.1 Physical security perimeters
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.2 Physical entry
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.3 Securing offices, rooms, and facilities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.4 Physical security monitoring
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.5 Protecting against physical and environmental threats
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.6 Working in secure areas
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.7 Clear desk and clear screen
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.8 Equipment siting and protection
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.9 Security of assets off-premises
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.10 Storage media
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.11 Supporting utilities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.12 Cabling security
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.13 Equipment maintenance
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
7.14 Secure disposal or re-use of equipment
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.1 User end point devices
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.2 Privileged access rights
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.3 Information access restriction
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.4 Access to source code
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.5 Secure authentication
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.6 Capacity management
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.7 Protection against malware
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.8 Management of technical vulnerabilities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.9 Configuration management
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.10 Information deletion
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.11 Data masking
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.12 Data leakage prevention
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.13 Information backup
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.14 Redundancy of information processing facilities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.15 Logging
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.16 Monitoring activities
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.17 Clock synchronization
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.18 Use of privileged utility programs
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.19 Installation of software on operational systems
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.20 Networks security
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.21 Security of network services
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.22 Segregation of networks
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.23 Web filtering
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.24 Use of cryptography
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.25 Secure development life cycle
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.26 Application security requirements
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.27 Secure system architecture and engineering principles
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.28 Secure coding
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.29 Security testing in development and acceptance
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.30 Outsourced development
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.31 Separation of development, test and production environments
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.32 Change management
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.33 Test information
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
8.34 Protection of information systems during audit testing
Assessment: <enter the current state at your company>
Plan: <describe your plan>
Implementation:
<measure 1>
<measure 2>
Monitoring and review: <describe what you'll do>
Template Copyright openregulatory.com (https://openregulatory.com). See template
license (https://openregulatory.com/template-license).
Please don't remove this notice even if you've modified contents of this template.