Information Security Controls

Summary

This document lists the information security controls as specified in Annex A of ISO/IEC 27001:2023. These
controls are intended to support the implementation of the Information Security Management System (ISMS)
within <your company name> and to address information security risks tailored to the needs of the
organization.

Overview Over Information Security Controls

The following table summarizes the controls from Annex A that are applicable to the ISMS. These controls are
grouped by categories as defined in the standard. For more details on each security control, see the
implementation section below this overview table.

Note that you don't have to comply with all controls listed below. Here's what you do instead: For each
control, mark it as applicable (yes or no). If you selected "yes", then add some notes on how you
implemented it in the sections below this table (scroll down). If you selected "no", add a comment in the
"Comment" column on why it's not applicable, and in the "In Compliance?" column, select "n/a".

Implementation Of Information Security Controls

5.1 Policies for information security

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.2 Information security roles and responsibilities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.3 Segregation of duties

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.4 Management responsibilities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.5 Contact with authorities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.6 Contact with special interest groups

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.7 Threat intelligence

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.8 Information security in project management

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.9 Inventory of information and other associated assets

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.10 Acceptable use of information and other associated assets

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.11 Return of assets

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.12 Classification of information

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.13 Labelling of information

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.14 Information transfer

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.15 Access control

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.16 Identity management

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.17 Authentication information

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.18 Access rights

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.19 Information security in supplier relationships

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.20 Addressing information security within supplier agreements

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.21 Managing information security in the ICT supply chain

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.22 Monitoring, review, and change management of supplier services

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.23 Information security for use of cloud services

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.24 Information security incident management planning and preparation

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.25 Assessment and decision on information security events

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.26 Response to information security incidents

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.27 Learning from information security incidents

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.28 Collection of evidence

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.29 Information security during disruption

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.30 ICT readiness for business continuity

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.31 Legal, statutory, regulatory, and contractual requirements

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.32 Intellectual property rights

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.33 Protection of records

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.34 Privacy and protection of personal identifiable information (PII)

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.35 Independent review of information security

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.36 Compliance with policies, rules, and standards for information security

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

5.37 Documented operating procedures

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.1 Background verification checks

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.2 Terms and conditions of employment

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.3 Information security awareness, education, and training

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.4 Disciplinary process

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.5 Responsibilities after termination or change of employment

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.6 Confidentiality or non-disclosure agreements

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.7 Remote working

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

6.8 Information security event reporting

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.1 Physical security perimeters

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.2 Physical entry

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.3 Securing offices, rooms, and facilities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.4 Physical security monitoring

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.5 Protecting against physical and environmental threats

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.6 Working in secure areas

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.7 Clear desk and clear screen

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.8 Equipment siting and protection

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.9 Security of assets off-premises

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.10 Storage media

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.11 Supporting utilities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.12 Cabling security

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.13 Equipment maintenance

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

7.14 Secure disposal or re-use of equipment

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.1 User end point devices

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.2 Privileged access rights

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.3 Information access restriction

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.4 Access to source code

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.5 Secure authentication

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.6 Capacity management

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.7 Protection against malware

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.8 Management of technical vulnerabilities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.9 Configuration management

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.10 Information deletion

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.11 Data masking

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.12 Data leakage prevention

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.13 Information backup

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.14 Redundancy of information processing facilities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.15 Logging

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.16 Monitoring activities

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.17 Clock synchronization

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.18 Use of privileged utility programs

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.19 Installation of software on operational systems

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.20 Networks security

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.21 Security of network services

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.22 Segregation of networks

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.23 Web filtering

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.24 Use of cryptography

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.25 Secure development life cycle

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.26 Application security requirements

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.27 Secure system architecture and engineering principles

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.28 Secure coding

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.29 Security testing in development and acceptance

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.30 Outsourced development

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.31 Separation of development, test and production environments

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.32 Change management

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.33 Test information

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

8.34 Protection of information systems during audit testing

• Assessment: <enter the current state at your company>
• Plan: <describe your plan>
• Implementation:
  • <measure 1>
  • <measure 2>
• Monitoring and review: <describe what you'll do>

Template Copyright openregulatory.com. See template
license.

Please don't remove this notice even if you've modified contents of this template.