499 lines
12 KiB
JSON
499 lines
12 KiB
JSON
{
|
|
"id": "ISO/IEC 27001:2022",
|
|
"name": "ISO 27001 (2022)",
|
|
"controls": [
|
|
{
|
|
"id": "4.1",
|
|
"name": "Context of the organization - Understanding the organization and its context"
|
|
},
|
|
{
|
|
"id": "4.2",
|
|
"name": "Context of the organization - Understanding the needs of interested parties"
|
|
},
|
|
{
|
|
"id": "4.3",
|
|
"name": "Context of the organization - Determining the scope of the information security management system"
|
|
},
|
|
{
|
|
"id": "4.4",
|
|
"name": "Context of the organization - Information security management system"
|
|
},
|
|
{
|
|
"id": "5.1",
|
|
"name": "Leadership - Leadership and commitment"
|
|
},
|
|
{
|
|
"id": "5.2",
|
|
"name": "Leadership - Policy"
|
|
},
|
|
{
|
|
"id": "5.3",
|
|
"name": "Leadership - Organizational roles, responsibilities and authorities"
|
|
},
|
|
{
|
|
"id": "6.1.1",
|
|
"name": "Planning - General actions to address risks and opportunities"
|
|
},
|
|
{
|
|
"id": "6.1.2",
|
|
"name": "Planning - Information security risk assessment"
|
|
},
|
|
{
|
|
"id": "6.1.3",
|
|
"name": "Planning - Information security risk treatment"
|
|
},
|
|
{
|
|
"id": "6.2",
|
|
"name": "Planning - Information security objective and planning to achieve them"
|
|
},
|
|
{
|
|
"id": "6.3",
|
|
"name": "Planning - Planning of Changes"
|
|
},
|
|
{
|
|
"id": "7.1",
|
|
"name": "Support - Resources"
|
|
},
|
|
{
|
|
"id": "7.2",
|
|
"name": "Support - Competence"
|
|
},
|
|
{
|
|
"id": "7.3",
|
|
"name": "Support - Awareness"
|
|
},
|
|
{
|
|
"id": "7.4",
|
|
"name": "Support - Communication"
|
|
},
|
|
{
|
|
"id": "7.5.1",
|
|
"name": "Support - Documented information"
|
|
},
|
|
{
|
|
"id": "7.5.2",
|
|
"name": "Support - Creating and Updating"
|
|
},
|
|
{
|
|
"id": "7.5.3",
|
|
"name": "Support - Control of documented information"
|
|
},
|
|
{
|
|
"id": "8.1",
|
|
"name": "Operation - Operation planning and control"
|
|
},
|
|
{
|
|
"id": "8.2",
|
|
"name": "Operation - Information security risk assessment"
|
|
},
|
|
{
|
|
"id": "8.3",
|
|
"name": "Operation - Information security risk treatment"
|
|
},
|
|
{
|
|
"id": "9.1",
|
|
"name": "Performance evaluation - Monitoring, measurement, analysis, and evaluation"
|
|
},
|
|
{
|
|
"id": "9.2.1",
|
|
"name": "Performance evaluation - Internal Audit - General"
|
|
},
|
|
{
|
|
"id": "9.2.2",
|
|
"name": "Performance evaluation - Internal Audit Program"
|
|
},
|
|
{
|
|
"id": "9.3.1",
|
|
"name": "Performance evaluation - Management review - General"
|
|
},
|
|
{
|
|
"id": "9.3.2",
|
|
"name": "Performance evaluation - Management review inputs"
|
|
},
|
|
{
|
|
"id": "9.3.3",
|
|
"name": "Performance evaluation - Management review results"
|
|
},
|
|
{
|
|
"id": "10.1",
|
|
"name": "Improvement - Continual Improvement"
|
|
},
|
|
{
|
|
"id": "10.2",
|
|
"name": "Improvement - Nonconformity and corrective action"
|
|
},
|
|
{
|
|
"id": "A.5.1",
|
|
"name": "Organizational - Policies for information security"
|
|
},
|
|
{
|
|
"id": "A.5.2",
|
|
"name": "Organizational - Information security roles and responsibilities"
|
|
},
|
|
{
|
|
"id": "A.5.3",
|
|
"name": "Organizational - Segregation of duties"
|
|
},
|
|
{
|
|
"id": "A.5.4",
|
|
"name": "Organizational - Management responsibilities"
|
|
},
|
|
{
|
|
"id": "A.5.5",
|
|
"name": "Organizational - Contact with authorities"
|
|
},
|
|
{
|
|
"id": "A.5.6",
|
|
"name": "Organizational - Contact with special interest groups"
|
|
},
|
|
{
|
|
"id": "A.5.7",
|
|
"name": "Organizational - Threat Intelligence"
|
|
},
|
|
{
|
|
"id": "A.5.8",
|
|
"name": "Organizational - Information security in project management"
|
|
},
|
|
{
|
|
"id": "A.5.9",
|
|
"name": "Organizational - Inventory of information and other associated assets"
|
|
},
|
|
{
|
|
"id": "A.5.10",
|
|
"name": "Organizational - Acceptable use of information and other associated assets"
|
|
},
|
|
{
|
|
"id": "A.5.11",
|
|
"name": "Organizational - Return of assets"
|
|
},
|
|
{
|
|
"id": "A.5.12",
|
|
"name": "Organizational - Classification of information"
|
|
},
|
|
{
|
|
"id": "A.5.13",
|
|
"name": "Organizational - Labelling of information"
|
|
},
|
|
{
|
|
"id": "A.5.14",
|
|
"name": "Organizational - Information transfer"
|
|
},
|
|
{
|
|
"id": "A.5.15",
|
|
"name": "Organizational - Access control"
|
|
},
|
|
{
|
|
"id": "A.5.16",
|
|
"name": "Organizational - Identity management"
|
|
},
|
|
{
|
|
"id": "A.5.17",
|
|
"name": "Organizational - Authentication information"
|
|
},
|
|
{
|
|
"id": "A.5.18",
|
|
"name": "Organizational - Access rights"
|
|
},
|
|
{
|
|
"id": "A.5.19",
|
|
"name": "Organizational - Information security in supplier relationships"
|
|
},
|
|
{
|
|
"id": "A.5.20",
|
|
"name": "Organizational - Addressing information security within supplier agreements"
|
|
},
|
|
{
|
|
"id": "A.5.21",
|
|
"name": "Organizational - Managing information security in the ICT supply chain"
|
|
},
|
|
{
|
|
"id": "A.5.22",
|
|
"name": "Organizational - Monitoring, review and change management of supplier services"
|
|
},
|
|
{
|
|
"id": "A.5.23",
|
|
"name": "Organizational - Information security for use of cloud services"
|
|
},
|
|
{
|
|
"id": "A.5.24",
|
|
"name": "Organizational - Information security incident management planning and preparation"
|
|
},
|
|
{
|
|
"id": "A.5.25",
|
|
"name": "Organizational - Assessment and decision on information security events"
|
|
},
|
|
{
|
|
"id": "A.5.26",
|
|
"name": "Organizational - Response to information security incidents"
|
|
},
|
|
{
|
|
"id": "A.5.27",
|
|
"name": "Organizational - Learning from information security incidents"
|
|
},
|
|
{
|
|
"id": "A.5.28",
|
|
"name": "Organizational - Collection of evidence"
|
|
},
|
|
{
|
|
"id": "A.5.29",
|
|
"name": "Organizational - Information security during disruption"
|
|
},
|
|
{
|
|
"id": "A.5.30",
|
|
"name": "Organizational - ICT readiness for business continuity"
|
|
},
|
|
{
|
|
"id": "A.5.31",
|
|
"name": "Organizational - Legal, statutory, regulatory and contractual requirements"
|
|
},
|
|
{
|
|
"id": "A.5.32",
|
|
"name": "Organizational - Intellectual property rights"
|
|
},
|
|
{
|
|
"id": "A.5.33",
|
|
"name": "Organizational - Protection of records"
|
|
},
|
|
{
|
|
"id": "A.5.34",
|
|
"name": "Organizational - Privacy and protection of PII"
|
|
},
|
|
{
|
|
"id": "A.5.35",
|
|
"name": "Organizational - Independent review of information security"
|
|
},
|
|
{
|
|
"id": "A.5.36",
|
|
"name": "Organizational - Compliance with policies, rules and standards for information security"
|
|
},
|
|
{
|
|
"id": "A.5.37",
|
|
"name": "Organizational - Documented operating procedures"
|
|
},
|
|
{
|
|
"id": "A.6.1",
|
|
"name": "People - Screening"
|
|
},
|
|
{
|
|
"id": "A.6.2",
|
|
"name": "People - Terms and conditions of employment"
|
|
},
|
|
{
|
|
"id": "A.6.3",
|
|
"name": "People - Information security awareness, education and training"
|
|
},
|
|
{
|
|
"id": "A.6.4",
|
|
"name": "People - Disciplinary process"
|
|
},
|
|
{
|
|
"id": "A.6.5",
|
|
"name": "People - Responsibilities after termination or change of employment"
|
|
},
|
|
{
|
|
"id": "A.6.6",
|
|
"name": "People - Confidentiality or non-disclosure agreements"
|
|
},
|
|
{
|
|
"id": "A.6.7",
|
|
"name": "People - Remote working"
|
|
},
|
|
{
|
|
"id": "A.6.8",
|
|
"name": "People - Information security event reporting"
|
|
},
|
|
{
|
|
"id": "A.7.1",
|
|
"name": "Physical - Physical security perimeters"
|
|
},
|
|
{
|
|
"id": "A.7.2",
|
|
"name": "Physical - Physical entry"
|
|
},
|
|
{
|
|
"id": "A.7.3",
|
|
"name": "Physical - Securing offices, rooms and facilities"
|
|
},
|
|
{
|
|
"id": "A.7.4",
|
|
"name": "Physical - Physical security monitoring"
|
|
},
|
|
{
|
|
"id": "A.7.5",
|
|
"name": "Physical - Protecting against physical and environmental threats"
|
|
},
|
|
{
|
|
"id": "A.7.6",
|
|
"name": "Physical - Working in secure areas"
|
|
},
|
|
{
|
|
"id": "A.7.7",
|
|
"name": "Physical - Clear desk and clear screen"
|
|
},
|
|
{
|
|
"id": "A.7.8",
|
|
"name": "Physical - Equipment siting and protection"
|
|
},
|
|
{
|
|
"id": "A.7.9",
|
|
"name": "Physical - Security of assets off-premises"
|
|
},
|
|
{
|
|
"id": "A.7.10",
|
|
"name": "Physical - Storage media"
|
|
},
|
|
{
|
|
"id": "A.7.11",
|
|
"name": "Physical - Supporting utilities"
|
|
},
|
|
{
|
|
"id": "A.7.12",
|
|
"name": "Physical - Cabling security"
|
|
},
|
|
{
|
|
"id": "A.7.13",
|
|
"name": "Physical - Equipment maintenance"
|
|
},
|
|
{
|
|
"id": "A.7.14",
|
|
"name": "Physical - Secure disposal or re-use of equipment"
|
|
},
|
|
{
|
|
"id": "A.8.1",
|
|
"name": "Technological - User endpoint devices"
|
|
},
|
|
{
|
|
"id": "A.8.2",
|
|
"name": "Technological - Privileged access rights"
|
|
},
|
|
{
|
|
"id": "A.8.3",
|
|
"name": "Technological - Information access restriction"
|
|
},
|
|
{
|
|
"id": "A.8.4",
|
|
"name": "Technological - Access to source code"
|
|
},
|
|
{
|
|
"id": "A.8.5",
|
|
"name": "Technological - Secure authentication"
|
|
},
|
|
{
|
|
"id": "A.8.6",
|
|
"name": "Technological - Capacity management"
|
|
},
|
|
{
|
|
"id": "A.8.7",
|
|
"name": "Technological - Protection against malware"
|
|
},
|
|
{
|
|
"id": "A.8.8",
|
|
"name": "Technological - Management of technical vulnerabilities"
|
|
},
|
|
{
|
|
"id": "A.8.9",
|
|
"name": "Technological - Configuration management"
|
|
},
|
|
{
|
|
"id": "A.8.10",
|
|
"name": "Technological - Information deletion"
|
|
},
|
|
{
|
|
"id": "A.8.11",
|
|
"name": "Technological - Data masking"
|
|
},
|
|
{
|
|
"id": "A.8.12",
|
|
"name": "Technological - Data leakage prevention"
|
|
},
|
|
{
|
|
"id": "A.8.13",
|
|
"name": "Technological - Information backup"
|
|
},
|
|
{
|
|
"id": "A.8.14",
|
|
"name": "Technological - Redundancy of information processing facilities"
|
|
},
|
|
{
|
|
"id": "A.8.15",
|
|
"name": "Technological - Logging"
|
|
},
|
|
{
|
|
"id": "A.8.16",
|
|
"name": "Technological - Monitoring activities"
|
|
},
|
|
{
|
|
"id": "A.8.17",
|
|
"name": "Technological - Clock synchronization"
|
|
},
|
|
{
|
|
"id": "A.8.18",
|
|
"name": "Technological - Use of privileged utility programs"
|
|
},
|
|
{
|
|
"id": "A.8.19",
|
|
"name": "Technological - Installation of software on operational systems"
|
|
},
|
|
{
|
|
"id": "A.8.20",
|
|
"name": "Technological - Networks security"
|
|
},
|
|
{
|
|
"id": "A.8.21",
|
|
"name": "Technological - Security of network services"
|
|
},
|
|
{
|
|
"id": "A.8.22",
|
|
"name": "Technological - Segregation of networks"
|
|
},
|
|
{
|
|
"id": "A.8.23",
|
|
"name": "Technological - Web filtering"
|
|
},
|
|
{
|
|
"id": "A.8.24",
|
|
"name": "Technological - Use of cryptography"
|
|
},
|
|
{
|
|
"id": "A.8.25",
|
|
"name": "Technological - Secure development life cycle"
|
|
},
|
|
{
|
|
"id": "A.8.26",
|
|
"name": "Technological - Application security requirements"
|
|
},
|
|
{
|
|
"id": "A.8.27",
|
|
"name": "Technological - Secure system architecture and engineering principles"
|
|
},
|
|
{
|
|
"id": "A.8.28",
|
|
"name": "Technological - Secure coding"
|
|
},
|
|
{
|
|
"id": "A.8.29",
|
|
"name": "Technological - Security testing in development and acceptance"
|
|
},
|
|
{
|
|
"id": "A.8.30",
|
|
"name": "Technological - Outsourced development"
|
|
},
|
|
{
|
|
"id": "A.8.31",
|
|
"name": "Technological - Separation of development, test and production environments"
|
|
},
|
|
{
|
|
"id": "A.8.32",
|
|
"name": "Technological - Change management"
|
|
},
|
|
{
|
|
"id": "A.8.33",
|
|
"name": "Technological - Test information"
|
|
},
|
|
{
|
|
"id": "A.8.34",
|
|
"name": "Technological - Protection of information systems during audit testing"
|
|
}
|
|
]
|
|
}
|