| ISO/IEC 27001:2022 Annex A controls | Applied | Control applied/Justification of Inclusion | Justification for exclusion | Responsibility | |
| 5 | Organization control | ||||
| 5.1 | Policies for information security | Yes | Existence of a Policy is a demonstration of management intent, approach to manage ISMS. To be controlled by Annual Review | NA | General Manager |
| 5.2 | Information security roles and responsibilities | Yes | Existence of ISMS organization structure provides defined roles & responsibilities to management staff. To be documented in Organization chart/JD | NA | ISMR |
| 5.3 | Segregation of duties | Yes | Segregation of duties to be done to protect against any kind of fraud. It is to be demonstrated in the organization chart/JD | NA | ISMR |
| 5.4 | Management responsibilities | Yes | This is to ensure all personnel do not misuse the information made available to them for the purpose of operations.It is Part of GM roles, IS policies and Objectives, Training in IS to employees | NA | EM |
| 5.5 | Contact with authorities | Yes | Part of GM and EM Roles to ensure availability of emergency services | NA | ISMR |
| 5.6 | Contact with special interest groups | Yes | Part of IT role to ensure access to latest security information/vulnerabilities | NA | IT department |
| 5.7 | Threat intelligence | Yes | Part of IT role to collect information about existing and emerging threat environment and take appropriate mitigation action | NA | IT department |
| 5.8 | Information security in project management | Yes | Part of PM role to ensure security ‘of, by and for’ projects | NA | PM and IT |
| 5.9 | Inventory of information and other associated assets | Yes | To ensure all informations and assets are identified and reasonable security controls are applies | NA | EM and IT |
| 5.10 | Acceptable use of information and other associated assets | Yes | To ensure all personnel have accountability of secure usage of information and assets | NA | All users |
| 5.11 | Return of assets | Yes | To ensure all assets are returned to the owner | NA | IT department |
| 5.12 | Classification of information | Yes | To provide appropriate level of security sensitivity to the Information/Assets | NA | ISMR |
| 5.13 | Labelling of information | Yes | To ensure labeling of Information/Assets in line with classification | NA | ISMR |
| 5.14 | Information transfer | Yes | To protect information from misuse from information recipients and the medium of information tranfer | NA | PM and IT |
| 5.15 | Access control | Yes | To ensure ‘need to know’ principle in each access to prevent unauthorized access to information and other associated assets. | NA | EM and IT |
| 5.16 | Identity management | Yes | To ensure identification of individuals and systems accessing the organization’s information | NA | EM and IT |
| 5.17 | Authentication information | Yes | To protect sensitive authentication information | NA | IT department |
| 5.18 | Access rights | Yes | to ensure access to information/ assets is defined and authorized | NA | EM and IT |
| 5.19 | Information security in supplier relationships | Yes | To protect organization interest in dealing with vendors | NA | Admin/Accounts |
| 5.20 | Addressing information security within supplier agreements | Yes | To protect organization interest in dealing with vendors | NA | Admin/Accounts |
| 5.21 | Managing information security in the ICT supply chain | Yes | To protect organization interest in dealing with vendors | NA | IT |
| 5.22 | Monitoring, review and change management of supplier services | Yes | To protect organization interest in dealing with vendors | NA | Admin/Accounts |
| 5.23 | Information security for use of cloud services | N/A | NA | Cloud service not in use | |
| 5.24 | Information security incident management planning and preparation | Yes | To ensure incidents are reported and managed | NA | ISMR |
| 5.25 | Assessment and decision on information security events | Yes | To ensure incidents are reported and managed | NA | ISMR |
| 5.26 | Response to information security incidents | Yes | To ensure incidents are reported and managed | NA | ISMR |
| 5.27 | Learning from information security incidents | Yes | To ensure incidents are reported and managed | NA | ISMR |
| 5.28 | Collection of evidence | Yes | To ensure incidents are reported and managed | NA | ISMR |
| 5.29 | Information security during disruption | Yes | To ensure security in crisis | NA | ISMR |
| 5.30 | ICT readiness for business continuity | Yes | To ensure security in crisis | NA | ISMR and IT |
| 5.31 | Legal, statutory, regulatory and contractual requirements | Yes | To protect organization against any legal non compliance from copyright violation | NA | ISMR |
| 5.32 | Intellectual property rights | Yes | To protect organization against any legal non compliance from copyright violation | NA | ISMR |
| 5.33 | Protection of records | Yes | To ensure availability of historical records | NA | ISMR |
| 5.34 | Privacy and protection of PII | Yes | To protect organization against any legal non compliance related to privacy | NA | ISMR |
| 5.35 | Independent review of information security | Yes | To ensure effectivness of the ISMS | NA | ISMR |
| 5.36 | Compliance with policies, rules and standards for information security | Yes | To ensure accountability of managers | NA | ISMR |
| 5.37 | Documented operating procedures | Yes | To ensure processing integrity/process availability | NA | ISMR |
| 6 | People control | ||||
| 6.1 | Screening | Yes | To ensure people joining the organization are free from any criminal background | NA | HR/Admin |
| 6.2 | Terms and conditions of employment | Yes | Ensure all personnel do not misuse the information made available to them for the purpose of operations. | NA | HR/Admin |
| 6.3 | Information security awareness, education and training | Yes | Ensure all personnel do not misuse the information made available to them for the purpose of operations. | NA | HR/Admin |
| 6.4 | Disciplinary process | Yes | To ensure a process of appropriate disciplinary action in case someone is found guilty of information misusage. | NA | EM |
| 6.5 | Responsibilities after termination or change of employment | Yes | Process of termination involves information/access return | NA | HR/Admin |
| 6.6 | Confidentiality or non-disclosure agreements | Yes | To ensure information protection from business partners/employees | NA | EM |
| 6.7 | Remote working | N/A | NA | Remote working not permitted | |
| 6.8 | Information security event reporting | Yes | To ensure security events are reported and managed | All users | |
| 7 | Physical control | ||||
| 7.1 | Physical security perimeters | yes | To ensure physical protection against unauthorized access | NA | EM and IT |
| 7.2 | Physical entry | yes | To ensure physical protection against unauthorized access | NA | EM and IT |
| 7.3 | Securing offices, rooms and facilities | yes | To protect against external and environmental controls | NA | IT |
| 7.4 | Physical security monitoring | yes | To protect against external and environmental controls | NA | Admin |
| 7.5 | Protecting against physical and environmental threats | yes | To protect against external and environmental controls | NA | IT |
| 7.6 | Working in secure areas | yes | To protect against external and environmental controls | NA | EM and IT |
| 7.7 | Clear desk and clear screen | yes | To protect against unauthorized access/shoulder surfing | NA | All users |
| 7.8 | Equipment siting and protection | yes | To protect physical infrastructure | NA | IT/Admin |
| 7.9 | Security of assets off-premises | yes | To protect physical infrastructure | PM | |
| 7.10 | Storage media | yes | To ensure only authorized disclosure, modification, removal or destruction of information on storage media. | NA | IT |
| 7.11 | Supporting utilities | yes | To ensure continuous power availability | NA | IT |
| 7.12 | Cabling security | yes | To ensure protection of telecom and network cables | NA | IT |
| 7.13 | Equipment maintenance | yes | To protect physical infrastructure | NA | IT |
| 7.14 | Secure disposal or re-use of equipment | yes | To ensure longer life of equipment/Environment protection | NA | IT |
| 8 | Technological Controls | ||||
| 8.1 | User endpoint devices | yes | To ensure all information in Endpoint device are secure | NA | IT |
| 8.2 | Privileged access rights | yes | To ensure ‘need to know’ principle in each access by ensuring priviledged access right is restricted. | NA | IT/EM |
| 8.3 | Information access restriction | yes | To ensure ‘need to know’ principle in each access by ensuring priviledged access right is restricted. | NA | IT |
| 8.4 | Access to source code | N/A | NA | Source Code is not maintained by hence this control is not applicable. | |
| 8.5 | Secure authentication | Yes | To protect sensitive authentication information | NA | IT/All users |
| 8.6 | Capacity management | Yes | To ensure high availability of Data storage | NA | IT |
| 8.7 | Protection against malware | Yes | To protect against new malware threats | NA | IT |
| 8.8 | Management of technical vulnerabilities | Yes | To ensure secure operating environment | NA | IT |
| 8.9 | Configuration management | yes | To ensure hardware, software, services and networks function correctly | NA | IT |
| 8.10 | Information deletion | Yes | Information stored in information systems should be deleted when no longer required. | NA | All users |
| 8.11 | Data masking | N/A | NA | Sensitive data not transferred | |
| 8.12 | Data leakage prevention | yes | prevent the unauthorized disclosure and extraction of information by individuals or systems | NA | IT |
| 8.13 | Information backup | Yes | To ensure higher availability of data/associated configuration | NA | IT |
| 8.14 | Redundancy of information processing facilities | Yes | To ensure redundancy in information processing infrastructure minimizing failure | NA | IT |
| 8.15 | Logging | Yes | To ensure accountability and non-repudiation | NA | IT |
| 8.16 | Monitoring activities | Yes | To detect anomalous behaviour for potential security incident | NA | IT |
| 8.17 | Clock synchronization | Yes | To ensure accountability and non-repudiation | NA | IT |
| 8.18 | Use of privileged utility programs | Yes | To protect network from unauthorized access | NA | IT |
| 8.19 | Installation of software on operational systems | Yes | To ensure secure and ligimate software are installed in secure operating environment | NA | IT |
| 8.20 | Networks security | Yes | To ensure protection of networks | NA | IT |
| 8.21 | Security of network services | Yes | To ensure protection of networks | NA | IT |
| 8.22 | Segregation of networks | Yes | To ensure minimal impact of network in case of a security attack | NA | IT |
| 8.23 | Web filtering | yes | prevent access to unauthorized web resources and malware | NA | IT |
| 8.24 | Use of cryptography | N/A | NA | Cryptographic keys are not proceured or generated and their life cycle is not managed | |
| 8.25 | Secure development life cycle | N/A | NA | No software development. | |
| 8.26 | Application security requirements | N/A | NA | No application | |
| 8.27 | Secure system architecture and engineering principles | N/A | NA | No software development. | |
| 8.28 | Secure coding | N/A | NA | No software development. | |
| 8.29 | Security testing in development and acceptance | N/A | NA | No software development. | |
| 8.30 | Outsourced development | N/A | NA | No software development. | |
| 8.31 | Separation of development, test and production environments | N/A | NA | No software development. | |
| 8.32 | Change management | Yes | To ensure control of changes | NA | ISMR |
| 8.33 | Test information | N/A | NA | No software development. | |
| 8.34 | Protection of information systems during audit testing | Yes | To ensure accountability and non-repudiation | NA | ISMR |
Back to Home Page
If you need assistance or have any doubt and need to ask any questions contact me at preteshbiswas@gmail.com. You can also contribute to this discussion and I shall be happy to publish them. Your comments and suggestion are also welcome.
Hello Ji, Shall I get SOA for ISO27001:2022 excel sheet also Risk Assessment Excel sheet too. Kindly do the needful. Your all the ISO content so useful for all. Thanks. Kindly help me
Dear you will have to pay USD $100 for the same