ISO27001 ISMS KB - Start Here
This knowledge base contains expanded study notes for ISO/IEC 27001 and ISO/IEC 27002.
Research Archive
802 published notes organized across 26 sections and 54 subsections.
Section
Overview
1 notes across 1 subsections
Research Notes
1 notesSection
Fundamentals
15 notes across 2 subsections
Framework Notes
2 notesAnnex A and the Statement of Applicability
Annex A is a reference set of information security controls. The organization uses it to make sure it has not overlooked relevant controls when treating risks.
ISO 27001 Clauses 4-10 vs Annex A
1. Clauses 4-10 — mandatory ISMS management-system requirements. 2. Annex A controls — a reference set of information security controls used for risk treatment and the Statement...
Research Notes
13 notesAccess Control
Access control is the set of rules and mechanisms used to decide who can access information and systems, what they can do, and how that access is approved, changed, reviewed, an...
Control Attributes and Risk Treatment Effects
Control attributes are useful only if they help link a control to the risk treatment outcome you need.
Field of Application, Usage, and Compliance
This topic explains who the guide is for, how ISO/IEC 27001 and ISO/IEC 27002 relate to each other, and what it means to claim compliance with ISO/IEC 27001.
Information Security Management System
An Information Security Management System is the structured set of policies, processes, roles, risks, controls, evidence, audits, management reviews, and improvement activities...
Information Security Policy
An information security policy is management's approved statement of what the organization expects for protecting information. It sets direction, assigns high-level expectations...
Internal Audit
Internal audit checks whether the ISMS conforms to ISO/IEC 27001 requirements, the organization's own requirements, and whether it is effectively implemented and maintained.
ISO27002 Control Attributes
A control is the actual safeguard. An attribute is a label describing the safeguard.
Management Responsibilities
Management responsibilities means managers must make sure people follow the organization's information security policies, procedures, and role expectations. The security team ca...
Management Review
Management review is the formal process where top management reviews ISMS performance, suitability, adequacy, and effectiveness.
Risk Assessment
Risk assessment identifies, analyzes, and evaluates information security risks so the organization can decide how to treat them.
Roles and Responsibilities
Roles and responsibilities define who is accountable for information security activities, who performs them, who approves them, and who must be consulted or informed.
Segregation of Duties
Segregation of duties means sensitive work should be split so one person cannot request, approve, perform, and review the same activity without independent control.
Statement of Applicability
The Statement of Applicability, usually called the SoA, is the ISO/IEC 27001 control decision record.
Section
ISO 27001
7 notes across 1 subsections
Clauses
7 notesISO 27001 Clause 10 - Improvement
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
ISO 27001 Clause 4 - Context of the Organization
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
ISO 27001 Clause 5 - Leadership
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
ISO 27001 Clause 6 - Planning
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
ISO 27001 Clause 7 - Support
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
ISO 27001 Clause 8 - Operation
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
ISO 27001 Clause 9 - Performance Evaluation
Placeholder clause card for Dataview tracking. Expand this when clause-specific study material is added.
Section
Annex A Organizational Controls
39 notes across 2 subsections
Maps of Content
1 notesA.5 Organizational Controls MOC
Organizational controls establish governance, accountability, policy, process, and oversight for the ISMS.
Controls
38 notesA.5.2 vs A.5.4 Comparison
Research note.
ISO 27001 A.5.1 - Policies for Information Security
Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant...
ISO 27001 A.5.10 - Acceptable Use of Information and Other Associated Assets
People must know how they are allowed to use organizational information and assets, and how they must handle information based on sensitivity and classification.
ISO 27001 A.5.11 - Return of Assets
When someone leaves, changes role, ends a contract, or no longer needs an asset, the organization must get its assets back and ensure organizational information is returned or s...
ISO 27001 A.5.12 - Classification of Information
Information must be grouped by protection need so people know how carefully to handle it.
ISO 27001 A.5.13 - Labelling of Information
If information is classified, people need a practical way to see or infer the classification so they can handle it correctly.
ISO 27001 A.5.14 - Information Transfer
The organization must define how information can be transferred safely, both internally and externally.
ISO 27001 A.5.15 - Access Control
The organization must define and enforce rules for who can access information, systems, services, networks, applications, repositories, and physical locations.
ISO 27001 A.5.16 - Identity Management
Every user identity should be created, changed, reviewed, disabled, and removed through a controlled process.
ISO 27001 A.5.17 - Authentication Information
The organization must control how secret authentication information is issued, changed, protected, reset, and handled.
ISO 27001 A.5.18 - Access Rights
Access rights must be granted, changed, reviewed, and removed through a controlled process.
ISO 27001 A.5.19 - Information Security in Supplier Relationships
The organization must manage information security risks created by suppliers, supplier products, and supplier services.
ISO 27001 A.5.2 - Information Security Roles and Responsibilities
Information security roles and responsibilities must be defined and allocated according to organizational needs.
ISO 27001 A.5.20 - Addressing Information Security Within Supplier Agreements
The organization must put the right security requirements into supplier contracts or agreements before the supplier receives access to information, systems, facilities, or servi...
ISO 27001 A.5.21 - Managing Information Security in the ICT Supply Chain
The organization must manage security risks that come through ICT suppliers and the suppliers behind those suppliers.
ISO 27001 A.5.22 - Monitoring, Review and Change Management of Supplier Services
Supplier security does not end when the contract is signed. The organization must keep checking whether the supplier is delivering the agreed service securely, whether controls...
ISO 27001 A.5.23 - Information Security for Use of Cloud Services
Cloud services must be governed from selection to exit. The organization needs defined processes for buying, configuring, using, monitoring, changing, and leaving cloud services...
ISO 27001 A.5.24 - Information Security Incident Management Planning and Preparation
The organization must prepare before incidents happen. It needs defined and communicated incident management processes, roles, responsibilities, escalation paths, and recovery c...
ISO 27001 A.5.25 - Assessment and Decision on Information Security Events
The organization must review reported security events and make a clear, recorded decision: is this just an event, or is it an information security incident that needs formal res...
ISO 27001 A.5.26 - Response to Information Security Incidents
Once an event is categorized as an incident, the organization must respond using documented procedures rather than improvising.
ISO 27001 A.5.27 - Learning from Information Security Incidents
The organization must turn incident experience into better controls, procedures, awareness, risk treatment, and response capability.
ISO 27001 A.5.28 - Collection of Evidence
The organization must know how to identify, collect, acquire, preserve, store, and protect evidence related to security events so it remains complete, reliable, and usable.
ISO 27001 A.5.29 - Information Security During Disruption
The organization must decide in advance how information security will be maintained during serious disruption, crisis, disaster recovery, or business continuity events.
ISO 27001 A.5.3 - Segregation of Duties
No single person should be able to perform a sensitive activity from beginning to end without independent oversight, approval, review, or control.
ISO 27001 A.5.30 - ICT Readiness for Business Continuity
The organization must plan, build, maintain, and test ICT continuity capability so priority systems and services can recover in line with business continuity objectives.
ISO 27001 A.5.31 - Legal, Statutory, Regulatory and Contractual Requirements
The organization must know which legal, statutory, regulatory, and contractual information security requirements apply, document them, keep them current, and define how it will...
ISO 27001 A.5.32 - Intellectual Property Rights
The organization must have procedures that prevent unauthorized use, copying, distribution, modification, or licensing misuse of software, documents, designs, source code, trade...
ISO 27001 A.5.33 - Protection of Records
The organization must protect required records for as long as they need to be retained, so they are not lost, destroyed, falsified, accessed without authorization, or released w...
ISO 27001 A.5.34 - Privacy and Protection of PII
The organization must identify privacy and PII protection requirements that apply to the personal information it collects, stores, processes, transmits, shares, or retains, then...
ISO 27001 A.5.35 - Independent Review of Information Security
The organization must have its information security management approach and actual implementation independently reviewed at planned intervals and when significant changes happen.
ISO 27001 A.5.36 - Compliance with Policies, Rules and Standards for Information Security
The organization must regularly check whether people, processes, and systems comply with its information security policies, rules, standards, and technical implementation requir...
ISO 27001 A.5.37 - Documented Operating Procedures
The organization must document operating procedures for information processing facilities and make the current approved procedures available to the people who need to use them.
ISO 27001 A.5.4 - Management Responsibilities
Management must require all personnel to apply information security in accordance with the organization's information security policy, topic-specific policies, and procedures.
ISO 27001 A.5.5 - Contact with Authorities
The organization must know which external authorities matter for information security and must maintain usable contact paths before an incident, investigation, regulatory reques...
ISO 27001 A.5.6 - Contact with Special Interest Groups
The organization should stay connected to credible external security knowledge sources. Security teams should not rely only on internal experience, vendor marketing, or outdated...
ISO 27001 A.5.7 - Threat Intelligence
The organization must collect threat information, analyze it in context, and turn it into usable intelligence for decisions.
ISO 27001 A.5.8 - Information Security in Project Management
Projects must handle information security from the start, not as a late review before go-live.
ISO 27001 A.5.9 - Inventory of Information and Other Associated Assets
The organization must know what information and related assets it has, where they are, who owns them, how important they are, and how they are protected.
Section
Annex A People Controls
9 notes across 2 subsections
Maps of Content
1 notesA.6 People Controls MOC
A.5 is mostly governance and organizational control design. A.6 is about personnel trust and behavior. In an audit, A.6 evidence usually comes from HR, recruitment, line managem...
Controls
8 notesISO 27001 A.6.1 - Screening
The organization should check that people are who they claim to be, have the relevant background for the role, and do not present unmanaged personnel risk before they join or re...
ISO 27001 A.6.2 - Terms and Conditions of Employment
People should not have to guess what they are responsible for. Employment contracts, contractor agreements, confidentiality agreements, onboarding acknowledgements, or security...
ISO 27001 A.6.3 - Information Security Awareness, Education and Training
People need to know how to behave securely in their actual role. Everyone needs baseline awareness, but people with specific responsibilities need deeper training that matches t...
ISO 27001 A.6.4 - Disciplinary Process
The organization needs a documented and communicated process for handling information security policy violations. People should know that violations can lead to action, and mana...
ISO 27001 A.6.5 - Responsibilities After Termination or Change of Employment
When someone leaves the organization or changes role, their old access, assets, and responsibilities must be handled deliberately. Some rights should stop immediately. Some duti...
ISO 27001 A.6.6 - Confidentiality or Non-Disclosure Agreements
The organization should know when confidentiality or non-disclosure agreements are needed, use terms that match its information-protection needs, keep those agreements legally u...
ISO 27001 A.6.7 - Remote Working
When people work away from organization premises, the organization still has to protect information. That includes homes, hotels, coffee shops, customer sites, temporary offices...
ISO 27001 A.6.8 - Information Security Event Reporting
People need to know what might be a security event, how to report it, who to report it to, and what not to do. Reporting should be fast, simple, and no-blame enough that people...
Section
Exam Prep
3 notes across 1 subsections
Exam Notes
3 notesCommon Exam Traps
Research note.
Exam Cues
- approved; - communicated; - acknowledged; - reviewed; - version controlled; - management commitment; - topic-specific; - relevant personnel and interested parties.
Quiz Review - Control Attributes and Compliance
Annex A is not a mandatory checklist for every organization. It is a reference set of controls used to help the organization check whether it has overlooked relevant risks or co...
Section
Annex A Physical Controls
15 notes across 2 subsections
Maps of Content
1 notesA.7 Physical Controls MOC
A.5 defines organizational governance and A.6 defines people behavior and personnel lifecycle controls. A.7 tests whether the physical environment supports those decisions. The...
Controls
14 notesISO 27001 A.7.1 - Physical Security Perimeters
The organization should know which physical areas need protection and where the boundaries are. A perimeter can be a building boundary, floor, room, cage, cabinet, loading area,...
ISO 27001 A.7.10 - Storage Media
The organization should control storage media from the moment it is obtained until it is erased, destroyed, disposed of, or transferred. Media includes digital and physical carr...
ISO 27001 A.7.11 - Supporting Utilities
Information processing facilities need supporting utilities to operate. Electricity, cooling, ventilation, telecommunications, water, fire protection, emergency lighting, and bu...
ISO 27001 A.7.12 - Cabling Security
Cables are part of the information processing environment. If they are badly routed, unprotected, mixed incorrectly, poorly labelled, or accessible to unauthorized people, they...
ISO 27001 A.7.13 - Equipment Maintenance
Equipment that runs reliably today can still fail tomorrow. The organization should define maintenance needs, follow supplier recommendations, use authorized maintainers, keep m...
ISO 27001 A.7.14 - Secure Disposal or Re-Use of Equipment
Before equipment is reused, sold, returned, repaired, donated, recycled, or discarded, the organization should verify that sensitive information and licensed software are no lon...
ISO 27001 A.7.2 - Physical Entry
If an area is secure, entry should be controlled. The organization should know who is allowed in, how entry is verified, how visitors are handled, how delivery/loading areas are...
ISO 27001 A.7.3 - Securing Offices, Rooms and Facilities
The organization should design and implement physical protections for offices, rooms, and facilities based on what those areas contain and how critical or sensitive the work is.
ISO 27001 A.7.4 - Physical Security Monitoring
The organization should monitor premises for unauthorized physical access, similar to how networks are monitored for intrusion. Monitoring may be manual, automated, or a mix of...
ISO 27001 A.7.5 - Protecting Against Physical and Environmental Threats
The organization should protect sites, buildings, rooms, and infrastructure from hazards such as fire, flood, explosion, chemical leaks, civil unrest, utility failure, and threa...
ISO 27001 A.7.6 - Working in Secure Areas
The organization should define how people work inside secure areas when the work itself is sensitive or critical. Physical entry controls are not enough. The rules must also cov...
ISO 27001 A.7.7 - Clear Desk and Clear Screen
People should not leave sensitive papers, removable media, printed documents, fax messages, or unlocked screens exposed where unauthorized people can see, photograph, remove, al...
ISO 27001 A.7.8 - Equipment Siting and Protection
The organization should place and protect equipment in a way that reduces physical damage, environmental damage, unauthorized access, unauthorized use, and information exposure.
ISO 27001 A.7.9 - Security of Assets Off-Premises
The organization should protect equipment, documents, data, software, and storage media when they leave the organization's controlled environment.
Section
Audit Evidence Packs
92 notes across 5 subsections
A.5 Evidence Packs
37 notesA.5.1 Audit Evidence Pack
The auditor wants to confirm that information security policies are defined, approved, published, communicated, acknowledged, controlled, and reviewed.
A.5.10 Audit Evidence Pack
The auditor wants to confirm that acceptable use rules and information handling procedures are defined, communicated, acknowledged, implemented, and enforced for relevant users...
A.5.11 Audit Evidence Pack
The auditor wants to confirm that employees, contractors, third-party users, and other relevant parties return organizational assets when employment, contract, agreement, or rol...
A.5.12 Audit Evidence Pack
The auditor wants to confirm that the organization has a clear, usable classification scheme and that information is classified according to confidentiality, integrity, availabi...
A.5.13 Audit Evidence Pack
The auditor wants to confirm that labelling procedures exist, align with the classification scheme, and are implemented across relevant physical and digital forms of information.
A.5.14 Audit Evidence Pack
The auditor wants to confirm that the organization has documented and implemented rules, procedures, or agreements for transferring information internally and externally across...
A.5.15 Audit Evidence Pack
The auditor wants to confirm that physical and logical access rules are defined, implemented, approved, reviewed, and based on business and information security requirements.
A.5.16 Audit Evidence Pack
The auditor wants to confirm that identities are uniquely registered where possible and managed through the full lifecycle: creation, authorization, change, review, disabling, d...
A.5.17 Audit Evidence Pack
The auditor wants to confirm that secret authentication information is issued, managed, changed, reset, stored, and handled through a controlled process, and that users understa...
A.5.18 Audit Evidence Pack
The auditor wants to confirm that access rights are formally provisioned, reviewed, modified, and removed according to access control rules.
A.5.19 Audit Evidence Pack
The auditor wants to confirm that supplier information security risks are identified, assessed, controlled, contractually addressed, and reviewed.
A.5.2 Audit Evidence Pack
The auditor wants to confirm that information security roles and responsibilities are defined, allocated, documented, communicated, understood, accepted, current, and applied to...
A.5.20 Audit Evidence Pack
The auditor wants to confirm that supplier security requirements are established, agreed, authorized, and appropriate to the supplier relationship before access or information s...
A.5.21 Audit Evidence Pack
The auditor wants to confirm that ICT supply-chain risks are identified and managed, including inherited risks from subcontractors, cloud providers, support parties, hosting pro...
A.5.22 Audit Evidence Pack
The auditor wants to confirm that supplier security practices and service delivery are monitored, reviewed, evaluated, and changed through a controlled process.
A.5.23 Audit Evidence Pack
The auditor wants to confirm that cloud service acquisition, use, management, and exit are governed according to the organization's information security requirements.
A.5.24 Audit Evidence Pack
The auditor wants to confirm that incident management processes, roles, responsibilities, reporting routes, and preparation activities are defined, established, communicated, an...
A.5.25 Audit Evidence Pack
The auditor wants to confirm that reported security events are assessed using defined criteria and that the incident/non-incident decision is recorded with justification and tim...
A.5.26 Audit Evidence Pack
The auditor wants to confirm that confirmed information security incidents are responded to according to documented procedures and that response decisions, actions, responsibili...
A.5.27 Audit Evidence Pack
The auditor wants to confirm that knowledge from incidents is captured and used to improve controls, procedures, awareness, risk treatment, and the ISMS.
A.5.28 Audit Evidence Pack
The auditor wants to confirm that procedures exist and operate for identifying, collecting, acquiring, preserving, storing, and protecting evidence related to information securi...
A.5.29 Audit Evidence Pack
The auditor wants to confirm that information security is maintained at an appropriate level during disruption and that continuity plans include security objectives, roles, requ...
A.5.3 Audit Evidence Pack
The auditor wants to confirm that conflicting duties and responsibilities have been identified and segregated, or that compensating controls exist where segregation is not pract...
A.5.30 Audit Evidence Pack
The auditor wants to confirm that ICT readiness is planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements.
A.5.31 Audit Evidence Pack
The auditor wants to confirm that applicable legal, statutory, regulatory, and contractual information security requirements are identified, documented, owned, kept current, and...
A.5.32 Audit Evidence Pack
The auditor wants to confirm that procedures protect intellectual property rights and that software, content, source code, libraries, and AI-generated material are used within a...
A.5.33 Audit Evidence Pack
The auditor wants to confirm that required records are identified, retained, protected from loss/alteration/unauthorized access/release, reviewed, accessible through retention,...
A.5.34 Audit Evidence Pack
The auditor wants to confirm that privacy and PII requirements are identified, mapped, implemented, reviewed, and evidenced for all relevant PII holdings, roles, transfers, and...
A.5.35 Audit Evidence Pack
The auditor wants to confirm that the information security approach and implementation are independently reviewed at planned intervals and after significant changes, with findin...
A.5.36 Audit Evidence Pack
The auditor wants to confirm that compliance with information security policies, rules, and standards is regularly reviewed through management and technical checks, with finding...
A.5.37 Audit Evidence Pack
The auditor wants to confirm that operating procedures for information processing facilities are documented, controlled, current, available to personnel who need them, and used...
A.5.4 Audit Evidence Pack
The auditor wants to confirm that managers actively require personnel to apply information security according to policies and procedures.
A.5.5 Audit Evidence Pack
The auditor wants to confirm that the organization has identified relevant authorities, assigned authorized liaison roles, defined contact triggers, maintained accurate contact...
A.5.6 Audit Evidence Pack
The auditor wants to confirm that the organization maintains proportionate contact with relevant specialist security groups, forums, or professional associations and that useful...
A.5.7 Audit Evidence Pack
The auditor wants to confirm that threat information is collected, analyzed, validated, contextualized, and used to support risk assessment, risk treatment, control improvement,...
A.5.8 Audit Evidence Pack
The auditor wants to confirm that information security is integrated into the project management method and applied in real projects from initiation through transition to operat...
A.5.9 Audit Evidence Pack
The auditor wants to confirm that information and associated assets are identified, owned, classified, maintained, protected, and updated through change, project, procurement, a...
A.6 Evidence Packs
8 notesA.6.1 Audit Evidence Pack
The auditor wants evidence that background verification checks are defined, applied, documented, and protected as personal data.
A.6.2 Audit Evidence Pack
The auditor wants evidence that security responsibilities are defined, accepted, role-appropriate, current, and applicable to employees, contractors, and third-party users in sc...
A.6.3 Audit Evidence Pack
The auditor wants evidence that training is role-relevant, current, recorded, repeated where needed, and improved based on effectiveness feedback.
A.6.4 Audit Evidence Pack
The auditor wants evidence that the organization can respond fairly and consistently when personnel or relevant interested parties violate information security policy.
A.6.5 Audit Evidence Pack
The auditor wants proof that old access and assets are removed, relevant parties are notified, and continuing duties are communicated after termination or role change.
A.6.6 Audit Evidence Pack
The auditor wants evidence that agreements reflect actual confidentiality requirements and are legally usable where needed.
A.6.7 Audit Evidence Pack
The auditor wants evidence that information remains protected when accessed, processed, or stored outside organization premises.
A.6.8 Audit Evidence Pack
The auditor wants proof that reporting channels are known, usable, timely, and connected to event assessment and incident management.
A.7 Evidence Packs
14 notesA.7.1 Audit Evidence Pack
The auditor wants evidence that physical zones protect assets and information, not just a floorplan showing rooms.
A.7.10 Audit Evidence Pack
- Media handling follows classification. - Media is inventoried and labelled where appropriate. - Dispatches are authorized and recorded. - Sensitive media is protected during t...
A.7.11 Audit Evidence Pack
- Critical facilities have documented utility dependencies. - UPS/generator tests include load, runtime, cooling, and maintenance evidence. - Alarms detect utility failures and...
A.7.12 Audit Evidence Pack
- Cable routes are documented and protected. - Power/data segregation is implemented where needed. - Patch panels, cabinets, and connections are locked or access-controlled. - L...
A.7.13 Audit Evidence Pack
- Maintenance is scheduled and recorded. - Faults and repairs are tracked. - Maintainers are authorized and qualified. - External maintainers are escorted where required. - Conf...
A.7.14 Audit Evidence Pack
- Records identify asset, storage media, classification, method, verifier, and date. - Sanitization method matches media type and sensitivity. - Contractor records are asset-spe...
A.7.2 Audit Evidence Pack
The auditor wants evidence that only authorized people can enter secure areas and that visitor, badge, delivery, and loading controls operate in practice.
A.7.3 Audit Evidence Pack
- Controls are based on value, liability, importance, and classification. - Sensitive room purpose is not unnecessarily exposed. - Internal directories and access clues are prot...
A.7.4 Audit Evidence Pack
- Monitoring scope is documented and risk-based. - Alerts have owners, response times, and escalation paths. - Monitoring tests are performed and recorded. - Monitoring staff kn...
A.7.5 Audit Evidence Pack
- Hazard assessment includes site, room, utility, and neighbor risks. - Specialist advice exists for material hazards. - Controls are implemented and maintained. - Continuity ar...
A.7.6 Audit Evidence Pack
- Secure-area work is identified and risk-assessed. - Need-to-know, device, media, supervision, and dual-control rules are documented. - Employees, contractors, and third partie...
A.7.7 Audit Evidence Pack
- Rules cover papers, removable media, screens, printers, faxes, storage, and confidential waste. - Auto-lock settings are enforced. - Sensitive print/fax workflows are controll...
A.7.8 Audit Evidence Pack
- Equipment inventory includes location, owner, and protection requirement. - Siting assessment covers physical, environmental, viewing, access, and interference risks. - Networ...
A.7.9 Audit Evidence Pack
- Asset removal is authorized and logged. - Off-site assets are recorded with custodian, location, and review date. - Mobile devices are encrypted and managed. - Long-term loans...
Maps of Content
1 notesAudit Evidence MOC
1. Design — is the control defined appropriately? 2. Implementation — has it been put in place? 3. Operation — is it operating as intended? 4. Evidence — can the organization pr...
Template Notes
32 notesA.8.1 Audit Evidence Pack
- Device inventory includes managed and BYOD endpoints. - Compliance reports show patching, encryption, screen lock, and malware/EDR status. - Remote access requires strong auth...
A.8.10 Audit Evidence Pack
- Deletion records match retention rules. - Deletion method matches sensitivity and storage type. - Items awaiting destruction are secured. - Cloud and backup data are included....
A.8.11 Audit Evidence Pack
- Masking methods are defined and matched to use cases. - Full-data access is role-based and approved. - Token lookup tables/keys are segregated. - Re-combination is logged and...
A.8.12 Audit Evidence Pack
- DLP scope maps to sensitive/classified information. - Approved data flows and channels are defined. - DLP rules are tuned to the organization’s risk and data types. - Alerts a...
A.8.13 Audit Evidence Pack
- Backup scope maps to critical information, systems, and software. - Frequency aligns with risk and continuity requirements. - Restore tests are documented and successful. - Ba...
A.8.14 Audit Evidence Pack
- Redundancy is linked to RTO/RPO and service criticality. - Critical dependencies are included. - Failover tests meet target recovery times. - Data replication and alternate-si...
A.8.15 Audit Evidence Pack
- Logs include event, user/account, date/time, source, and action. - Privileged activity is logged and independently reviewed. - Logs are protected from source-system administra...
A.8.16 Audit Evidence Pack
- Detection use cases trace to risk scenarios, assets, and critical services. - Monitoring source coverage includes relevant identity, endpoint, server, network, cloud, applicat...
A.8.19 Audit Evidence Pack
- Installation records link to approved changes. - Security, compatibility, and regression tests are retained. - Deployment was performed by authorized personnel. - Production i...
A.8.2 Audit Evidence Pack
- Privileges are approved based on need-to-use. - Separate named admin IDs exist where feasible. - Privileged activity is logged and reviewed. - Logs are protected and retained....
A.8.20 Audit Evidence Pack
- Diagrams match actual network configuration. - Sensitive traffic paths and public network exposure are identified. - Network zones are enforced and tested. - Network device ad...
A.8.21 Audit Evidence Pack
- Network services have owners and risk assessments. - Required security mechanisms are documented. - Agreements include security features and service levels. - Provider reports...
A.8.22 Audit Evidence Pack
- Zones are risk-based and documented. - Systems and services are assigned to zones. - Inter-zone rules are specific and reviewed. - Wireless and cloud networks are included. -...
A.8.23 Audit Evidence Pack
- Categories are mapped to policy and risk. - Filtering covers remote users and relevant devices. - Exceptions have approval, owner, and review date. - Users cannot casually dis...
A.8.24 Audit Evidence Pack
- Cryptographic decisions trace to risk and classification. - Algorithms, key lengths, and protocols are approved and current. - Keys have owners, purpose, lifecycle status, and...
A.8.25 Audit Evidence Pack
- Secure development rules are mandatory and integrated into workflow. - Developers and reviewers have relevant training. - Reviews are performed by competent reviewers, not onl...
A.8.26 Audit Evidence Pack
- Requirements are specific and testable. - Requirements trace to risk, classification, and legal obligations. - Security and business owners approve requirements. - Testing pro...
A.8.27 Audit Evidence Pack
- Principles are specific and usable. - Architecture reviews reference principles. - Threat models identify and treat design risks. - Deviations are risk-assessed and approved....
A.8.28 Audit Evidence Pack
- Standards are language, framework, and risk-specific. - Developers can retrieve and explain applicable standards. - Automated checks run and findings are reviewed. - Secure co...
A.8.29 Audit Evidence Pack
- Test depth and frequency trace to risk. - Testing occurs during development and before acceptance. - Acceptance criteria are documented. - Defective input, regression, access...
A.8.3 Audit Evidence Pack
- Access rules are approved by the information or application owner. - Role permissions are mapped to create/read/modify/delete/export/admin rights. - Application and database p...
A.8.30 Audit Evidence Pack
- Contracts include secure development, testing, IP, audit, and training requirements. - Supplier deliverables have test and review evidence. - Findings are tracked to closure o...
A.8.31 Audit Evidence Pack
- Access differs between development, test, and production. - Production deployments require approval and release records. - Network and administrative paths are restricted and...
A.8.32 Audit Evidence Pack
- Security impact is assessed before approval. - Testing and rollback are proportionate to risk. - Implementation logs match approved changes. - Release records identify include...
A.8.33 Audit Evidence Pack
- Synthetic or masked data is the default. - Each live-data use is authorized. - Test environments protect sensitive data appropriately. - Logs, caches, screenshots, and debug f...
A.8.34 Audit Evidence Pack
- Operational testing is planned before execution. - Scope, tools, timing, contacts, and stop criteria are documented. - Appropriate management authorizes the activity. - Tool u...
A.8.4 Audit Evidence Pack
- Source code is centrally stored in controlled repositories. - Read/write/merge/build/release permissions are separated. - Changes require review, approval, and test evidence....
A.8.5 Audit Evidence Pack
- MFA is implemented for remote, privileged, and high-risk access where required. - MFA uses different factor types. - Failed logon handling includes lockout, delay, throttling,...
A.8.6 Audit Evidence Pack
- Critical systems have defined capacity plans. - Monitoring covers current and expected bottlenecks. - Trend analysis is reviewed and acted on. - Thresholds have owners and act...
A.8.7 Audit Evidence Pack
- Malware protection coverage is inventoried. - Updates are monitored and exceptions are investigated. - Real-time scanning is enabled where feasible. - Sensitive/shared systems...
A.8.8 Audit Evidence Pack
- Scanning covers all relevant systems. - Vulnerabilities have owners, severity, risk rating, and target dates. - Critical issues are prioritized by exploitability and exposure....
A.8.9 Audit Evidence Pack
- Baselines exist for major technology types. - Systems are mapped to applicable baselines. - Compliance is checked regularly or continuously. - Exceptions include risk rational...
Section
ISMS Artifacts
59 notes across 1 subsections
Research Notes
59 notesAQ-ISO27001-A.7.12 Cabling Security
Audit question set for ISO27001-A.7.12. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.13 Equipment Maintenance
Audit question set for ISO27001-A.7.13. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.14 Secure Disposal or Re-Use of Equipment
Audit question set for ISO27001-A.7.14. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.10 Storage Media
Audit question set for ISO27001-A.7.10. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.11 Supporting Utilities
Audit question set for ISO27001-A.7.11. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.9 Security of Assets Off-Premises
Audit question set for ISO27001-A.7.9. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.8 Equipment Siting and Protection
Audit question set for ISO27001-A.7.8. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.1 Screening
Audit question set for ISO27001-A.6.1. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.2 Terms and Conditions of Employment
Audit question set for ISO27001-A.6.2. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.3 Information Security Awareness, Education and Training
Audit question set for ISO27001-A.6.3. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.4 Disciplinary Process
Audit question set for ISO27001-A.6.4. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.5 Responsibilities After Termination or Change of Employment
Audit question set for ISO27001-A.6.5. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.6 Confidentiality or Non-Disclosure Agreements
Audit question set for ISO27001-A.6.6. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.7 Remote Working
Audit question set for ISO27001-A.6.7. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.6.8 Information Security Event Reporting
Audit question set for ISO27001-A.6.8. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.1 Physical Security Perimeters
Audit question set for ISO27001-A.7.1. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.2 Physical Entry
Audit question set for ISO27001-A.7.2. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.3 Securing Offices, Rooms and Facilities
Audit question set for ISO27001-A.7.3. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.4 Physical Security Monitoring
Audit question set for ISO27001-A.7.4. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.5 Protecting Against Physical and Environmental Threats
Audit question set for ISO27001-A.7.5. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.6 Working in Secure Areas
Audit question set for ISO27001-A.7.6. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.7.7 Clear Desk and Clear Screen
Audit question set for ISO27001-A.7.7. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.33 Protection of Records
Audit question set for ISO27001-A.5.33. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.34 Privacy and Protection of PII
Audit question set for ISO27001-A.5.34. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.35 Independent Review of Information Security
Audit question set for ISO27001-A.5.35. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.36 Compliance with Policies, Rules and Standards for Information Security
Audit question set for ISO27001-A.5.36. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.37 Documented Operating Procedures
Audit question set for ISO27001-A.5.37. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.23 Information Security for Use of Cloud Services
Audit question set for ISO27001-A.5.23. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.24 Information Security Incident Management Planning and Preparation
Audit question set for ISO27001-A.5.24. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.25 Assessment and Decision on Information Security Events
Audit question set for ISO27001-A.5.25. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.26 Response to Information Security Incidents
Audit question set for ISO27001-A.5.26. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.27 Learning from Information Security Incidents
Audit question set for ISO27001-A.5.27. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.28 Collection of Evidence
Audit question set for ISO27001-A.5.28. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.29 Information Security During Disruption
Audit question set for ISO27001-A.5.29. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.30 ICT Readiness for Business Continuity
Audit question set for ISO27001-A.5.30. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
Audit question set for ISO27001-A.5.31. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.32 Intellectual Property Rights
Audit question set for ISO27001-A.5.32. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.1 Policies for Information Security
Audit question set for ISO27001-A.5.1. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.10 Acceptable Use of Information and Other Associated Assets
Audit question set for ISO27001-A.5.10. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.11 Return of Assets
Audit question set for ISO27001-A.5.11. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.12 Classification of Information
Audit question set for ISO27001-A.5.12. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.13 Labelling of Information
Audit question set for ISO27001-A.5.13. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.14 Information Transfer
Audit question set for ISO27001-A.5.14. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.15 Access Control
Audit question set for ISO27001-A.5.15. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.16 Identity Management
Audit question set for ISO27001-A.5.16. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.17 Authentication Information
Audit question set for ISO27001-A.5.17. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.18 Access Rights
Audit question set for ISO27001-A.5.18. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.19 Information Security in Supplier Relationships
Audit question set for ISO27001-A.5.19. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.2 Information Security Roles and Responsibilities
Audit question set for ISO27001-A.5.2. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.20 Addressing Information Security Within Supplier Agreements
Audit question set for ISO27001-A.5.20. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.21 Managing Information Security in the ICT Supply Chain
Audit question set for ISO27001-A.5.21. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.22 Monitoring, Review and Change Management of Supplier Services
Audit question set for ISO27001-A.5.22. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.3 Segregation of Duties
Audit question set for ISO27001-A.5.3. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.4 Management Responsibilities
Audit question set for ISO27001-A.5.4. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.5 Contact with Authorities
Audit question set for ISO27001-A.5.5. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.6 Contact with Special Interest Groups
Audit question set for ISO27001-A.5.6. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.7 Threat Intelligence
Audit question set for ISO27001-A.5.7. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.8 Information Security in Project Management
Audit question set for ISO27001-A.5.8. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
AQ-ISO27001-A.5.9 Inventory of Information and Other Associated Assets
Audit question set for ISO27001-A.5.9. Use it to validate implementation, operating evidence, exceptions, review cadence, ownership, and corrective action.
Section
Annex a technological controls
33 notes across 2 subsections
Maps of Content
1 notesA.8 Technological Controls MOC
A.5 sets governance rules, A.6 manages people responsibilities, and A.7 protects the physical environment. A.8 tests whether technical systems enforce and evidence those decisions.
Framework Notes
32 notesISO 27001 A.8.1 - User End Point Devices
The organization should protect laptops, desktops, mobile phones, tablets, personal devices, and other endpoint devices that users rely on to access organizational information.
ISO 27001 A.8.10 - Information Deletion
The organization should not keep information forever just because storage is cheap. When information is no longer needed for business, legal, regulatory, contractual, or evidenc...
ISO 27001 A.8.11 - Data Masking
The organization should hide, replace, tokenize, pseudonymize, or anonymize sensitive data where full visibility is not needed. The goal is to let people or systems use data for...
ISO 27001 A.8.12 - Data Leakage Prevention
The organization should prevent sensitive information from leaving approved locations, systems, networks, or channels without authorization. This requires understanding which in...
ISO 27001 A.8.13 - Information Backup
The organization should make backup copies of important information, software, and systems, protect those backups, and regularly test whether they can actually be restored.
ISO 27001 A.8.14 - Redundancy of Information Processing Facilities
The organization should design critical processing facilities so that a single failure does not create unacceptable downtime. Redundancy may involve duplicate equipment, cluster...
ISO 27001 A.8.15 - Logging
The organization should collect useful logs, protect them from tampering, keep them long enough, and review or analyse them so security-relevant events can be detected and inves...
ISO 27001 A.8.16 - Monitoring Activities
The organization should actively watch important technology environments for signs that something abnormal or suspicious is happening. Monitoring should help detect possible att...
ISO 27001 A.8.19 - Installation of Software on Operational Systems
Operational systems should not accept software changes just because someone has technical ability to install them. New software, updates, libraries, patches, scripts, packages,...
ISO 27001 A.8.2 - Privileged Access Rights
Privileged access allows users to administer systems, override controls, change configurations, access sensitive data, or recover systems during failure. Because privileged acce...
ISO 27001 A.8.20 - Networks Security
Networks are not just cables and routers. They are trust paths between users, systems, applications, cloud services, suppliers, and management interfaces. If the network is poor...
ISO 27001 A.8.21 - Security of Network Services
When the organization uses network services, especially third-party network services, it should know exactly what security features and service levels are required, what the pro...
ISO 27001 A.8.22 - Segregation of Networks
Large flat networks are hard to defend. Network segregation divides users, systems, and services into smaller physical or logical zones so traffic between them can be controlled.
ISO 27001 A.8.23 - Web Filtering
Users can be compromised by visiting malicious websites, downloading fake tools, following phishing links, or connecting to command-and-control infrastructure. Web filtering red...
ISO 27001 A.8.24 - Use of Cryptography
The organization should define when cryptography is required, what approved cryptographic methods may be used, who manages keys, how keys are protected, and how cryptographic co...
ISO 27001 A.8.25 - Secure Development Life Cycle
Development work should follow secure rules from the beginning. This applies to software, services, networks, infrastructure, environments, and systems that are built or changed...
ISO 27001 A.8.26 - Application Security Requirements
Application security requirements should be defined before the application is built, bought, integrated, or changed. The organization should decide what security the application...
ISO 27001 A.8.27 - Secure System Architecture and Engineering Principles
The organization should define architectural and engineering principles that guide how systems are designed securely. These principles should be documented, maintained, and used...
ISO 27001 A.8.28 - Secure Coding
Developers should follow secure coding standards that fit the languages, frameworks, tools, and risk level of the software being built. The standard should explain both general...
ISO 27001 A.8.29 - Security Testing in Development and Acceptance
Security testing should be planned, performed, recorded, and used as part of development and acceptance. It should not be left until the final days before go-live.
ISO 27001 A.8.3 - Information Access Restriction
The organization should make sure users can only access the information, functions, applications, databases, reports, exports, and assets they need for their role.
ISO 27001 A.8.30 - Outsourced Development
If a supplier builds software or systems for the organization, the organization still owns the security outcome. Outsourcing the work does not outsource accountability.
ISO 27001 A.8.31 - Separation of Development Test and Production Environments
Developers need places to build and test. Production needs stability, integrity, and controlled access. These environments should not be casually mixed.
ISO 27001 A.8.32 - Change Management
Changes to systems, infrastructure, networks, applications, code, integrations, operational processes, and information processing facilities should be planned, reviewed, approve...
ISO 27001 A.8.33 - Test Information
Test data should be chosen deliberately. Synthetic or fictitious data is usually safer. If production data is used for testing, it must be justified, authorized, protected, logg...
ISO 27001 A.8.34 - Protection of Information Systems During Audit Testing
Audits, penetration tests, vulnerability scans, configuration reviews, data extraction, and assurance tools can disrupt systems or expose information if they are not planned. Te...
ISO 27001 A.8.4 - Access to Source Code
Source code, build tools, compilers, package repositories, CI/CD pipelines, and software libraries can directly change how systems behave. If an attacker or unauthorized insider...
ISO 27001 A.8.5 - Secure Authentication
Authentication is the point where a system tests whether the person, service, or device claiming an identity should be accepted. Secure authentication means the logon process do...
ISO 27001 A.8.6 - Capacity Management
The organization should know whether its systems, networks, storage, cloud services, databases, staff, and other resources can support current and future demand. Capacity manage...
ISO 27001 A.8.7 - Protection Against Malware
The organization should reduce the chance that malicious software infects systems, spreads through files or connected services, damages information, or gives attackers unauthori...
ISO 27001 A.8.8 - Management of Technical Vulnerabilities
The organization should actively find out what vulnerabilities affect its systems, assess how exposed it is, and respond in a risk-based timeframe. Response can include patching...
ISO 27001 A.8.9 - Configuration Management
The organization should define what secure and acceptable configuration looks like, apply it, monitor whether systems stay aligned to it, and review exceptions. If approved conf...
Section
Implementer Guide
6 notes across 2 subsections
Maps of Content
1 notesISO 27001 Implementer Guide
This guide is the implementation view of the vault. It explains how to build and operate an ISMS using the existing ISO/IEC 27001 notes, Annex A controls, templates, evidence pa...
Framework Notes
5 notesA.5 Organizational Controls Implementation Guide
This note converts the covered A.5 control library into an implementer view. Use the individual control notes for detail and this guide for build sequencing.
A.6 People Controls Implementation Guide
1. Identify people categories in ISMS scope: employees, contractors, temporary staff, consultants, and third-party users. 2. Map role risk using access level, information classi...
A.7 Physical Controls Implementation Guide
1. Identify areas containing information and associated assets. 2. Classify zones by business process, asset sensitivity, customer/regulatory need, and risk. 3. Define perimeter...
A.8 Technological Controls Implementation Guide
1. Identify systems, endpoints, users, privileged access paths, information repositories, source repositories, authentication paths, critical capacity resources, malware protect...
ISMS Implementation Roadmap
- Start with the business and risk context, not Annex A. - Treat Annex A as a control library, not a mandatory checklist. - Keep evidence close to the process that creates it. -...
Section
Risk Knowledge Base
15 notes across 1 subsections
Knowledge Base
15 notesRISK-0002 Incident Escalation Failure Due to Unclear Ownership
Because incident ownership, escalation criteria, and communication paths are not prepared or rehearsed, a serious security incident may be handled slowly or inconsistently.
RISK-0003 Security Event Misclassification Delays Incident Response
Because reported security events are not assessed with clear criteria, a material incident may be dismissed, delayed, or escalated without the evidence needed for response.
RISK-0004 Uncoordinated Incident Response Allows Compromise to Spread
Because confirmed incidents are handled without a documented response record and authority model, containment may be delayed or inconsistent across teams.
RISK-0005 Repeat Incidents Due to Missing Lessons Learned
Because incident knowledge is not converted into corrective actions, the same failure mode may recur and leave the organization exposed to preventable incidents.
RISK-0006 Evidence Integrity Loss Due to Weak Chain of Custody
Because incident evidence is collected or stored without integrity controls, investigation, legal, regulatory, disciplinary, or audit conclusions may not be defensible.
RISK-0007 Excessive Access to Sensitive Assets Due to Weak Access Rules
Because access rules are not clearly defined, approved, and reviewed, users may have more access than their role requires across sensitive systems, data, repositories, or locations.
RISK-0008 Orphaned Identities After Role or Employment Change
Because identities are not managed through a controlled lifecycle, inactive, duplicate, stale, or shared identities may remain usable after users change roles or leave.
RISK-0009 Compromised Authentication Information Due to Weak Credential Handling
Because secret authentication information is not issued, reset, stored, and protected through controlled procedures, credentials may be exposed, reused, guessed, or misused.
RISK-0010 Stale Access Rights After Business Change
Because access rights are not reviewed, modified, and removed after role, employment, supplier, or system changes, users may retain access that is no longer justified.
RISK-0011 Unmanaged Supplier Security Exposure Due to Incomplete Supplier Inventory
Because suppliers, products, and services are not inventoried, owned, risk-tiered, and periodically reviewed, the organization may accept security exposure without knowing who is accountable or what controls apply.
RISK-0012 Supplier Access Before Security Requirements Are Agreed
Because supplier security requirements are not formally agreed before information sharing or access begins, the organization may rely on informal expectations that cannot be enforced during incidents, disputes, audits, or termination.
RISK-0013 Inherited ICT Supply Chain Compromise Through Unreviewed Dependencies
Because ICT supplier dependencies, subcontractors, hosting platforms, software components, and support parties are not identified or reviewed, a compromise or control failure outside the direct supplier may affect the organization.
RISK-0014 Supplier Service Change Without Risk Review
Because supplier service reports, security practices, incidents, and material changes are not actively reviewed, supplier risk may increase after onboarding without triggering control updates or management decisions.
RISK-0015 Cloud Governance and Exit Failure Due to Weak Cloud Service Controls
Because cloud services are not governed from acquisition through use, monitoring, change, and exit, the organization may misunderstand shared responsibility, misconfigure security controls, lose data location visibility, or fail to exit safely.
RISK-0001 Customer Data Compromise Due to Ransomware Campaign
Because of ransomware actors exploiting an unpatched VPN and weak monitoring affecting the customer database, customer data compromise and operational disruption may occur.
Section
Auditor Guide
6 notes across 2 subsections
Maps of Content
1 notesISO 27001 Auditor Guide
This guide is the audit view of the vault. It turns the ISO/IEC 27001 and Annex A notes into audit planning, evidence testing, interview questions, findings, and corrective acti...
Framework Notes
5 notesA.5 Organizational Controls Audit Guide
This note gives the audit view for the currently documented A.5 organizational controls. Use the evidence packs for detailed requests and this guide for audit logic.
A.6 People Controls Audit Guide
1. Select samples across employees, contractors, temporary staff, and third-party users. 2. Compare onboarding dates, agreement dates, screening completion dates, and access pro...
A.7 Physical Controls Audit Guide
1. Review zone registers, floor/security diagrams, and risk assessment. 2. Walk the physical site and test practical bypass paths. 3. Observe badge use, visitor handling, recept...
A.8 Technological Controls Audit Guide
1. Review policies and standards before sampling technical evidence. 2. Sample endpoint inventory against MDM/EDR/compliance reports. 3. Check remote access, timeout, encryption...
Internal Audit Execution Guide
- What risk does this control treat? - Who owns the control? - How do you know it operated during the audit period? - What happens when the control fails? - What evidence would...
Section
Control Knowledge Base
91 notes across 4 subsections
A.5 Controls
37 notesISO27001-A.5.33 Protection of Records
The organization must protect required records for as long as they need to be retained, so they are not lost, destroyed, falsified, accessed without authorization, or released without authorization.
ISO27001-A.5.34 Privacy and Protection of PII
The organization must identify privacy and PII protection requirements that apply to the personal information it collects, stores, processes, transmits, shares, or retains, then implement controls to meet those requirements.
ISO27001-A.5.35 Independent Review of Information Security
The organization must have its information security management approach and actual implementation independently reviewed at planned intervals and when significant changes happen.
ISO27001-A.5.36 Compliance with Policies, Rules and Standards for Information Security
The organization must regularly check whether people, processes, and systems comply with its information security policies, rules, standards, and technical implementation requirements.
ISO27001-A.5.37 Documented Operating Procedures
The organization must document operating procedures for information processing facilities and make the current approved procedures available to the people who need to use them.
ISO27001-A.5.23 Information Security for Use of Cloud Services
Cloud services must be governed from selection to exit. The organization needs defined processes for buying, configuring, using, monitoring, changing, and leaving cloud services in line with its security requirements.
ISO27001-A.5.24 Information Security Incident Management Planning and Preparation
The organization must prepare before incidents happen. It needs defined and communicated incident management processes, roles, responsibilities, escalation paths, and recovery coordination.
ISO27001-A.5.25 Assessment and Decision on Information Security Events
The organization must review reported security events and make a clear, recorded decision: is this just an event, or is it an information security incident that needs formal response?
ISO27001-A.5.26 Response to Information Security Incidents
Once an event is categorized as an incident, the organization must respond using documented procedures rather than improvising.
ISO27001-A.5.27 Learning from Information Security Incidents
The organization must turn incident experience into better controls, procedures, awareness, risk treatment, and response capability.
ISO27001-A.5.28 Collection of Evidence
The organization must know how to identify, collect, acquire, preserve, store, and protect evidence related to security events so it remains complete, reliable, and usable.
ISO27001-A.5.29 Information Security During Disruption
The organization must decide in advance how information security will be maintained during serious disruption, crisis, disaster recovery, or business continuity events.
ISO27001-A.5.30 ICT Readiness for Business Continuity
The organization must plan, build, maintain, and test ICT continuity capability so priority systems and services can recover in line with business continuity objectives.
ISO27001-A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
The organization must know which legal, statutory, regulatory, and contractual information security requirements apply, document them, keep them current, and define how it will meet them.
ISO27001-A.5.32 Intellectual Property Rights
The organization must have procedures that prevent unauthorized use, copying, distribution, modification, or licensing misuse of software, documents, designs, source code, trademarks, patents, subscription content, and AI-generated or AI-assisted material.
ISO27001-A.5.1 Policies for Information Security
The organization needs a formal information security policy structure, not random documents sitting in a shared folder.
ISO27001-A.5.10 Acceptable Use of Information and Other Associated Assets
People must know how they are allowed to use organizational information and assets, and how they must handle information based on sensitivity and classification.
ISO27001-A.5.11 Return of Assets
When someone leaves, changes role, ends a contract, or no longer needs an asset, the organization must get its assets back and ensure organizational information is returned or securely removed.
ISO27001-A.5.12 Classification of Information
Information must be grouped by protection need so people know how carefully to handle it.
ISO27001-A.5.13 Labelling of Information
If information is classified, people need a practical way to see or infer the classification so they can handle it correctly.
ISO27001-A.5.14 Information Transfer
The organization must define how information can be transferred safely, both internally and externally.
ISO27001-A.5.15 Access Control
The organization must define and enforce rules for who can access information, systems, services, networks, applications, repositories, and physical locations.
ISO27001-A.5.16 Identity Management
Every user identity should be created, changed, reviewed, disabled, and removed through a controlled process.
ISO27001-A.5.17 Authentication Information
The organization must control how secret authentication information is issued, changed, protected, reset, and handled.
ISO27001-A.5.18 Access Rights
Access rights must be granted, changed, reviewed, and removed through a controlled process.
ISO27001-A.5.19 Information Security in Supplier Relationships
The organization must manage information security risks created by suppliers, supplier products, and supplier services.
ISO27001-A.5.2 Information Security Roles and Responsibilities
People must know what they are responsible for, and the organization must be able to prove those responsibilities were assigned, communicated, accepted, and kept current.
ISO27001-A.5.20 Addressing Information Security Within Supplier Agreements
The organization must put the right security requirements into supplier contracts or agreements before the supplier receives access to information, systems, facilities, or services.
ISO27001-A.5.21 Managing Information Security in the ICT Supply Chain
The organization must manage security risks that come through ICT suppliers and the suppliers behind those suppliers.
ISO27001-A.5.22 Monitoring, Review and Change Management of Supplier Services
Supplier security does not end when the contract is signed. The organization must keep checking whether the supplier is delivering the agreed service securely, whether controls still work, and whether supplier changes create new risk.
ISO27001-A.5.3 Segregation of Duties
No single person should be able to perform a sensitive activity from beginning to end without independent oversight, approval, review, or control.
ISO27001-A.5.4 Management Responsibilities
Managers must actively ensure that people follow information security requirements.
ISO27001-A.5.5 Contact with Authorities
The organization must know which external authorities matter for information security and must maintain usable contact paths before an incident, investigation, regulatory request, or emergency happens.
ISO27001-A.5.6 Contact with Special Interest Groups
The organization should stay connected to credible external security knowledge sources. Security teams should not rely only on internal experience, vendor marketing, or outdated training.
ISO27001-A.5.7 Threat Intelligence
The organization must collect threat information, analyze it in context, and turn it into usable intelligence for decisions.
ISO27001-A.5.8 Information Security in Project Management
Projects must handle information security from the start, not as a late review before go-live.
ISO27001-A.5.9 Inventory of Information and Other Associated Assets
The organization must know what information and related assets it has, where they are, who owns them, how important they are, and how they are protected.
A.6 Controls
8 notesISO27001-A.6.1 Screening
The organization should check that people are who they claim to be, have the relevant background for the role, and do not present unmanaged personnel risk before they join or receive access.
ISO27001-A.6.2 Terms and Conditions of Employment
People should not have to guess what they are responsible for. Employment contracts, contractor agreements, confidentiality agreements, onboarding acknowledgements, or security responsibility addenda should clearly state what personnel must do to protect information and what the organization is responsible for.
ISO27001-A.6.3 Information Security Awareness, Education and Training
People need to know how to behave securely in their actual role. Everyone needs baseline awareness, but people with specific responsibilities need deeper training that matches their work, systems, information access, and security duties.
ISO27001-A.6.4 Disciplinary Process
The organization needs a documented and communicated process for handling information security policy violations. People should know that violations can lead to action, and managers should know how to trigger the process fairly and consistently.
ISO27001-A.6.5 Responsibilities After Termination or Change of Employment
When someone leaves the organization or changes role, their old access, assets, and responsibilities must be handled deliberately. Some rights should stop immediately. Some duties, such as confidentiality, may continue after the relationship ends.
ISO27001-A.6.6 Confidentiality or Non-Disclosure Agreements
The organization should know when confidentiality or non-disclosure agreements are needed, use terms that match its information-protection needs, keep those agreements legally usable, review them regularly, and make sure the right parties sign them before receiving confidential information.
ISO27001-A.6.7 Remote Working
When people work away from organization premises, the organization still has to protect information. That includes homes, hotels, coffee shops, customer sites, temporary offices, shared workspaces, and other remote locations.
ISO27001-A.6.8 Information Security Event Reporting
People need to know what might be a security event, how to report it, who to report it to, and what not to do. Reporting should be fast, simple, and no-blame enough that people do not hide mistakes.
A.7 Controls
14 notesISO27001-A.7.12 Cabling Security
Cables are part of the information processing environment. If they are badly routed, unprotected, mixed incorrectly, poorly labelled, or accessible to unauthorized people, they can cause outages, interference, safety issues, interception, or tampering.
ISO27001-A.7.13 Equipment Maintenance
Equipment that runs reliably today can still fail tomorrow. The organization should define maintenance needs, follow supplier recommendations, use authorized maintainers, keep maintenance and fault records, and protect confidential information during maintenance.
ISO27001-A.7.14 Secure Disposal or Re-Use of Equipment
Before equipment is reused, sold, returned, repaired, donated, recycled, or discarded, the organization should verify that sensitive information and licensed software are no longer recoverable.
ISO27001-A.7.10 Storage Media
The organization should control storage media from the moment it is obtained until it is erased, destroyed, disposed of, or transferred. Media includes digital and physical carriers such as USB drives, backup tapes, disks, removable drives, CDs/DVDs, printed records, and other portable media.
ISO27001-A.7.11 Supporting Utilities
Information processing facilities need supporting utilities to operate. Electricity, cooling, ventilation, telecommunications, water, fire protection, emergency lighting, and building management systems can all affect availability.
ISO27001-A.7.9 Security of Assets Off-Premises
The organization should protect equipment, documents, data, software, and storage media when they leave the organization's controlled environment.
ISO27001-A.7.8 Equipment Siting and Protection
The organization should place and protect equipment in a way that reduces physical damage, environmental damage, unauthorized access, unauthorized use, and information exposure.
ISO27001-A.7.1 Physical Security Perimeters
The organization should know which physical areas need protection and where the boundaries are. A perimeter can be a building boundary, floor, room, cage, cabinet, loading area, reception barrier, secure office, server room, records archive, or customer-specific zone.
ISO27001-A.7.2 Physical Entry
If an area is secure, entry should be controlled. The organization should know who is allowed in, how entry is verified, how visitors are handled, how delivery/loading areas are controlled, and how access records are reviewed.
ISO27001-A.7.3 Securing Offices, Rooms and Facilities
The organization should design and implement physical protections for offices, rooms, and facilities based on what those areas contain and how critical or sensitive the work is.
ISO27001-A.7.4 Physical Security Monitoring
The organization should monitor premises for unauthorized physical access, similar to how networks are monitored for intrusion. Monitoring may be manual, automated, or a mix of both.
ISO27001-A.7.5 Protecting Against Physical and Environmental Threats
The organization should protect sites, buildings, rooms, and infrastructure from hazards such as fire, flood, explosion, chemical leaks, civil unrest, utility failure, and threats from neighboring premises.
ISO27001-A.7.6 Working in Secure Areas
The organization should define how people work inside secure areas when the work itself is sensitive or critical. Physical entry controls are not enough. The rules must also cover what people may know, bring in, take out, record, discuss, supervise, and modify while inside the secure area.
ISO27001-A.7.7 Clear Desk and Clear Screen
People should not leave sensitive papers, removable media, printed documents, fax messages, or unlocked screens exposed where unauthorized people can see, photograph, remove, alter, or discard them.
Knowledge Base
32 notesISO27001-A.8.1 User End Point Devices
Query-first control card for A.8.1 User End Point Devices. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.10 Information Deletion
Query-first control card for A.8.10 Information Deletion. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.11 Data Masking
Query-first control card for A.8.11 Data Masking. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.12 Data Leakage Prevention
Query-first control card for A.8.12 Data Leakage Prevention. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.13 Information Backup
Query-first control card for A.8.13 Information Backup. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.14 Redundancy of Information Processing Facilities
Query-first control card for A.8.14 Redundancy of Information Processing Facilities. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.15 Logging
Query-first control card for A.8.15 Logging. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.16 Monitoring Activities
Query-first control card for A.8.16 Monitoring Activities. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.19 Installation of Software on Operational Systems
Query-first control card for A.8.19 Installation of Software on Operational Systems. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.2 Privileged Access Rights
Query-first control card for A.8.2 Privileged Access Rights. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.20 Networks Security
Query-first control card for A.8.20 Networks Security. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.21 Security of Network Services
Query-first control card for A.8.21 Security of Network Services. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.22 Segregation of Networks
Query-first control card for A.8.22 Segregation of Networks. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.23 Web Filtering
Query-first control card for A.8.23 Web Filtering. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.24 Use of Cryptography
Query-first control card for A.8.24 Use of Cryptography. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.25 Secure Development Life Cycle
Query-first control card for A.8.25 Secure Development Life Cycle. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.26 Application Security Requirements
Query-first control card for A.8.26 Application Security Requirements. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.27 Secure System Architecture and Engineering Principles
Query-first control card for A.8.27 Secure System Architecture and Engineering Principles. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.28 Secure Coding
Query-first control card for A.8.28 Secure Coding. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.29 Security Testing in Development and Acceptance
Query-first control card for A.8.29 Security Testing in Development and Acceptance. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.3 Information Access Restriction
Query-first control card for A.8.3 Information Access Restriction. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.30 Outsourced Development
Query-first control card for A.8.30 Outsourced Development. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.31 Separation of Development Test and Production Environments
Query-first control card for A.8.31 Separation of Development Test and Production Environments. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.32 Change Management
Query-first control card for A.8.32 Change Management. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.33 Test Information
Query-first control card for A.8.33 Test Information. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.34 Protection of Information Systems During Audit Testing
Query-first control card for A.8.34 Protection of Information Systems During Audit Testing. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.4 Access to Source Code
Query-first control card for A.8.4 Access to Source Code. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.5 Secure Authentication
Query-first control card for A.8.5 Secure Authentication. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.6 Capacity Management
Query-first control card for A.8.6 Capacity Management. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.7 Protection Against Malware
Query-first control card for A.8.7 Protection Against Malware. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.8 Management of Technical Vulnerabilities
Query-first control card for A.8.8 Management of Technical Vulnerabilities. Use the linked detailed note for mentor-style implementation and audit guidance.
ISO27001-A.8.9 Configuration Management
Query-first control card for A.8.9 Configuration Management. Use the linked detailed note for mentor-style implementation and audit guidance.
Section
Evidence Library
4 notes across 1 subsections
Research Notes
4 notesEVID-0001 Monthly Threat Intelligence Review
Monthly review record documenting relevant threats, advisories, indicators, affected assets, and follow-up actions.
EVID-0002 IOC Update Record
Record showing which indicators of compromise were received, assessed for relevance, and added to detection or blocking workflows.
EVID-0003 SIEM Rule Update
Record showing a SIEM rule, detection query, alert condition, or correlation rule updated because of relevant threat intelligence.
EVID-0004 Vendor Advisory Review
Record showing vendor advisories reviewed for relevance to organizational assets, exposures, and risk treatment.
Section
ISO 27005 Risk Guide
2 notes across 2 subsections
Maps of Content
1 notesISO 27005 Risk Management Guide
This guide is the ISO/IEC 27005 view of the vault. It will grow as you provide more risk-management material.
Framework Notes
1 notesISO 27005 Risk Process Notes
ISO/IEC 27005 gives guidance for managing information security risk in support of an ISO/IEC 27001 ISMS. It helps turn risk thinking into a repeatable process for deciding what...
Section
Crosswalks
6 notes across 1 subsections
Framework Notes
6 notesGDPR to ISO 27001 Engineering Crosswalk
A responsibility-aware map from GDPR obligations to ISO 27001 governance and Annex A controls without treating ISO certification as proof of GDPR compliance.
A.5 Controls Implementation Audit Risk Mapping
This table maps each covered A.5 organizational control to implementation output, audit evidence, and ISO/IEC 27005-style risk logic.
A.6 People Controls Implementation Audit Risk Mapping
- A.6 controls are people-risk treatments. They reduce the chance that the wrong person is trusted or that the right person lacks clear obligations. - A.6 evidence often sits ou...
A.7 Physical Controls Implementation Audit Risk Mapping
- Physical controls often fail through behavior, not technology. Observation and walkthrough evidence matter. - Physical controls should align to asset inventory, classification...
A.8 Technological Controls Implementation Audit Risk Mapping
- A.8 controls require technical evidence. Policies are not enough. - Endpoint controls connect to remote working, off-premises assets, and incident reporting. - Privileged acce...
ISO 27001 Implementer Auditor ISO 27005 Mapping
1. implementer view: what to build; 2. auditor view: what to verify; 3. ISO/IEC 27005 view: what risk logic supports the decision.
Section
Exam Preparation
41 notes across 1 subsections
Exam Notes
41 notesEXAM-016 - People Controls: Screening and Employment Terms
- Screening must be lawful, ethical, proportional, and risk-based. - Screening applies to employees, contractors, temporary staff, and third-party users in ISMS scope. - Candida...
EXAM-017 - Awareness, Education and Training
A.6.3 Information Security Awareness Education and Training asks whether the right people receive the right security knowledge at the right time, with updates when things change.
EXAM-018 - Disciplinary, Termination, and Confidentiality
- A.6.4 requires a formalized and communicated disciplinary process, not ad hoc manager action. - A.6.4 should be evidence-based, fair, consistent, and proportionate. - A.6.5 co...
EXAM-019 - Remote Working and Event Reporting
- Remote working is broader than VPN or remote access. - Remote work controls include physical environment, endpoint, secure connection, access, asset inventory, user awareness,...
EXAM-020 - Physical Perimeters and Entry
- A.7.1 is about defined and used security perimeters. - A.7.2 is about entry controls and access points for secure areas. - Physical controls protect confidentiality, integrity...
EXAM-021 - Room Security and Physical Monitoring
- A.7.3 is risk-based physical design for offices, rooms, and facilities. - A.7.3 includes avoiding visible clues to sensitive targets, such as server-room signs or exposed dire...
EXAM-022 - Environmental Threats, Secure Areas, and Clear Desk
- A.7.5 is not just fire safety; it covers physical and environmental threats to infrastructure. - A.7.5 should link to risk assessment, specialist advice, and business continui...
EXAM-023 - Equipment Siting and Protection
- A.7.8 is broader than server room protection. - Equipment siting includes workstations, network devices, terminals, screens, communications equipment, and remote equipment. -...
EXAM-024 - Off-Premises Assets and Storage Media
- A.7.9 is not only remote access. It includes equipment, documents, data, software, paper, mobile devices, BYOD, custody, and return. - A.7.9 allows risk acceptance where off-s...
EXAM-025 - Supporting Utilities
- A.7.11 is not only electricity. - UPS or generator existence is weak unless capacity, runtime, maintenance, and tests match documented requirements. - Cooling must be included...
EXAM-026 - Cabling, Maintenance, and Equipment Disposal
- A.7.12 is not just tidy cable management; it covers interception, interference, and damage. - A.7.13 is not only availability; maintenance can expose data or introduce tamperi...
EXAM-027 - Endpoint, Privileged Access, and Information Access Restriction
- A.8.1 is not just anti-malware or laptop encryption. - BYOD is in scope when it accesses organizational information. - VPN does not solve endpoint security by itself. - A.8.2...
EXAM-028 - Source Code, Authentication, and Capacity
- A.8.4 includes development tools and software libraries, not only Git repositories. - Read access to source code can still be sensitive because it reveals system design and co...
EXAM-029 - Malware Protection
- Antivirus installation alone is not enough. - Malware risk is not limited to Windows endpoints. - User awareness is explicitly part of the control. - Automatic cleaning still...
EXAM-030 - Vulnerability and Configuration Management
- A.8.8 is not just scanning or patching. - Vulnerability remediation should be risk-based and verified by retest. - Penetration testing supplements vulnerability management; it...
EXAM-031 - Deletion and Data Masking
- A.8.10 is not only physical media destruction. - Retention policy alone is weak without deletion evidence. - Items awaiting destruction still need protection. - Masking is not...
EXAM-032 - DLP and Backup
- DLP is not just a tool. - DLP requires knowing sensitive data and approved flows. - False positives affect DLP effectiveness. - Backup job success is not restore success. - Ba...
EXAM-033 - Redundancy and Logging
- A.8.14 does not require full redundancy for every system. - Backup is not the same as redundancy. - Cloud resilience still needs design and testing evidence. - A.8.15 is not o...
EXAM-034 - Monitoring Activities
- Treating log collection as full monitoring. - Assuming vendor default detection rules are sufficient. - Treating every alert as an incident without triage. - Ignoring monitori...
EXAM-035 - Software Installation and Network Security
- Treating developer skill as a substitute for production change control. - Assuming emergency production changes do not need records. - Treating licence and support checks as u...
EXAM-036 - Network Services, Segregation, and Web Filtering
- Treating provider service use as provider-owned risk. - Treating uptime SLAs as full network service security. - Treating perimeter firewalls as sufficient segregation. - Assu...
EXAM-037 - Use of Cryptography
- Assuming encryption alone satisfies the control. - Ignoring key lifecycle management. - Treating public keys and certificates as needing no integrity protection. - Selecting s...
EXAM-038 - Secure Development and Architecture
- Treating secure SDLC as only code scanning. - Treating acquired applications as outside application security requirements. - Treating architecture principles as generic slogan...
EXAM-039 - Secure Coding and Security Testing
- Treating secure SDLC as identical to secure coding. - Treating automated tools as complete proof of secure coding. - Treating functional testing as security testing. - Leaving...
EXAM-040 - Outsourced Development and Environment Separation
- Assuming a supplier contract alone satisfies outsourced development control. - Treating supplier security as fully delegated. - Accepting supplier deliverables based only on f...
EXAM-041 - Change Test Information and Audit Testing
- Treating approval alone as full change management. - Treating emergency changes as exempt from control. - Treating test data as low risk because it is outside production. - Ig...
EXAM-014 - Records, Privacy, and PII
These controls are easy to confuse because both involve retained information. The exam distinction is purpose: records protection is about preserving required records; privacy/P...
EXAM-015 - Assurance, Compliance, and Operating Procedures
These controls close the A.5 organizational control set by checking whether the ISMS is independently reviewed, whether policies and standards are followed, and whether operatin...
EXAM-001 - Clauses 4-10 vs Annex A
The exam often tests whether you understand the difference between mandatory management-system requirements and risk-selected controls.
EXAM-002 - Statement of Applicability
The Statement of Applicability explains which Annex A controls apply, which do not, why those decisions were made, and whether selected controls are implemented.
EXAM-003 - ISO 27002 Control Attributes
ISO/IEC 27002 attributes help categorize controls by properties such as control type, information security properties, cybersecurity concepts, operational capabilities, and secu...
EXAM-004 - Policy vs Procedure vs Standard
The exam may use policy, procedure, guideline, and standard loosely. Answer based on function, not title.
EXAM-005 - Responsibility vs Accountability
Roles and responsibilities must be defined, communicated, accepted, and kept current. Managers remain accountable for ensuring security requirements are followed in their area.
EXAM-006 - Implementation vs Audit Evidence
The exam often tests the difference between intent, documentation, and operating evidence.
EXAM-007 - Preventive vs Detective vs Corrective Controls
Control type matters because risk treatment should match the desired risk effect.
EXAM-008 - Supplier and Cloud Control Distinctions
Supplier and cloud controls overlap in practice, but the exam often tests the distinction between supplier risk management, contractual requirements, supply chain dependencies,...
EXAM-009 - Access, Identity, Authentication, and Rights
The access-related controls form a chain: define access rules, manage identities, protect authentication secrets, and grant/review/remove actual access rights.
EXAM-010 - Incident Management Planning
Incident management planning defines roles, reporting paths, escalation, communications, evidence handling, recovery coordination, and lessons learned before an incident occurs.
EXAM-011 - Incident Management Lifecycle
A.5.24 to A.5.28 form a practical lifecycle for incident management. Each control tests a different part of the lifecycle.
EXAM-012 - Continuity Security and ICT Readiness
A.5.29 and A.5.30 are related but not interchangeable. One protects security during disruption; the other ensures ICT availability and recovery capability.
EXAM-013 - Legal, IP, and Contractual Compliance
These controls are compliance-heavy. The exam may test whether the organization can prove obligations are known, current, owned, mapped to controls, and evidenced.
Section
ISO 27001 Knowledge Base
2 notes across 2 subsections
Maps of Content
1 notesISO 27001 Knowledge Base
ISO/IEC 27001 is the requirements standard. It defines the management-system requirements, the risk-based control selection requirement, and Annex A as the control reference set...
Knowledge Base
1 notesISO 27001 Requirements to Implementation and Audit Map
This map keeps the ISO/IEC 27001 requirement view separate from the implementer and auditor views.
Section
ISO 27002 Knowledge Base
3 notes across 2 subsections
Maps of Content
1 notesISO 27002 Knowledge Base
ISO/IEC 27002 provides guidance for information security controls. In this KB, it supports interpretation of ISO/IEC 27001 Annex A controls, evidence expectations, implementatio...
Knowledge Base
2 notesISO 27002 Annex A Control Interpretation Map
This map separates the ISO/IEC 27002 interpretation layer from the ISO/IEC 27001 requirement layer.
ISO 27002 Control Attributes Evidence Map
This note explains how ISO/IEC 27002 control attributes should be used in this KB.
Section
ISO 27005 Knowledge Base
1 notes across 1 subsections
Maps of Content
1 notesISO 27005 Knowledge Base
ISO/IEC 27005 is the risk-management companion for this project. It supports ISO/IEC 27001 implementation by making risk context, risk assessment, risk treatment, residual risk,...
Section
GRC Knowledge Model
3 notes across 2 subsections
Maps of Content
2 notesGRC Knowledge Model
This section turns the ISO learning notes into a future compliance/evidence software model.
Risk Knowledge Base
This section holds reusable risk knowledge for ISO/IEC 27005-style analysis and future GRC software modeling.
Research Notes
1 notesAsset Threat Vulnerability Risk Control Evidence Data Model
This note defines the practical data chain for the KB and future software model.
Section
Gdpr
6 notes across 1 subsections
Framework Notes
6 notesGDPR Accountability, ROPA, DPIA, and Privacy by Design
How Articles 24, 25, 30, and 35 become ownership, processing records, design gates, DPIAs, and reviewable evidence.
GDPR Lawful Bases and Processing Principles
How to select and document a lawful basis, apply Article 5 principles, control consent, and stop purpose or retention drift.
GDPR Processors, Subprocessors, and International Transfers
A practical control model for Article 28 contracts, processor due diligence, subprocessor changes, transfer safeguards, and service exit.
GDPR Scope, Roles, and Operating Model
A practical starting point for deciding whether GDPR applies, identifying controller and processor roles, and turning legal scope into system ownership.
GDPR Security and Personal Data Breach Response
A risk-based Article 32 control model and an evidence-driven workflow for assessing, recording, notifying, and learning from personal-data breaches.
GDPR Transparency and Data Subject Rights
An operational guide to privacy notices, identity verification, access, correction, deletion, restriction, portability, and objections.
Section
Templates
332 notes across 9 subsections
A.5 Audit Checklists
37 notesA.5.10 Audit Checklist
Use this during internal audits to verify that acceptable use and handling rules are defined, acknowledged, implemented, and enforced.
A.5.11 Audit Checklist
Use this during internal audits to verify that assets are returned during termination, contract end, agreement end, or role change.
A.5.12 Audit Checklist
Use this during internal audits to verify that information classification is defined, implemented, understood, and maintained.
A.5.13 Audit Checklist
Use this during internal audits to verify that information labelling procedures are defined and implemented in line with the classification scheme.
A.5.14 Audit Checklist
Use this during internal audits to verify that information transfer rules, procedures, and agreements are defined and implemented across actual transfer channels.
A.5.15 Audit Checklist
Use this during internal audits to verify that physical and logical access controls are defined, implemented, approved, and reviewed.
A.5.16 Audit Checklist
Use this during internal audits to verify that identities are managed across the full lifecycle.
A.5.17 Audit Checklist
Use this during internal audits to verify that secret authentication information is allocated and managed through a controlled process.
A.5.18 Audit Checklist
Use this during internal audits to verify that access rights are provisioned, reviewed, modified, and removed according to access control rules.
A.5.19 Audit Checklist
Use this during internal audits to verify that supplier information security risks are identified, assessed, controlled, and reviewed.
A.5.20 Audit Checklist
Use this during internal audits to verify that supplier security requirements are formally agreed and appropriate to the supplier relationship.
A.5.21 Audit Checklist
Use this during internal audits to verify that ICT supply-chain dependencies and inherited security risks are identified and managed.
A.5.22 Audit Checklist
Use this during internal audits to verify that supplier services and security practices are monitored, reviewed, evaluated, and changed through a controlled process.
A.5.23 Audit Checklist
Use this during internal audits to verify that cloud services are acquired, used, managed, and exited according to information security requirements.
A.5.24 Audit Checklist
Use this during internal audits to verify that incident management planning and preparation are defined, communicated, and ready to operate.
A.5.25 Audit Checklist
Use this during internal audits to test whether A.5.25 Assessment and Decision on Information Security Events is designed, implemented, operating, and evidenced.
A.5.26 Audit Checklist
Use this during internal audits to test whether A.5.26 Response to Information Security Incidents is designed, implemented, operating, and evidenced.
A.5.27 Audit Checklist
Use this during internal audits to test whether A.5.27 Learning from Information Security Incidents is designed, implemented, operating, and evidenced.
A.5.28 Audit Checklist
Use this during internal audits to test whether A.5.28 Collection of Evidence is designed, implemented, operating, and evidenced.
A.5.29 Audit Checklist
Use this during internal audits to test whether A.5.29 Information Security During Disruption is designed, implemented, operating, and evidenced.
A.5.30 Audit Checklist
Use this during internal audits to test whether A.5.30 ICT Readiness for Business Continuity is designed, implemented, operating, and evidenced.
A.5.31 Audit Checklist
Use this during internal audits to test whether A.5.31 Legal, Statutory, Regulatory and Contractual Requirements is designed, implemented, operating, and evidenced.
A.5.32 Audit Checklist
Use this during internal audits to test whether A.5.32 Intellectual Property Rights is designed, implemented, operating, and evidenced.
A.5.33 Audit Checklist
Use this during internal audits to test whether A.5.33 Protection of Records is designed, implemented, operating, and evidenced.
A.5.34 Audit Checklist
Use this during internal audits to test whether A.5.34 Privacy and Protection of PII is designed, implemented, operating, and evidenced.
A.5.35 Audit Checklist
Use this during internal audits to test whether A.5.35 Independent Review of Information Security is designed, implemented, operating, and evidenced.
A.5.36 Audit Checklist
Use this during internal audits to test whether A.5.36 Compliance with Policies, Rules and Standards for Information Security is designed, implemented, operating, and evidenced.
A.5.37 Audit Checklist
Use this during internal audits to test whether A.5.37 Documented Operating Procedures is designed, implemented, operating, and evidenced.
A.5.5 Audit Checklist
Use this during internal audits to test whether relevant authority contacts are identified, maintained, authorized, and usable.
A.5.6 Audit Checklist
Use this during internal audits to verify that the organization maintains relevant external security knowledge contacts and uses received information appropriately.
A.5.7 Audit Checklist
Use this during internal audits to verify that threat information is collected, analyzed, contextualized, and used to support ISMS decisions.
A.5.8 Audit Checklist
Use this during internal audits to verify that information security is embedded in project governance and applied to sampled projects.
A.5.9 Audit Checklist
Use this during internal audits to verify that information and associated assets are inventoried, owned, maintained, and protected.
Template - A.5.1 Audit Checklist
Research note.
Template - A.5.2 Audit Checklist
Research note.
Template - A.5.3 Audit Checklist
Research note.
Template - A.5.4 Audit Checklist
Research note.
A.6 Audit Checklists
8 notesA.6.1 Audit Checklist
- Confirm the organization has a documented screening procedure. - Confirm screening applies to employees, contractors, temporary staff, and third-party users in ISMS scope. - C...
A.6.2 Audit Checklist
Use this checklist during an internal audit of employment, contractor, and third-party security responsibility terms.
A.6.3 Audit Checklist
Use this checklist during an internal audit of information security awareness, education, training, and update processes.
A.6.4 Audit Checklist
Use this checklist during an internal audit of disciplinary handling for information security policy violations.
A.6.5 Audit Checklist
Use this checklist during an internal audit of leaver, mover, contractor offboarding, and continuing responsibility controls.
A.6.6 Audit Checklist
Use this checklist during an internal audit of confidentiality and non-disclosure agreement controls.
A.6.7 Audit Checklist
- Confirm remote working policy and procedures exist. - Confirm authorized remote workers, locations, activities, data, and controls are recorded. - Check remote working risk as...
A.6.8 Audit Checklist
Use this checklist during an internal audit of information security event reporting.
A.7 Audit Checklists
14 notesA.7.1 Audit Checklist
- Confirm physical security perimeters are defined. - Confirm zones are linked to information/assets and risk. - Review perimeter diagrams or zone register. - Walk the perimeter...
A.7.10 Audit Checklist
Use this checklist during an internal audit of storage media acquisition, use, transport, storage, disposal, destruction, and damaged-media handling.
A.7.11 Audit Checklist
Use this checklist during an internal audit of power, cooling, telecommunications, water, emergency lighting, fire protection, and building-management utility resilience.
A.7.12 Audit Checklist
Use this checklist during an internal audit of power, data, telecommunications, and supporting service cabling.
A.7.13 Audit Checklist
Use this checklist during an internal audit of equipment maintenance and repair controls.
A.7.14 Audit Checklist
Use this checklist during an internal audit of equipment disposal, reuse, sale, donation, recycling, or repair dispatch.
A.7.2 Audit Checklist
- Confirm secure areas are identified. - Confirm entry controls match risk and sensitivity. - Review physical access authorization and logs. - Check physical access review recor...
A.7.3 Audit Checklist
Use this checklist during an internal audit of physical security design for offices, rooms, and facilities.
A.7.4 Audit Checklist
- Confirm premises monitoring scope is documented. - Confirm monitoring is continuous where required. - Review monitoring service or personnel responsibilities. - Check alarm re...
A.7.5 Audit Checklist
Use this checklist during an internal audit of physical and environmental threat protection.
A.7.6 Audit Checklist
Use this checklist during an internal audit of work performed inside secure areas.
A.7.7 Audit Checklist
Use this checklist during an internal audit of clear desk, clear screen, printer, fax, and unattended information controls.
A.7.8 Audit Checklist
Use this checklist during an internal audit of equipment siting, physical protection, environmental exposure, and remote equipment scope.
A.7.9 Audit Checklist
Use this checklist during an internal audit of assets taken, used, stored, or accessed outside organization premises.
Templates
75 notesApplication Security Requirements Approval Record
Use this record to show business, system owner, and security approval of application security requirements.
Audit Tool Validation Record
Use this record when approving or validating tools used for audit testing, scanning, extraction, or assurance activities on operational systems.
Authentication Exception and Compensating Control Record
Use this record when a system cannot meet the secure authentication standard and needs risk acceptance or compensating controls.
Availability Requirement Mapping
Use this matrix to connect business availability requirements to redundancy, backup, capacity, and continuity controls.
Backup and Restore Test Record
Use this record to prove backup restore capability was tested without compromising live data.
Building Management System Security Review
Use this review where building management systems are in ISMS scope or can affect information processing facilities.
Certificate Authority and Certificate Review
Use this review for internal or external certificate authorities, public-key certificates, TLS certificates, signing certificates, and certificate lifecycle checks.
Change Request and Security Impact Assessment
- Access control impact reviewed. - Logging/monitoring impact reviewed. - Backup/recovery impact reviewed. - Vulnerability or configuration impact reviewed. - Supplier or integr...
Configuration Drift Alert Review Record
Use this record when configuration monitoring identifies drift from an approved baseline.
Configuration Exception and Risk Acceptance Record
Use this record when a system cannot comply with an approved configuration baseline and the deviation needs risk-based approval.
Cryptographic Legal Requirements Assessment
Use this when encryption, digital signatures, electronic communications, key management, or cross-border services may be affected by legal or regulatory rules.
Damaged Media Handling Decision Record
Use this record before sending damaged media for repair, manufacturer return, warranty replacement, disposal, or destruction.
DLP Alert Review and Tuning Log
Use this log to record DLP alerts, false positives, prioritization, tuning decisions, and escalation.
Dynamic Privilege Session Record
Use this record when temporary elevated access, remote support control, third-party troubleshooting, or dynamic privilege is granted to access information or functions.
Emergency Change Record
Use this record when an urgent operational or security situation requires a change outside the normal approval cycle.
Emergency Privileged Access Record
Use this record when emergency or break-glass privileged access is issued or used.
Equipment Siting and Protection Assessment
Use this template when placing, reviewing, relocating, or risk-assessing equipment that processes, stores, transmits, or displays information.
Evidence Collection and Chain of Custody Log
Use this when evidence related to an information security event may need to support investigation, legal action, regulatory response, disciplinary action, insurance, or formal r...
ICT Continuity Requirements and Test Record
Use this to document ICT continuity requirements, recovery priorities, RTO/RPO expectations, test results, and improvement actions.
Incident Response Record
Use this to record incident response decisions, actions, approvals, communications, evidence decisions, containment, recovery, and closure.
Information and Associated Asset Inventory
Use this to maintain the inventory required by A.5.9 for information and associated assets, including owners, custodians, classification, location, backup/recovery, retention, a...
Information Security Continuity Requirements
Use this to define the minimum information security requirements that must remain in place during disruption, crisis response, disaster recovery, or business continuity events.
Information Security Event Report Form
Use this form to report observed or suspected information security events or weaknesses.
Log Review and Alert Triage Record
Use this record to document log review, alert triage, security impact assessment, escalation, and closure.
Long-Term Asset Loan Attestation
Use this attestation for assets assigned off-premises for an extended period, such as home-worker equipment or long-term project equipment.
Maintenance Access and Tamper Check Record
Use this record when internal or external personnel perform maintenance on equipment that can affect information security.
Malware Infection Response Record
Use this record when malware is suspected or confirmed and the organization needs evidence of detection, containment, cleaning/rebuild, verification, and lessons learned.
Monitoring Alert Threshold Review
Use this record to review whether monitoring thresholds create useful alerts without hiding real incidents or overwhelming the response team.
Monitoring Coverage and Data Source Map
Use this map to prove which networks, systems, applications, cloud services, and security tools feed the monitoring process.
Network Device Configuration and Change Review
Use this record to review firewall, router, switch, VPN, wireless, SD-WAN, load balancer, or virtual network device configuration and changes.
Network Service SLA and Security Feature Review
Use this review before contracting, renewing, or materially changing a network service.
Office Room and Facility Security Assessment
Use this assessment to determine physical security controls for offices, rooms, and facilities based on the information and assets inside them.
Operational Software Release and Installation Record
Use this record for each approved software installation or update on operational systems.
Personnel Security Responsibility Acknowledgement
Use this acknowledgement during onboarding, contractor setup, role change, or access expansion to record acceptance of security responsibilities.
Physical and Environmental Threat Assessment
Use this template to assess site, building, room, utility, and neighboring-premises hazards that could affect information assets or ICT continuity.
Physical Entry Access Review
Use this template to review physical access rights for secure areas, badges, keys, cards, PINs, or biometric access.
Physical Security Alarm Test Record
Use this record to document tests of physical alarms, monitoring services, notification chains, and escalation response.
Re-Identification Risk Assessment
Use this assessment when data is claimed to be anonymised or when combinations of fields may still identify individuals.
Redundancy Failover Test Record
Use this record to prove failover or redundancy testing met availability requirements.
Remote Working Risk Assessment
Use this template to assess remote working risk for a role, location type, activity, system, or information classification.
Secure Code Review Record
Use this record to document secure code review, reviewer independence, findings, and remediation.
Secure Coding Exception Record
Use this record when secure coding rules cannot be fully applied because of legacy constraints, technology limits, or justified operational need.
Security Acceptance Sign-Off Record
- Acceptance criteria are met or exceptions approved. - High-risk findings are closed or formally accepted. - Operations readiness is confirmed. - User/security training is comp...
Security Architecture Review Record
Use this record to document architecture review against secure engineering principles.
Security Engineering Deviation Record
Use this record when a system design deviates from approved secure architecture or engineering principles.
Security Test Results and Remediation Tracker
Use this tracker to record security test findings, remediation, retesting, and residual risk acceptance.
Security Training Record
Use this record for individual or group training evidence. Avoid storing unnecessary personal data in the vault if HR systems hold the authoritative record.
Sensitive Data Transfer Approval Record
Use this record when sensitive information needs to be transferred outside normal approved flows or to an external party.
Sensitive Room Signage and Directory Review
Use this checklist to review whether signs, directories, phone lists, notice boards, or visible labels reveal sensitive targets or access information.
Software and Content Licence Compliance Inventory
Use this to reconcile software, development tools, libraries, subscription content, and licensed resources against actual use.
Storage Media Movement Log
Use this log when storage media is removed, transported, couriered, archived, delivered, or returned.
Supplier Development Evidence Request List
Use this list when preparing an internal audit, supplier review, or acceptance review for outsourced development.
Supplier Security Risk Assessment
Use this before onboarding or materially changing a supplier relationship, and during periodic supplier review.
Supplier Service Review and Change Log
Use this to record periodic supplier reviews, security report reviews, service delivery issues, supplier changes, incidents, and follow-up actions.
Supporting Utility Inspection and Test Log
Use this log to record inspections, tests, maintenance, alarms, and corrective actions for supporting utilities.
Template - Control Attribute Review
Use this when reviewing whether a selected control matches the intended risk treatment effect.
Template - Control Balance Analysis
Research note.
Template - Corrective Action Tracker
Use this to track nonconformities, audit findings, policy violations, or control weaknesses.
Template - Evidence Request List
Research note.
Template - Information Security Role Definition
Use this for roles with significant information security responsibilities, such as system owner, asset owner, administrator, incident manager, vendor owner, or risk owner.
Template - Internal Audit Interview Question Bank
- Where can you find the information security policy? - What are your main information security responsibilities? - How do you report a suspected security incident? - What secur...
Template - Management Responsibilities Interview Questions
- What are your information security responsibilities? - How do you ensure your team follows information security policies? - How do you know your team completed required traini...
Template - Manager Security Accountability Statement
Use this in manager role descriptions, policy addenda, or management training packs.
Template - Risk and Control Mapping Table
Use this to link risks, treatment objectives, controls, control attributes, owners, and evidence.
Template - Role and Responsibility Interview Questions
- What are your basic information security responsibilities? - Where can you find the information security policy? - How do you report a suspected incident? - What should you do...
Template - Security Responsibilities Addendum
Use this as an addendum to job descriptions, employee handbooks, contractor onboarding packs, or role profiles.
Template - Segregation of Duties Exception Record
Use this when full segregation of duties is not practical and compensating controls are required.
Template - Statement of Applicability Support Table
Research note.
Test Data Security Approval Record
Use this record before production or sensitive data is copied into development, test, staging, analytics, or supplier environments.
UPS and Generator Capacity Test Record
Use this record to verify whether UPS and generator capacity matches the documented availability and continuity requirements.
Virtual Network and Hypervisor Security Review
Use this checklist when reviewing virtual networks, cloud networks, hypervisors, security groups, route tables, virtual firewalls, or management planes.
Visitor Access Log
Research note.
Vulnerability Exception and Risk Acceptance Record
Use this record when a vulnerability will not be remediated within the normal timeframe and requires risk-based exception approval.
Web Filtering Coverage Review
Use this review to verify that web filtering applies to required users, devices, locations, remote-working scenarios, and network paths.
Wireless Network Security Assessment
Use this assessment when wireless networks connect to organizational networks or provide access to business systems.
Template Forms
5 notesTemplate Clause Note
Use this when creating an ISO/IEC 27001 clause note under the ISO 27001 knowledge base.
Template Control Card
Use this when creating a reusable control card that maps ISO/IEC 27001 Annex A, ISO/IEC 27002 guidance, ISO/IEC 27005 risk logic, evidence, audit questions, and software objects.
Template Evidence Item
Use this when defining an evidence item for an audit, control, risk treatment, or future GRC data model.
Template Risk Scenario
markdown type: risk-scenario asset: "" threat: "" vulnerability: "" risk level: "" likelihood: "" impact: "" treatment option: "" related controls: evidence required: owner: ""...
Template Weekly Review
Use this at the end of each study week to keep learning, artifacts, mappings, and weak areas connected.
Checklists
91 notesA.8.1 Audit Checklist
- Review endpoint policy and device security standard. - Confirm endpoint inventory includes corporate and BYOD devices. - Sample endpoint compliance reports. - Check patch, mal...
A.8.10 Audit Checklist
Use this checklist during an internal audit of retention, deletion, destruction, cloud deletion, backup deletion, and media awaiting destruction.
A.8.11 Audit Checklist
Use this checklist during an internal audit of masking, pseudonymisation, tokenisation, anonymisation, re-combination, and re-identification controls.
A.8.12 Audit Checklist
Use this checklist during an internal audit of DLP scope, data flows, DLP rules, alert handling, transfer approvals, and user awareness.
A.8.13 Audit Checklist
Use this checklist during an internal audit of backup scope, schedule, protection, job monitoring, restore testing, archive recoverability, and corrective action.
A.8.14 Audit Checklist
Use this checklist during an internal audit of redundancy requirements, architecture, failover testing, recovery performance, and redundancy-related risk.
A.8.15 Audit Checklist
Use this checklist during an internal audit of log generation, storage, protection, retention, analysis, alerting, and corrective action.
A.8.16 Audit Checklist
Use this checklist during an internal audit of security monitoring, alerting, anomaly detection, triage, escalation, and incident evaluation.
A.8.19 Audit Checklist
Use this checklist during an internal audit of software installation, release, testing, licence, support, and rollback controls for operational systems.
A.8.2 Audit Checklist
Use this checklist during an internal audit of privileged access allocation, use, monitoring, emergency access, and removal.
A.8.20 Audit Checklist
Use this checklist during an internal audit of network architecture, device security, zoning, routing, virtual networks, monitoring, and change control.
A.8.21 Audit Checklist
Use this checklist during an internal audit of network service security mechanisms, service levels, service requirements, provider controls, and monitoring.
A.8.22 Audit Checklist
Use this checklist during an internal audit of network zones, inter-zone controls, wireless segregation, segmentation tests, and exceptions.
A.8.23 Audit Checklist
Use this checklist during an internal audit of web filtering policy, tool configuration, coverage, exceptions, bypass resistance, monitoring, and awareness.
A.8.24 Audit Checklist
Use this checklist during an internal audit of cryptographic policy, approved algorithms, key management, certificate handling, legal requirements, and escrow/recovery.
A.8.25 Audit Checklist
Use this checklist during an internal audit of secure development rules, competence, code review, vulnerability follow-up, and supplier development.
A.8.26 Audit Checklist
Use this checklist during an internal audit of application security requirements for developed or acquired applications.
A.8.27 Audit Checklist
Use this checklist during an internal audit of secure architecture and engineering principles.
A.8.28 Audit Checklist
Use this checklist during an internal audit of secure coding principles, standards, tools, reviews, generated code, and exceptions.
A.8.29 Audit Checklist
Use this checklist during an internal audit of security testing in development and acceptance.
A.8.3 Audit Checklist
Use this checklist during an internal audit of application, database, report, export, print, maintenance utility, and dynamic privilege access restrictions.
A.8.30 Audit Checklist
- Outsourced development scope is identified. - Supplier development risk assessment exists. - Contract/SOW includes security requirements. - IP ownership and licence obligation...
A.8.31 Audit Checklist
Use this checklist when auditing separation of development, test, staging, and production environments.
A.8.32 Audit Checklist
Use this checklist when auditing change management for information systems and information processing facilities.
A.8.33 Audit Checklist
Use this checklist when auditing selection, protection, management, and deletion of test information.
A.8.34 Audit Checklist
Use this checklist when auditing protection of operational systems during audit testing and assurance activities.
A.8.4 Audit Checklist
Use this checklist during an internal audit of source code, development tools, software libraries, and code-impacting scripts or macros.
A.8.5 Audit Checklist
Use this checklist during an internal audit of authentication mechanisms, MFA, failed logon controls, recovery flows, and authentication exceptions.
A.8.6 Audit Checklist
Use this checklist during an internal audit of resource monitoring, trend analysis, capacity forecasting, scaling, tuning, and staffing capacity.
A.8.7 Audit Checklist
Use this checklist during an internal audit of malware protection deployment, update status, scanning, infection response, and user awareness.
A.8.8 Audit Checklist
Use this checklist during an internal audit of vulnerability intelligence, scanning, risk evaluation, remediation, patching, exceptions, and retesting.
A.8.9 Audit Checklist
Use this checklist during an internal audit of secure configuration baselines, implementation, monitoring, exceptions, and review.
Access Review Checklist
Use this for periodic reviews of logical or physical access to systems, repositories, applications, networks, cloud platforms, and sensitive locations.
AI-Generated Code Security Review Checklist
Use this checklist when code, scripts, infrastructure-as-code, tests, or configuration snippets are generated by AI or other automated code-generation tools.
AI-Generated Content IP Review Checklist
Use this before externally using AI-generated or AI-assisted material in policies, templates, consulting deliverables, training, marketing, software, or client work.
Application Transaction Security Checklist
Use this checklist for applications that perform payments, customer transactions, public-network transactions, or legally significant actions.
Asset Return Checklist
Use this when an employee, contractor, third-party user, or other relevant party leaves, changes role, ends a contract, or no longer requires organizational assets.
Authentication Mechanism Review Checklist
Use this checklist during design review, audit preparation, or system assessment to test whether authentication behavior is secure.
Background Verification Checklist
Use this checklist during hiring, contractor onboarding, or role change into a higher-risk position.
Cabling Inspection Checklist
Use this checklist during physical walkthroughs to verify cabling is protected from interception, interference, damage, and unsafe installation.
Clear Desk and Clear Screen Checklist
Use this checklist for routine clear desk and clear screen inspections, especially in shared offices, visitor-exposed areas, and areas handling sensitive information.
Cloud and Backup Deletion Checklist
Use this checklist when verifying deletion of information from cloud services, backups, archives, snapshots, or replicated storage.
Cloud Security Requirements and Exit Checklist
Use this before acquiring a cloud service, during periodic cloud review, and before exiting or migrating from a cloud provider.
Confidentiality Agreement Review Checklist
Use this checklist to review NDA/confidentiality agreement needs, content, signing, enforceability, and review status.
Configuration Compliance Review Checklist
Use this checklist to compare systems against approved configuration baselines and record compliance gaps.
Critical System Capacity Review Checklist
Use this checklist for periodic review of capacity risks in critical systems, cloud services, networks, databases, and support teams.
Delivery and Loading Area Security Checklist
Use this checklist to control deliveries, collections, loading bays, and goods movement into or out of secure areas.
Development Test Production Separation Checklist
Use this checklist to review whether development, test, staging, and production separation is real and enforceable.
Development Tool and Library Integrity Checklist
Use this checklist to review compilers, build tools, CI/CD runners, package sources, dependency registries, and library integrity controls.
Disciplinary Process Checklist
Use this checklist when reviewing whether the disciplinary process can fairly handle information security policy violations.
Endpoint Loss or Theft Response Checklist
Use this checklist when a laptop, phone, tablet, or other endpoint device is lost, stolen, or suspected compromised.
Environmental Protection Inspection Checklist
Use this checklist during site walkthroughs to confirm physical and environmental protections remain effective.
Equipment Protection Inspection Checklist
Use this checklist during physical walkthroughs to confirm equipment is still sited securely and protected from damage, interference, unauthorized access, and unauthorized viewing.
Equipment Sanitization Verification Checklist
Use this checklist before equipment containing storage media is reused, sold, donated, recycled, discarded, or transferred outside organizational control.
Information Access Restriction Review Checklist
Use this checklist to test whether application, database, reporting, export, and maintenance access restrictions match approved access rules.
Key Escrow and Emergency Recovery Checklist
Use this checklist when cryptographic keys must be recoverable for legal, operational, continuity, or organizational control reasons.
Leaver and Role Change Security Checklist
Use this checklist for employee leavers, contractor offboarding, third-party user removal, and internal role changes.
Log Integrity and Access Review Checklist
Use this checklist to review whether logs are protected against unauthorized modification, deletion, redirection, shutdown, and overwrite.
Long-Term Archive Recoverability Checklist
Use this checklist to verify that archived information can still be read and interpreted for legal, regulatory, or business retention requirements.
Malware Awareness Checklist
Use this checklist when designing or reviewing user awareness content for malware prevention and reporting.
Network Segmentation Test Checklist
Use this checklist to test that network zone boundaries block and allow traffic as intended.
Network Service Provider Review Checklist
Use this checklist during periodic review of supplier-provided network services.
Off-Premises Asset Protection Checklist
Use this checklist when approving, reviewing, or auditing assets used away from organization premises.
Operating Procedure Review and Change Checklist
Use this when creating, reviewing, or changing operating procedures for information processing facilities.
Out-of-Hours Monitoring Escalation Checklist
Use this checklist to define and test how monitoring alerts are handled outside normal business hours.
Outsourced Development Security Requirements Checklist
Use this checklist before signing or renewing a development contract, statement of work, or supplier delivery plan.
Patch Testing and Rollback Checklist
Use this checklist before applying patches where testing, change approval, outage planning, or rollback is required.
Physical Security Perimeter Review Checklist
Use this checklist during physical security reviews, office moves, layout changes, tenancy changes, or internal audits.
PII Handling and Access Review Checklist
Use this to review whether PII handling, access, transfer, retention, and training controls remain appropriate.
Printer and Fax Security Checklist
Use this checklist to review whether printers and fax machines expose sensitive information through location, unattended output, or weak secure-printing practices.
Privacy Breach Notification Readiness Checklist
Use this to test whether privacy breach notification obligations are known and can be acted on quickly. Verify specific legal deadlines and content requirements against official...
Privileged Access Review Checklist
Use this checklist during periodic reviews of privileged users, privileged roles, emergency access, and stale access.
Privileged Activity Log Review Checklist
Use this checklist to review privileged account activity logs for appropriate, authorized, and traceable use.
Records Inventory Review Checklist
Use this for the documented annual check that required records still exist, remain protected, and remain accessible through retention.
Remote Access and Endpoint Connection Checklist
Use this checklist to verify that endpoints connecting remotely meet security requirements before accessing organizational systems.
Remote Working Security Checklist
Use this checklist before approving remote work or during periodic review of remote working controls.
Repair Dispatch Data Protection Checklist
Use this checklist before sending equipment for repair, warranty return, vendor analysis, or replacement.
Secure Coding Compliance Review Checklist
Use this checklist to verify code against the applicable secure coding standard.
Secure Development Compliance Review Checklist
Use this checklist to verify that a project or development team follows secure development rules.
Security Acceptance Criteria Checklist
Use this checklist to define the security conditions that must be met before a system is accepted for operational use.
Security Terms and Conditions Checklist
Use this checklist when reviewing employment contracts, contractor terms, onboarding acknowledgements, or security addenda for A.6.2 coverage.
Sensitive Function and Export Control Checklist
Use this checklist when reviewing whether sensitive application functions, reports, downloads, exports, and print features are restricted according to access rules.
Software Licence and Support Verification Checklist
Use this checklist before acquiring or installing software on operational systems, and during periodic review of supported operational software.
Software Rollback and Fallback Checklist
Use this checklist before installing software on operational systems where failure could affect confidentiality, integrity, availability, or business service.
Source Code Change Control Checklist
Use this checklist when reviewing whether code, scripts, macros, reports, and database logic changes are controlled before release.
Supplier Security Agreement Requirements Checklist
Use this before signing or renewing supplier agreements where the supplier has access to information, systems, facilities, services, or security-relevant dependencies.
Template - Management Review Input Checklist
Research note.
Template - Management Security Responsibilities Checklist
Use this to verify whether managers are actively enforcing security requirements in their teams.
Template - Policy Review Checklist
Use this during planned policy reviews or event-driven reviews after significant changes.
Test Data Protection Checklist
Use this checklist before and after testing that involves sensitive, production-derived, personal, or confidential information.
Third-Party Information Transfer Agreement Checklist
Use this when sensitive information or software is exchanged with suppliers, customers, partners, regulators, contractors, or other third parties.
Registers
58 notesAccess Rights Request and Review Register
Use this to document access requests, approvals, provisioned rights, reviews, modifications, and removals.
Application Security Requirements Register
Use this register to document security requirements for developed, acquired, or changed applications.
Approved Sensitive Data Flow Register
Use this register to document approved sensitive data transfers, channels, protections, and authorization requirements.
Authority Contact Register
Use this to document and maintain official authority contacts required for incident response, breach notification, continuity, legal compliance, sector regulation, or emergency...
Backup Scope and Coverage Register
Use this register to confirm that important information, software, systems, configurations, and dependencies are covered by backups.
Cabling Route and Protection Register
Use this register to document important power, data, and supporting service cable routes and the protection applied to them.
Capacity Monitoring and Forecast Register
Use this register to record capacity metrics, trends, forecasts, thresholds, and planned actions.
Cloud Service Register
Use this to track approved cloud services, ownership, data exposure, shared responsibility, review status, and exit readiness.
Confidentiality Agreement Register
Use this register to track confidentiality and non-disclosure agreements for employees, contractors, temporary staff, third-party users, suppliers, partners, visitors, and other...
Configuration Baseline Register
Use this register to record approved configuration baselines and map them to systems, platforms, services, and networks.
Cryptographic Key Management Register
Use this register to track cryptographic keys, owners, purpose, storage, lifecycle dates, rotation, revocation, and destruction.
Cryptographic Use Case and Algorithm Register
Use this register to document where cryptography is used and whether the chosen algorithm, protocol, and key parameters are appropriate.
Data Masking Decision Register
Use this register to record where masking, pseudonymisation, tokenisation, or anonymisation is used and why.
DLP Scope and Rule Register
Use this register to define sensitive information in DLP scope and map DLP rules to systems, channels, and devices.
Endpoint Device Inventory and Compliance Register
Use this register to track user endpoint devices, custodians, ownership model, and security compliance.
Equipment Disposal and Reuse Register
Use this register to track equipment disposal, reuse, sale, donation, recycling, repair dispatch, or transfer where storage media or licensed software may be present.
Equipment Maintenance Register
Use this register to track equipment maintenance requirements, completed maintenance, fault history, and replacement indicators.
Event Triage and Incident Classification Register
Use this to record reported information security events and the decision on whether each event is an information security incident.
ICT Supply Chain Risk Register
Use this for critical ICT products and services where subcontractors, cloud platforms, hosting providers, software components, support parties, or other dependencies may affect...
Identity Lifecycle Register
Use this to track identity creation, changes, reviews, deactivation, deletion, and shared-identity exceptions.
Incident Lessons Learned Register
Use this after incidents or recurring events to capture what changed in controls, training, procedures, risk assessment, supplier management, or management review.
Information Deletion and Destruction Register
Use this register to record deletion or destruction of information, systems, storage media, backups, and cloud data.
Information Security Event Reporting Channel Register
Use this register to document approved event reporting channels, contact points, responsibilities, and availability.
Intellectual Property Rights Register
Use this to track protected software, documents, designs, source code, trademarks, patents, subscription content, and other intellectual property material used or created by the...
Legal and Contractual Requirements Register
Use this to identify, document, assign, review, and evidence legal, statutory, regulatory, and contractual information security requirements.
Log Source and Retention Register
Use this register to track log sources, event types, retention periods, protection methods, and review ownership.
Malware Protection Coverage and Update Register
Use this register to track malware protection deployment, update status, scan settings, and exceptions across systems.
Monitoring Detection Use Case Register
Use this register to translate risks and threat scenarios into concrete monitoring rules, alerts, thresholds, and response actions.
Network Monitoring and Corrective Action Register
Use this register to record network faults, suspicious events, monitoring alerts, problem records, and corrective actions.
Network Service Security Requirements Register
Use this register to define required security mechanisms, service levels, and service requirements for network services.
Off-Premises Asset Authorization Register
Use this register to authorize and track organization assets, information, software, or media taken outside controlled premises.
Operating Procedure Register
Use this to inventory operating procedures, owners, versions, approvals, users, and review dates.
Outsourced Development Review Register
Use this register to track ongoing supplier development reviews, issues, and acceptance decisions.
Personnel Screening Register
Use this register to track whether screening was completed for employees, contractors, temporary staff, and third-party users before joining or receiving sensitive access.
Physical Security False Alarm Register
Use this register to track repeated false alarms and corrective actions that prevent alarm fatigue.
Physical Security Zone Register
Use this register to define physical security zones, their purpose, protected assets, access routes, and perimeter controls.
Policy and Technical Compliance Review Register
Use this to track management compliance reviews, spot checks, technical compliance checks, findings, actions, and follow-up.
Policy Violation and Disciplinary Action Register
Use this register to track security policy violation cases, evidence review, decision, outcome, and closure.
Post-Employment Security Responsibilities Register
Use this register to track security responsibilities that continue after termination, contract end, or role change.
Privileged Access Register
Use this register to record privileged accounts, roles, approvals, scope, expiry, and review status.
Project Security Requirements Register
Use this for projects that build, buy, configure, integrate, outsource, or materially change systems, services, processes, suppliers, infrastructure, or data flows.
Records Retention and Protection Register
Use this to identify required records, retention periods, protection requirements, storage locations, access restrictions, readability dependencies, and disposal rules.
Redundancy Requirements and Architecture Register
Use this register to map availability requirements to implemented redundancy for critical information processing facilities.
Remote Equipment Register
Use this register to track equipment outside core premises, including branch, remote, home-office, customer-site, or supplier-hosted equipment within ISMS responsibility.
Remote Working Authorization Register
Use this register to track who is authorized to work remotely, from what location type, for which activities, with which data, equipment, and controls.
Secure Area Access Register
Use this register to track who is authorized to access secure areas and when physical access rights should be reviewed or removed.
Secure Area Work Authorization Register
Use this register to record approved sensitive work, authorized personnel, supervision needs, device restrictions, and dual-control requirements inside secure areas.
Secure Media Disposal and Destruction Register
Use this register to record erasure, destruction, disposal, contractor handoff, and verification for storage media that may contain organizational information.
Source Code Access Register
Use this register to record source repositories, access rights, owner approvals, and periodic review status.
Special Interest Group Participation Register
Use this to track the specialist security groups, forums, associations, advisories, and communities the organization uses to keep security knowledge current.
Supplier Security Register
Use this as the master security view of suppliers, products, and services that can affect information security.
Supporting Utility Dependency Register
Use this register to map critical facilities, services, and equipment to required supporting utilities and continuity expectations.
Template - Control Owner Register
Use this to map ISMS processes and controls to accountable owners, responsible teams, evidence, and review cycles.
Template - Policy Register
Use this to track policy ownership, approval, version control, review, and acknowledgement requirements.
Test Information Management Register
Use this register to track test data sets, their source, sensitivity, approval, protection, retention, and deletion.
Threat Intelligence Register
Use this to record threat information that has been reviewed, contextualized, and converted into intelligence for risk, control, incident response, vulnerability, or management...
Vulnerability Register and Remediation Tracker
Use this tracker to record vulnerabilities, exposure, owners, treatment actions, due dates, retests, and closure.
Web Filtering Exception Register
Use this register to record approved web filtering exceptions, false positives, and business-required access to otherwise blocked categories.
Matrices
13 notesAccess Control Matrix
Use this to define standard access rights by role, asset, classification, and approval owner.
Developer Security Training Matrix
Use this matrix to track security training expectations for developers, reviewers, DevOps, testers, and architects.
Incident Roles and Communications Matrix
Use this to assign incident response roles, escalation contacts, communications responsibilities, and decision authority before an incident happens.
Information Access Rule Matrix
Use this matrix when defining or reviewing role-based access to an application, service, database, report set, or information repository.
Information Classification and Handling Matrix
Use this to define classification levels, handling rules, labelling expectations, owner responsibilities, and review rules for information assets.
Information Transfer Rules Matrix
Use this to define which transfer methods are approved for each information classification and what controls must be used.
Network Zone and Connection Matrix
- Zone owner identified. - Allowed flows are specific. - Broad rules are justified. - Sensitive paths are monitored. - Rules are reviewed periodically.
PII Inventory and Privacy Requirements Matrix
Use this to document PII holdings and map privacy protections back to legal, regulatory, and contractual requirements.
Role-Based Security Training Matrix
Use this matrix to map training requirements to roles, responsibilities, systems, and information access.
Supplier Security Responsibility Matrix
Use this when a supplier relationship has shared security responsibilities and the contract needs a clear split between the organization, the supplier, and any shared control ar...
Template - RACI Matrix
Research note.
Template - Segregation of Duties Matrix
Use this to identify incompatible duties and document whether they are segregated or covered by compensating controls.
Web Filtering Policy and Category Matrix
Use this matrix to map web filtering policy decisions to blocked, warned, allowed, monitored, and exception-handled categories.
Policies and Procedures
31 notesAcceptable Use and Information Handling Rules
Use this as a practical rules template for personnel, contractors, and third-party users who use organizational information and associated assets.
Audit Testing Plan and Authorization Record
Use this record before audit tests, scans, assurance checks, or tool-assisted reviews are performed on operational systems.
Authentication Information Handling Standard
Use this to define how passwords, PINs, recovery answers, MFA tokens, biometric authentication data, privileged credentials, and service secrets are issued, handled, reset, and...
Backup Policy and Schedule
Use this template to define backup frequency, scope, retention, storage location, protection, and restore testing requirements.
Capacity Management Plan
Use this plan to define how critical systems and services will be monitored, trended, forecast, and adjusted for capacity.
Change Management Procedure
Use this procedure to define how changes to systems, infrastructure, applications, code, networks, cloud resources, and operational environments are controlled.
Cryptographic Controls Policy
Use this policy to define approved cryptographic uses, algorithms, protocols, key management responsibilities, legal checks, and exceptions.
Data Masking Standard
Use this standard to define masking, pseudonymisation, tokenisation, anonymisation, full-data access, and re-identification controls.
Development Environment Separation Standard
Use this standard to define the minimum security expectations for development, test, staging, and production environments.
Endpoint Device Security Standard
Use this standard to define the minimum security baseline for user endpoint devices before they access organizational information.
Incident Management Plan
Use this to define how information security events, weaknesses, and incidents are reported, triaged, investigated, escalated, recovered from, reviewed, and improved.
Independent Information Security Review Plan and Report
Use this to plan and record independent reviews of the information security management approach and implementation.
Information Retention and Deletion Rules
Use this template to define retention periods, deletion triggers, deletion methods, and evidence requirements by information type.
Logging and Monitoring Standard
Use this standard to define loggable events, minimum log fields, retention, protection, review, and escalation requirements.
Malware Protection Standard
Use this standard to define minimum malware protection requirements for endpoints, servers, mobile devices, cloud workloads, email, web access, file uploads, and removable media.
Network Security Architecture and Zoning Standard
Use this standard to document network zones, trust boundaries, sensitive traffic paths, management networks, public exposure, and virtual/cloud network scope.
Operational Software Installation Procedure
Use this procedure to define how software, packages, libraries, patches, tools, and vendor updates are approved and installed on operational systems.
Physical Security Monitoring Procedure
Use this procedure template to define how premises are monitored for unauthorized physical access.
Release and Rollback Plan
Use this plan for significant releases or grouped changes before operational implementation.
Secure Architecture Principles Standard
Use this standard to document the secure engineering principles that system development activities must apply.
Secure Area Working Procedure
Use this procedure template to define how sensitive work is performed inside secure areas.
Secure Authentication Standard
Use this standard to define minimum authentication expectations for applications, operating systems, remote access, privileged access, and third-party access.
Secure Coding Standard
Use this standard to define secure coding principles and language/framework-specific rules.
Secure Development Policy
Use this policy to define mandatory secure development rules for internal teams, contractors, and suppliers.
Security Awareness and Training Plan
Use this plan to define annual, induction, refresher, and role-specific information security training.
Security Test Plan
Use this plan to define risk-based security testing during development and before acceptance.
Storage Media Handling Procedure
Use this procedure to define how storage media is acquired, approved, labelled, used, stored, transported, erased, destroyed, and disposed of.
Technical Compliance Review Plan
Use this before running configuration checks, vulnerability scans, firewall reviews, cloud configuration reviews, penetration tests, or other technical conformity checks.
Template - Policy Communication and Acknowledgement Tracker
Use this to prove that relevant personnel and interested parties were informed of policies and acknowledged them where required.
Template - Top-Level Information Security Policy
Use this to draft or review the organization's high-level information security policy under A.5.1 Policies for Information Security.
Vulnerability Management Procedure
Use this procedure to define how the organization identifies, evaluates, treats, retests, and reports technical vulnerabilities.
Section
Indexes
5 notes across 3 subsections
Maps of Content
2 notesAnnex A Controls MOC
Research note.
Templates MOC
Research note.
Framework Notes
1 notesISO 27001 Overview
Research note.
Research Notes
2 notesAudit Evidence Index
Research note.
Exam Cues Index
Research note.
Section
Templates
6 notes across 1 subsections
Template Notes
6 notesTemplate Audit Question
markdown type: audit question question id: "" question: "" related standard: ISO27001 related clause: "" related controls: related risks: expected evidence: status: draft answer...
Template Clause Note
markdown type: clause standard: ISO27001 clause id: "" clause name: "" status: not started priority: medium related iso27005 topics: related iso27002 topics: related controls: r...
Template Control Card
Use this for ISO 27001 Annex A controls that should appear in Dataview dashboards.
Template Evidence Item
markdown type: evidence evidence id: "" evidence name: "" evidence type: "" status: draft related standard: ISO27001 related controls: related risks: owner: "" source system: ""...
Template Exam Topic
markdown type: exam topic standard: ISO27001 topic: "" status: not started confidence: low confidence rank: 1 exam relevance: medium exam relevance rank: 2 weak area: true relat...
Template Risk Scenario
Use this for ISO 27005-style risk scenarios that should appear in Dataview dashboards.
No research notes found
Try clearing the framework filter.