ISO 27001 Annex A Control Lookup

Practical purpose

Set coherent, approved direction for information security and keep supporting policies aligned with business, risk and compliance needs.

Read the full Control 5.1 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for policies for information security.
• Implement policy or procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved policy or procedure
• governance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is policies for information security implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting policies for information security without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Allocate clear accountability and authority for security decisions and recurring activities.

Read the full Control 5.2 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security roles and responsibilities.
• Implement policy or procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved policy or procedure
• governance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security roles and responsibilities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security roles and responsibilities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Reduce opportunities for error, misuse or concealment by separating incompatible responsibilities or applying compensating oversight.

Read the full Control 5.3 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for segregation of duties.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is segregation of duties implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting segregation of duties without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Ensure managers actively reinforce security expectations within the teams and processes they direct.

Read the full Control 5.4 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for management responsibilities.
• Implement policy or procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved policy or procedure
• governance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is management responsibilities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting management responsibilities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Maintain usable routes for regulatory, law-enforcement and emergency contact when events or obligations require coordination.

Read the full Control 5.5 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for contact with authorities.
• Implement compliance process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved compliance process
• compliance assessment records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is contact with authorities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting contact with authorities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Use trusted professional and industry communities to stay informed about relevant security developments and good practice.

Read the full Control 5.6 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for contact with special interest groups.
• Implement policy or procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved policy or procedure
• governance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is contact with special interest groups implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting contact with special interest groups without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Collect and evaluate relevant threat information so risk, monitoring and protective decisions reflect the current environment.

Read the full Control 5.7 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for threat intelligence.
• Implement risk process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved risk process
• risk decisions
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is threat intelligence implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting threat intelligence without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Integrate security risk and control decisions into project governance from initiation through delivery and closure.

Read the full Control 5.8 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security in project management.
• Implement policy or procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved policy or procedure
• governance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security in project management implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security in project management without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Maintain a reliable view of information and supporting assets that need protection, including clear ownership and lifecycle accountability.

Read the full Control 5.9 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define included asset types and inventory boundaries.
• Maintain information, system, application, cloud-service and other relevant asset records.
• Assign owners and connect assets to business processes, classification and risk.
• Use onboarding, change and decommissioning triggers to reconcile the inventory.

Common evidence

Common evidence may include:

• approved asset inventory
• information, system and cloud-service registers
• assigned asset owners
• periodic reconciliation and lifecycle records

Questions an auditor may ask

• How do you identify information assets within scope?
• How are owners assigned?
• Show an asset added or retired recently.
• How are cloud-hosted and outsourced assets kept current?

Common implementation mistakes

• inventory covers hardware only
• cloud services or virtual assets are omitted
• ownership is missing
• the spreadsheet is not reconciled with change or decommissioning

Practical purpose

Set practical expectations for how people may use and protect information, devices, services and facilities.

Read the full Control 5.10 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for acceptable use of information and other associated assets.
• Implement asset process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved asset process
• asset records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is acceptable use of information and other associated assets implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting acceptable use of information and other associated assets without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Recover organizational assets and information when roles, contracts or relationships change or end.

Read the full Control 5.11 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for return of assets.
• Implement asset process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved asset process
• asset records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is return of assets implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting return of assets without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply consistent sensitivity and handling decisions to information based on business value, obligations and impact.

Read the full Control 5.12 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for classification of information.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is classification of information implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting classification of information without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Communicate classification or handling needs in a usable form so people and systems can apply the right protections.

Read the full Control 5.13 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for labelling of information.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is labelling of information implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting labelling of information without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Protect information while it is shared internally or externally through approved channels and accountable arrangements.

Read the full Control 5.14 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information transfer.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information transfer implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information transfer without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Set risk-based principles for granting, using, reviewing and removing physical and logical access.

Read the full Control 5.15 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for access control.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is access control implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting access control without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Manage identities consistently across creation, verification, change, suspension and removal.

Read the full Control 5.16 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for identity management.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is identity management implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting identity management without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Issue, protect, reset and retire credentials and authentication secrets through controlled processes.

Read the full Control 5.17 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for authentication information.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is authentication information implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting authentication information without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Approve, provision, review and remove access rights according to role, need and changing employment or supplier status.

Read the full Control 5.18 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for access rights.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is access rights implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting access rights without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Identify and manage security risk arising from suppliers and the services, information or systems they support.

Read the full Control 5.19 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security in supplier relationships.
• Implement supplier process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved supplier process
• supplier assurance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security in supplier relationships implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security in supplier relationships without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Translate supplier risk and service expectations into clear, enforceable security terms and responsibilities.

Read the full Control 5.20 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for addressing information security within supplier agreements.
• Implement supplier process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved supplier process
• supplier assurance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is addressing information security within supplier agreements implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting addressing information security within supplier agreements without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Extend supplier assurance to relevant technology dependencies, subcontractors, components and lifecycle risks.

Read the full Control 5.21 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for managing information security in the ict supply chain.
• Implement supplier process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved supplier process
• supplier assurance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is managing information security in the ict supply chain implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting managing information security in the ict supply chain without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Review supplier security performance and control material service changes throughout the relationship.

Read the full Control 5.22 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for monitoring, review and change management of supplier services.
• Implement supplier process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved supplier process
• supplier assurance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is monitoring, review and change management of supplier services implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting monitoring, review and change management of supplier services without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Govern cloud selection, use, shared responsibilities, changes and exit according to information-security risk.

Read the full Control 5.23 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security for use of cloud services.
• Implement cloud governance process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved cloud governance process
• cloud inventory and assurance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security for use of cloud services implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security for use of cloud services without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Prepare roles, playbooks, communication and resources before security incidents occur.

Read the full Control 5.24 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security incident management planning and preparation.
• Implement incident process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved incident process
• incident records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security incident management planning and preparation implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security incident management planning and preparation without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Triage reported events consistently and decide whether escalation, response or other handling is required.

Read the full Control 5.25 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for assessment and decision on information security events.
• Implement incident process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved incident process
• incident records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is assessment and decision on information security events implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting assessment and decision on information security events without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Coordinate containment, investigation, communication, recovery and accountable decision-making during incidents.

Read the full Control 5.26 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for response to information security incidents.
• Implement incident process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved incident process
• incident records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is response to information security incidents implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting response to information security incidents without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Turn incident evidence into improvements to risks, controls, detection and response capability.

Read the full Control 5.27 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for learning from information security incidents.
• Implement incident process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved incident process
• incident records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is learning from information security incidents implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting learning from information security incidents without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Preserve reliable evidence when events may require investigation, disciplinary, contractual or legal action.

Read the full Control 5.28 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for collection of evidence.
• Implement incident process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved incident process
• incident records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is collection of evidence implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting collection of evidence without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Maintain essential security protections and risk decisions while normal operating arrangements are disrupted.

Read the full Control 5.29 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security during disruption.
• Implement continuity arrangement that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved continuity arrangement
• exercise and recovery records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security during disruption implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security during disruption without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Prepare and test technology recovery capability that supports prioritized business continuity needs.

Read the full Control 5.30 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for ict readiness for business continuity.
• Implement continuity arrangement that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved continuity arrangement
• exercise and recovery records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is ict readiness for business continuity implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting ict readiness for business continuity without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Identify, maintain and translate applicable obligations into owned security and compliance activities.

Read the full Control 5.31 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for legal, statutory, regulatory and contractual requirements.
• Implement compliance process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved compliance process
• compliance assessment records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is legal, statutory, regulatory and contractual requirements implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting legal, statutory, regulatory and contractual requirements without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Protect and use intellectual property in accordance with ownership, licence and contractual conditions.

Read the full Control 5.32 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for intellectual property rights.
• Implement compliance process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved compliance process
• compliance assessment records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is intellectual property rights implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting intellectual property rights without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Preserve records against loss, alteration, unauthorized access and premature disposal for required retention periods.

Read the full Control 5.33 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for protection of records.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is protection of records implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting protection of records without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply privacy and personal-information protections that reflect applicable obligations, purposes and risk.

Read the full Control 5.34 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for privacy and protection of pii.
• Implement privacy process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved privacy process
• privacy review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is privacy and protection of pii implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting privacy and protection of pii without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Obtain objective review of whether security governance and arrangements remain suitable and effective.

Read the full Control 5.35 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for independent review of information security.
• Implement policy or procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved policy or procedure
• governance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is independent review of information security implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting independent review of information security without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Evaluate whether security requirements are followed and address deviations through accountable action.

Read the full Control 5.36 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for compliance with policies, rules and standards for information security.
• Implement compliance process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved compliance process
• compliance assessment records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is compliance with policies, rules and standards for information security implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting compliance with policies, rules and standards for information security without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Provide current, usable instructions where consistent security operation depends on repeatable execution.

Read the full Control 5.37 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for documented operating procedures.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is documented operating procedures implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting documented operating procedures without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply proportionate pre-engagement checks for roles with access to sensitive information, systems or facilities.

Read the full Control 6.1 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for screening.
• Implement people-security process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved people-security process
• personnel records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is screening implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting screening without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Embed relevant security responsibilities and expectations into employment or engagement terms.

Read the full Control 6.2 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for terms and conditions of employment.
• Implement people-security process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved people-security process
• personnel records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is terms and conditions of employment implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting terms and conditions of employment without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Build role-relevant understanding and capability, then evaluate whether learning changes behaviour and performance.

Read the full Control 6.3 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security awareness, education and training.
• Implement awareness programme that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved awareness programme
• attendance and effectiveness records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security awareness, education and training implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security awareness, education and training without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Use a fair, communicated process for addressing deliberate or negligent breaches of security expectations.

Read the full Control 6.4 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for disciplinary process.
• Implement people-security process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved people-security process
• personnel records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is disciplinary process implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting disciplinary process without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Manage continuing obligations, access, assets and knowledge when a person changes role or leaves.

Read the full Control 6.5 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for responsibilities after termination or change of employment.
• Implement people-security process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved people-security process
• personnel records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is responsibilities after termination or change of employment implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting responsibilities after termination or change of employment without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Use suitable confidentiality commitments that reflect information sensitivity, roles, jurisdictions and relationship lifecycle.

Read the full Control 6.6 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for confidentiality or non-disclosure agreements.
• Implement people-security process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved people-security process
• personnel records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is confidentiality or non-disclosure agreements implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting confidentiality or non-disclosure agreements without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Protect information and services when work occurs away from controlled organizational locations.

Read the full Control 6.7 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for remote working.
• Implement people-security process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved people-security process
• personnel records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is remote working implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting remote working without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Give personnel simple, trusted routes for promptly reporting suspected events, weaknesses or unusual activity.

Read the full Control 6.8 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information security event reporting.
• Implement incident process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved incident process
• incident records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information security event reporting implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information security event reporting without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Define and protect physical boundaries around information, people and supporting assets according to risk.

Read the full Control 7.1 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for physical security perimeters.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is physical security perimeters implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting physical security perimeters without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Authorize, record and review entry to controlled areas while managing visitors and access credentials.

Read the full Control 7.2 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for physical entry.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is physical entry implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting physical entry without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply proportionate protection to workplaces and facilities, including shared and outsourced locations.

Read the full Control 7.3 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for securing offices, rooms and facilities.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is securing offices, rooms and facilities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting securing offices, rooms and facilities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Detect and review unauthorized or suspicious physical activity using proportionate monitoring and response.

Read the full Control 7.4 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for physical security monitoring.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is physical security monitoring implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting physical security monitoring without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Reduce harm from fire, water, temperature, power, civil disruption and other relevant environmental hazards.

Read the full Control 7.5 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for protecting against physical and environmental threats.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is protecting against physical and environmental threats implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting protecting against physical and environmental threats without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Set behaviour and supervision expectations for people working within sensitive physical areas.

Read the full Control 7.6 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for working in secure areas.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is working in secure areas implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting working in secure areas without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Reduce accidental exposure of sensitive information in offices, shared spaces and remote-work environments.

Read the full Control 7.7 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for clear desk and clear screen.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is clear desk and clear screen implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting clear desk and clear screen without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Position and protect equipment against unauthorized access, observation, damage and environmental exposure.

Read the full Control 7.8 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for equipment siting and protection.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is equipment siting and protection implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting equipment siting and protection without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Protect devices, media and information when used, transported or stored outside organizational premises.

Read the full Control 7.9 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for security of assets off-premises.
• Implement asset process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved asset process
• asset records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is security of assets off-premises implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting security of assets off-premises without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Control removable and other storage media through authorization, handling, transport, reuse and disposal.

Read the full Control 7.10 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for storage media.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is storage media implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting storage media without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Protect information-processing facilities from loss or instability of power, cooling, communications and other utilities.

Read the full Control 7.11 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for supporting utilities.
• Implement continuity arrangement that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved continuity arrangement
• exercise and recovery records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is supporting utilities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting supporting utilities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Protect power and communications cabling from interception, interference and damage.

Read the full Control 7.12 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for cabling security.
• Implement physical-security procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved physical-security procedure
• access and inspection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is cabling security implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting cabling security without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Maintain equipment safely and reliably while controlling access, information exposure and service records.

Read the full Control 7.13 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for equipment maintenance.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is equipment maintenance implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting equipment maintenance without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Remove or protect information before equipment is disposed of, returned, reassigned or reused.

Read the full Control 7.14 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for secure disposal or re-use of equipment.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is secure disposal or re-use of equipment implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting secure disposal or re-use of equipment without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply managed security baselines and lifecycle controls to endpoints that access organizational information and services.

Read the full Control 8.1 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for user endpoint devices.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is user endpoint devices implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting user endpoint devices without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Restrict, approve, monitor and review powerful access separately from routine user access.

Read the full Control 8.2 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for privileged access rights.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is privileged access rights implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting privileged access rights without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Enforce access boundaries according to business need, classification and approved authorization rules.

Read the full Control 8.3 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information access restriction.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information access restriction implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information access restriction without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Limit and monitor source-code access to protect integrity, confidentiality and controlled change.

Read the full Control 8.4 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for access to source code.
• Implement secure-development lifecycle that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved secure-development lifecycle
• design, review and test records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is access to source code implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting access to source code without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Use authentication mechanisms and operating practices proportionate to account, system and transaction risk.

Read the full Control 8.5 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for secure authentication.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is secure authentication implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting secure authentication without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Monitor and plan capacity so services remain reliable and security controls continue to operate under expected demand.

Read the full Control 8.6 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for capacity management.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is capacity management implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting capacity management without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Combine preventive, detective and recovery measures to reduce malware execution and impact.

Read the full Control 8.7 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for protection against malware.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is protection against malware implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting protection against malware without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Identify relevant technical vulnerabilities, determine exposure and drive risk-based remediation and exception decisions.

Read the full Control 8.8 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Maintain an accurate inventory of in-scope systems and owners.
• Use appropriate vulnerability sources and scanning coverage.
• Evaluate applicability, exposure and business impact before prioritizing remediation.
• Assign owners and target dates, control exceptions and verify closure.
• Review recurring weaknesses and unsupported technology.

Common evidence

Common evidence may include:

• vulnerability-management procedure
• asset inventory and scanning coverage
• vulnerability register and remediation records
• exception and risk-acceptance approvals
• dashboards and closure verification

Questions an auditor may ask

• How do you identify new vulnerabilities affecting the environment?
• How is applicability and exposure determined?
• Show a high-risk vulnerability from discovery through verified closure.
• How are overdue findings and exceptions approved?

Common implementation mistakes

• scanner output treated as the whole process
• no linkage to asset ownership or business impact
• priorities based only on technical severity
• findings closed without verification
• unsupported systems remain outside tracking

Practical purpose

Define, deploy and monitor secure configuration baselines across relevant technology.

Read the full Control 8.9 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for configuration management.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is configuration management implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting configuration management without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Delete information when authorized and no longer needed, including relevant copies and service-provider locations.

Read the full Control 8.10 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information deletion.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information deletion implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information deletion without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Reduce exposure of sensitive data by obscuring values where full detail is unnecessary.

Read the full Control 8.11 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for data masking.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is data masking implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting data masking without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Detect and reduce unauthorized movement or disclosure of sensitive information across people, endpoints and services.

Read the full Control 8.12 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for data leakage prevention.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is data leakage prevention implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting data leakage prevention without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Create protected, recoverable copies aligned with business recovery and information-retention needs.

Read the full Control 8.13 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for information backup.
• Implement continuity arrangement that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved continuity arrangement
• exercise and recovery records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is information backup implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting information backup without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Use proportionate redundancy to meet service availability and recovery needs.

Read the full Control 8.14 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for redundancy of information processing facilities.
• Implement continuity arrangement that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved continuity arrangement
• exercise and recovery records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is redundancy of information processing facilities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting redundancy of information processing facilities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Generate, protect and retain useful event records that support detection, investigation and accountability.

Read the full Control 8.15 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for logging.
• Implement monitoring standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved monitoring standard
• logs and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is logging implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting logging without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Review systems, networks and user activity for anomalies and indicators requiring investigation or response.

Read the full Control 8.16 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for monitoring activities.
• Implement monitoring standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved monitoring standard
• logs and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is monitoring activities implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting monitoring activities without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Maintain consistent time sources so records, alerts and investigations can be correlated reliably.

Read the full Control 8.17 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for clock synchronization.
• Implement monitoring standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved monitoring standard
• logs and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is clock synchronization implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting clock synchronization without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Restrict and monitor powerful utilities that can bypass normal system or application controls.

Read the full Control 8.18 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for use of privileged utility programs.
• Implement access process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved access process
• access review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is use of privileged utility programs implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting use of privileged utility programs without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Authorize and control software installation to protect stability, licensing and security baselines.

Read the full Control 8.19 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for installation of software on operational systems.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is installation of software on operational systems implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting installation of software on operational systems without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Design, configure and operate networks to protect information flows and connected services.

Read the full Control 8.20 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for networks security.
• Implement network-security standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved network-security standard
• network configuration and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is networks security implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting networks security without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Define and monitor security expectations for network services, whether internal, outsourced or cloud-delivered.

Read the full Control 8.21 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for security of network services.
• Implement network-security standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved network-security standard
• network configuration and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is security of network services implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting security of network services without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Separate networks, users and services where segmentation reduces exposure or limits movement.

Read the full Control 8.22 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for segregation of networks.
• Implement network-security standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved network-security standard
• network configuration and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is segregation of networks implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting segregation of networks without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Reduce exposure to malicious or prohibited web content through risk-based filtering and exception handling.

Read the full Control 8.23 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for web filtering.
• Implement network-security standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved network-security standard
• network configuration and review records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is web filtering implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting web filtering without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Govern cryptographic use, algorithms, certificates and keys according to information and service risk.

Read the full Control 8.24 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for use of cryptography.
• Implement cryptographic standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved cryptographic standard
• key and configuration records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is use of cryptography implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting use of cryptography without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Embed security activities, ownership and assurance throughout development and acquisition.

Read the full Control 8.25 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for secure development life cycle.
• Implement secure-development lifecycle that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved secure-development lifecycle
• design, review and test records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is secure development life cycle implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting secure development life cycle without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Define testable security and privacy requirements before applications are designed, acquired or changed.

Read the full Control 8.26 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for application security requirements.
• Implement application-security standard that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved application-security standard
• design and testing records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is application security requirements implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting application security requirements without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply documented security principles and risk decisions to system architecture and engineering.

Read the full Control 8.27 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for secure system architecture and engineering principles.
• Implement secure-development lifecycle that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved secure-development lifecycle
• design, review and test records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is secure system architecture and engineering principles implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting secure system architecture and engineering principles without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Use coding standards, developer practices and review techniques that prevent common weaknesses.

Read the full Control 8.28 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for secure coding.
• Implement secure-development lifecycle that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved secure-development lifecycle
• design, review and test records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is secure coding implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting secure coding without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Test security requirements and risk scenarios before release and after material change.

Read the full Control 8.29 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for security testing in development and acceptance.
• Implement secure-development lifecycle that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved secure-development lifecycle
• design, review and test records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is security testing in development and acceptance implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting security testing in development and acceptance without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Apply security requirements, oversight and acceptance criteria when development is performed externally.

Read the full Control 8.30 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for outsourced development.
• Implement supplier process that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved supplier process
• supplier assurance records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is outsourced development implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting outsourced development without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Separate environments and control movement between them to reduce unauthorized change and data exposure.

Read the full Control 8.31 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for separation of development, test and production environments.
• Implement secure-development lifecycle that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved secure-development lifecycle
• design, review and test records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is separation of development, test and production environments implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting separation of development, test and production environments without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Assess, authorize, test, implement and review technology changes through controlled workflows.

Read the full Control 8.32 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for change management.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is change management implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting change management without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Select, protect and remove test information so testing does not create unnecessary exposure.

Read the full Control 8.33 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for test information.
• Implement data-handling procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved data-handling procedure
• data protection records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is test information implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting test information without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up

Practical purpose

Plan and control audit testing so assurance activity does not disrupt systems or expose sensitive information.

Read the full Control 8.34 implementation guide →

What good implementation looks like

Typical implementation actions include:

• Define ownership, scope and operating criteria for protection of information systems during audit testing.
• Implement operating procedure that fits the organization’s risks, services and working practices.
• Integrate the activity with relevant change, exception and review processes.
• Review performance and improve the arrangement when risks, technology or obligations change.

Common evidence

Common evidence may include:

• approved operating procedure
• operational records
• assigned ownership and approval evidence
• sample implementation, review and exception records

Questions an auditor may ask

• How is protection of information systems during audit testing implemented in practice?
• Who owns the activity and how are decisions approved?
• Show me a recent example from operation through review.
• How are exceptions, changes or overdue actions handled?

Common implementation mistakes

• documenting protection of information systems during audit testing without consistent operation
• unclear ownership or review frequency
• evidence that does not cover the full ISMS scope
• exceptions accepted without risk-based approval or follow-up