Organizational controls37 items
Control numbers, titles, and theme classification are based on the public list of ISO/IEC 27001:2022 Annex A. The explanatory text is original material and is not the normative text of the ISO standard. For an authoritative check, use a licensed copy of the standard.
- A.5.1Policies for information security
- A.5.2Information security roles and responsibilities
- A.5.3Segregation of duties
- A.5.4Management responsibilities
- A.5.5Contact with authorities
- A.5.6Contact with special interest groups
- A.5.7Threat intelligence
- A.5.8Information security in project management
- A.5.9Inventory of information and other associated assets
- A.5.10Acceptable use of information and other associated assets
- A.5.11Return of assets
- A.5.12Classification of information
- A.5.13Labelling of information
- A.5.14Information transfer
- A.5.15Access control
- A.5.16Identity management
- A.5.17Authentication information
- A.5.18Access rights
- A.5.19Information security in supplier relationships
- A.5.20Addressing information security within supplier agreements
- A.5.21Managing information security in the information and communication technology (ICT) supply chain
- A.5.22Monitoring, review and change management of supplier services
- A.5.23Information security for use of cloud services
- A.5.24Information security incident management planning and preparation
- A.5.25Assessment and decision on information security events
- A.5.26Response to information security incidents
- A.5.27Learning from information security incidents
- A.5.28Collection of evidence
- A.5.29Information security during disruption
- A.5.30ICT readiness for business continuity
- A.5.31Legal, statutory, regulatory and contractual requirements
- A.5.32Intellectual property rights
- A.5.33Protection of records
- A.5.34Privacy and protection of personal identifiable information (PII)
- A.5.35Independent review of information security
- A.5.36Compliance with policies, rules and standards for information security
- A.5.37Documented operating procedures