Technological controls34 items

Control numbers, titles, and theme classification are based on the public list of ISO/IEC 27001:2022 Annex A. The explanatory text is original material and is not the normative text of the ISO standard. For an authoritative check, use a licensed copy of the standard.

• A.8.1User end point devices
• A.8.2Privileged access rights
• A.8.3Information access restriction
• A.8.4Access to source code
• A.8.5Secure authentication
• A.8.6Capacity management
• A.8.7Protection against malware
• A.8.8Management of technical vulnerabilities
• A.8.9Configuration management
• A.8.10Information deletion
• A.8.11Data masking
• A.8.12Data leakage prevention
• A.8.13Information backup
• A.8.14Redundancy of information processing facilities
• A.8.15Logging
• A.8.16Monitoring activities
• A.8.17Clock synchronization
• A.8.18Use of privileged utility programs
• A.8.19Installation of software on operational systems
• A.8.20Networks security
• A.8.21Security of network services
• A.8.22Segregation of networks
• A.8.23Web filtering
• A.8.24Use of cryptography
• A.8.25Secure development life cycle
• A.8.26Application security requirements
• A.8.27Secure system architecture and engineering principles
• A.8.28Secure coding
• A.8.29Security testing in development and acceptance
• A.8.30Outsourced development
• A.8.31Separation of development, test and production environments
• A.8.32Change management
• A.8.33Test information
• A.8.34Protection of information systems during audit testing