A.5.1.1: Policies for Information Security (ISO 27001 Control)

A set of policies for information security should be defined, approved by management, published, and communicated to employees and relevant external parties.

Explanation: The requirement is to define all the information security policies. This policy is the driving force for implementing security controls. Once all policies are approved by management, it is important to communicate them with all employees and external stakeholders to make them aware of their responsibilities. They must abide by these policies and help in securing the organization’s information.

Evidence that can be prepared: Policies lists, as mentioned previously, or as applicable to the organization’s business requirements. All the policies must be reviewed/approved by the management/steering committee.

Who prepares it: The information security department will facilitate the creation of the policies by involving relevant departments i.e. Human Resources, IT/Helpdesk, etc. The organization should assess and analyze their implementation teams who will help define the policies.

For external audit: An external auditor conducting the ISO 27001 certification audit will check all the defined/approved policies. Also, define how communication takes place on the policies to employees/external stakeholders.

A.5.1.2: Review of the Policies for Information Security (ISO 27001 Control)

The information security policies should be reviewed at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy, and effectiveness.

Explanation: Once policies are defined and approved, there must be a set frequency defined to review them and determine if they are still relevant or need improvements/changes. If changes are applicable, they must be done accordingly, and a revised policy approval must be received from management before releasing the changes to the employees and stakeholders.

Evidence that can be prepared: All the revised policies must be reviewed at regular intervals and the revised policies must be approved by management.

Who prepares it: The information security department will facilitate with relevant departments heads to ensure their policies are reviewed on regular, defined intervals.

For external audit: An external auditor conducting the ISO 27001 certification audit will check that all the policies have been reviewed at regular intervals, as well as have been approved and communicated to employees and external stakeholders.

A.6.1.1: Information Security Roles and Responsibilities (ISO 27001 Control)

All information security responsibilities should be defined and allocated.

Explanation/what is required: You must define the roles and responsibilities related to information security and the policies based on the ISO 27001 implementation scope. If the responsibilities are not defined or if there is lot of ambiguity in each role, employees will not be clear about which areas they are accountable to.

Who prepares it: The human resources department and the information security team are responsible for defining and publishing the roles and responsibilities.

For external audit: An external auditor conducting ISO 27001 certification audit will check the roles and responsibilities defined for each role.

A.6.1.2: Segregation of Duties (ISO 27001 Control)

Conflicting duties and areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets.

Explanation/what is required: The focus is to check on individuals who have dual responsibilities or are accountable for more than one role. The ISO 27001 standard covers the risk involved in such conflicting duties and areas of responsibility.

Consider this from an IT company example. Say Krishna is the business analyst team manager and is also responsible for QA/Software testing team. Such a scenario would be considered conflicting and the risk might increase that poses a threat to the integrity of the test result. Hence, to avoid such risks, segregation of duties is important. For example, Krishna should be responsible only for the business analyst team and Shiva should have responsibility for QA/Software testing team. This will help mitigate the risks.

The ISO 27001 standard recognizes that small organizations face challenges in segregating duties. In such scenarios, the focus should be more on monitoring the activities and maintaining the audit trails so that individual actions do not go undetected. That is why usage of tools/technology should be monitored in organizations who do sensitive transactions and handle confidential data. Tools help you track and maintain the audit trails, which can be used and analyzed whenever the doubt arises, or any incident occurs.

Evidence that can be prepared: The roles and responsibilities document should include clear segregation of duties and areas of responsibility. Also, controls should be implemented to monitor and detect unauthorized actions.

Who prepares it: The human resources department and the information security team will define and publish roles and responsibilities. The IT department can implement the controls in the tools/systems to monitor the activities and maintain the audit trails for future checks and verification purposes.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the roles and responsibilities and ensure clear segregation of duties.

A.6.1.3: Contact with Authorities (ISO 27001 Control)

Appropriate contacts with relevant authorities should be maintained.

Explanation/what is required: The requirement is to define a procedure to contact with authorities when an information security incident occurs. This procedure should describe how authorities should be contacted and who will contact them from the organization. These authorities could be law/legal, regulatory bodies, etc.. Whenever any changes happen in acts/law or regulations, that needs to be implemented by the organization, and it must be communicated by the regulatory bodies. Hence being in contact with authorities is always useful.

When incidents or attacks happen through Internet sources, it might be required to contact cyber-law bodies or relevant bodies to investigate and take appropriate action. There are other authorities that an organization must be in contact with, such as fire departments, electricity suppliers, nearby hospitals, or any other emergency services. As these all have an impact on your organization’s business or operations.

For example, if a fire or electrical incident occurs, you may need to contact such authorities, as such incidents may halt your operations (if it is related to business continuity, you will read more about it in this chapter). This impacts the company’s revenue and reputation. Hence, the organization incident management procedure must describe what is to be done if any unexpected incident occurs.

Evidence that can be prepared: An incident management and escalation procedure should define the roles and responsibilities and explain what to do in such scenarios. For example, how to contact the authorities and who will contact them in case of incident.

Who prepares it: The information security team is responsible for preparing the document by involving relevant stakeholders/departments such as human resources, IT Helpdesk, Software Development, and other operations whose incidents are required to be reported to authorities.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the incident management and escalation procedure. If an incident has occurred, they will check if the procedure was followed, including whether the incident form was used properly to report the incidents and what actions were taken for resolution.

A.6.1.4: Contact with Special Interest Groups (ISO 27001 Control)

Appropriate contacts with special interest groups or other specialist security forums and professional associations should be maintained.

Explanation/what is required: Although you learn many things from the ISO 27001 standard, you must also learn from other industry best practices and other relevant information that is published from time to time to improve your team's knowledge about who is responsible for implementing and monitoring controls on a regular basis. It is important to stay up to date and ready to prevent any information security attack on your systems. Hence, it is advisable to participate in security forums, seminars, and security interest groups that share relevant and new information with the teams.

Evidence that can be prepared: Association with security forums, participation in security forums and seminars, etc. can be shown as evidence.

Who prepares it: The information security team is responsible for maintaining the records of associations and participations.

For external audit: An external auditor conducting the ISO 27001 certification audit may check all the security forums or seminars that the organization is associated with and their participation.

A.6.1.5: Information Security in Project Management (ISO 27001 Control)

There must be information security in project management regardless of the type of project.

Explanation/what is required: The focus is to identify the information security risks in the project. Organizations that work on project delivery (including development, testing, facility management, and support processes) must do risk assessment exercises at the project initiation phase, as this will help identify various information security risks. This helps you prepare the mitigation plan by identifying the appropriate security controls. You must ensure that the information security risks are identified for all the phases of the project until it is delivered/closed.

Evidence that can be prepared: Create a risk-management procedure to explain how risk management is done in the projects and define the stakeholders’ roles and responsibilities. Use project risk registers and trackers with identified risks and mitigation actions, i.e. security controls.

There could be many more areas, which you can assess to minimize the information security risks. By assessing these project risks, you ensure that your organization’s objectives are fulfilled by meeting the project security objectives.

Who prepares it: Using a risk register or tracker, the project managers identify risks in discussion with various project stakeholders. The information security team could be consulted to ensure that all the risks have been identified and that the controls are appropriate.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the risk management procedure and project risk register, in order to check how information security risks are identified and mitigated.

A.6.2.1: Mobile Device Policy (ISO 27001 Control)

A policy and supporting security measures should be adopted to manage the risks introduced by mobile devices.

Explanation/what is required: The focus is on the use of mobile devices to access organization information that could pose information security risks. Some of the examples of mobile devices are smartphones, tablets, laptop computers, etc.

We cannot deny use of mobile device these days, as it is a fast and easy medium to access information anywhere in a fast-paced world. At the same time, these devices are vulnerable to theft, loss, hacking, and unauthorized access while you leave them unattended.

Hence, the ISO 27001 standard guides you to be more aware and vigilant when you use mobile devices outside the premises, as you are carrying with you the organization’s confidential information.

Evidence that can be prepared: A mobile device policy could be prepared, which must clearly state the usage of mobile devices inside and outside the organization. Conduct awareness sessions and maintain records about these sessions.

Who prepares it: The IT Helpdesk team, in consultation with the information security team, can define the mobile device policy. Awareness sessions can be conducted for mobile device users. Be sure to include end-user agreements for the users of mobile devices to sign.

The IT Helpdesk team will implement all the security controls, as well as any other controls that they deem important based on their experience, skills, and business needs.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the mobile device policy, check how awareness sessions are conducted, and will check the required security controls. Also, if an incident occurs, they will check the steps that were planned and executed.

A.6.2.2: Teleworking (ISO 27001 Control)

A policy and supporting security measures should be implemented to protect the information accessed, processed, or stored at the teleworking sites.

Explanation/what is required: The focus is which security measures should be implemented to protect information during its access, processing, or storage at teleworking sites.

A.7.1.1: Screening (ISO 27001 Control)

Carry out background verification on all candidates for employment in accordance with relevant laws, regulations, and ethics. These checks should be proportional to the business requirements, the classification of the information to be accessed, and the perceived risks.

Explanation/what is required: This control requires the organization to perform background checks on all people who will work for the company. This ensures that potential candidates don’t have fake identities or a serious criminal background that could pose as a risk to the organization, its customers, or fellow employees. The human resources department can perform these checks. Some companies outsource the background verification responsibility to experts or agencies.

The company must collect evidence about the candidate, such as educational certificates, the previous company where they worked, whether the company exists, and so on. This can be checked by verifying the company’s website and contacting their human resources team. You can also call the person’s references. All this will help in assessing the risk associated with the candidate and whether they can be hired.

Evidence that can be prepared: Background checks and reports on each candidate.

What is included in this report: Candidate names, the date on which the verification check was performed, the names and contact details of the people who were contacted, and the feedback noted about the candidate. Educational and criminal checks should also be documented.

During their first ISO 27001 implementation, some organizations might not conduct criminal checks on the candidates, so they must mention this in their standard operating procedure and note it as a risk in the human resources department risk assessment tracker.

Who prepares it: The human resources department or the outsource vendor hired for background checks.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for background checks of the employees joined in the past six or three months, depending on the implementation period in the organization. Figure 6-1 shows the front page of the background verification form. The complete template can be downloaded from the resources section of this book.

A.7.1.2 Terms and Conditions of Employment (ISO 27001 Control)

The contractual agreements with employees and contractors should state their and the organization’s responsibilities for information security.

Explanation/what is required: This control requires the company to define the terms and conditions of the employment contract. This should clearly state security responsibilities to be adhered by employees and contractors during their employment. The goal is to make employees aware of these terms. Companies can take action as per the law if company information or assets are misused.

Evidence that can be prepared: A signed employment contract or offer letter (covering terms and conditions).

Who prepares it: The human resources department maintains signed hard copies of the employment contract or offer letter. Scanned soft copies could be maintained as a backup.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for a signed employment contract or offer letter. Also, they will check whether all the terms and conditions are stated clearly and completely.

A.7.2.1 Management Responsibilities (ISO 27001 Control)

Management should require all employees and contractors to follow the information security guidelines in accordance with the established policies and procedures of the organization.

Explanation/what is required: This control requires management to communicate to employees and contractors the standard operating procedures to ensure that security practices are implemented accordingly.

Evidence that can be prepared: Communication emails, minutes of the meeting, and signed/approved policies and procedures.

Who prepares it: An email from management, and the minutes of a meeting to be maintained by the information security team. The information security department should also maintain signed hard copies of approved policies and procedures and scan soft copies to be maintained as a backup.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the evidence.

A.7.2.2 Information Security Awareness, Education, and Training (ISO 27001 Control)

All employees of the organization and, when relevant, contractors should receive appropriate awareness training and regular updates to organizational policies and procedures, as relevant to their job function.

Explanation/what is required: Information security awareness sessions should be planned and conducted for all the employees, including your support staff, such as cleaners, security guards, etc. Whenever any changes/updates take place to any of the policies or standard operating procedures, employees must be made aware of them. These awareness sessions must be conducted for contractors and third-party users as well, as they also pose risks to information security.

Awareness helps reduce security risks, so these awareness sessions must be conducted on a regular basis and should be a mandatory part of the new hire induction program.

Evidence that can be prepared: Attendance records of participants/employees who attended the awareness sessions. Feedback forms and records of any quizzes.

Who prepares it: Awareness sessions are conducted by the information security department. Whenever sessions are conducted, attendance records need to be maintained.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the records of the awareness sessions. The auditor can ask questions randomly to any employee to check their knowledge.

A.7.2.3 Disciplinary Process (ISO 27001 Control)

There should be a formal and communicated disciplinary process in place to take action against employees who have committed an information security breach.

Explanation/what is required: There must be a defined policy or a standard operating procedure that covers the disciplinary steps to be taken in the case of misconduct

Evidence that can be prepared: Disciplinary policy or a standard operating procedure, or both, could be prepared. Feedback forms.

Who prepares it: The human resources department.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the disciplinary policy or a standard operating procedure.

A.7.3.1 Termination or Change of Employment Responsibilities (ISO 27001 Control)

Information security responsibilities and duties that remain valid after termination or change of employment should be defined and communicated to the employee or contractor and enforced.

When employees leave The organization must define a clear policy or standard operating procedure that explains when employees/contractors leave the organization, what they must do to complete all the exit formalities. This is to ensure that the exit is done in a safe manner without any impact to organizational information.

It is important to ensure that exiting employees/contractors do not have access to sensitive information or assets after their last day.

Clients also know the importance of safeguarding their information, and they could also communicate their own standard operating procedures to you to follow when an employee/contractor working for your client leaves. It is the duty of the organization to ensure that exiting employees abide by these defined policies.

When employees transfer to another department Employees could move from one office location to another office or department. Say that employee Krishna is working at office location A and then is transferred to office location B. It becomes important for the organization to review and revoke Krishna’s access from the information, assets, tools/applications, etc. that are relevant only to location A and to ensure that he has access to location B’s data and information only.

Even when the employee transfers from one department to another, you must follow the same process and review/revoke access accordingly.

The responsibilities of an employee change Employee or contractor responsibilities could undergo changes, for example, they might get additional/new responsibilities and maybe old responsibilities become no longer valid. In such scenarios, it’s important to review/revoke the access accordingly.

Evidence that can be prepared: The human resources (HR) department typically manages employee exits and transfers, so HR should define the policy that covers these scenarios and should ensure that this information is communicated to employees and contractors.

The evidence can be an employee exit form on which every department lists the information for which access needs to be revoked and assets to be returned. On their last day, the employee must return all the assets issued by every department. Every department head must sign the employee exit form to confirm that the employee has returned all assets. Once the employee exit form has been signed by every department head, then the HR department should relieve the employee by providing a company relieving certificate or an experience certificate (as per the human resources norms/standards).

IT companies and IT departments in any organization must ensure that the user ID of the employee/contractor is disabled in the system on the last day (the record must be available in the system for audit purposes) to ensure no tools or applications are accessible.

An example exit clearance form is shown in Figure 6-2, for reference. The complete form can be downloaded from the book’s resources.

A.8.1.1 Inventory of Assets (ISO 27001 Control)

Assets associated with information and information processing facilities should be identified and an inventory of these assets should be drawn up and maintained.

Explanation/what is required: The first step is to create an asset list by identifying the relevant assets. An inventory of these assets needs to be managed throughout their lifecycle, which includes creation, processing, storage, transmission, deletion, and destruction.

Evidence that can be prepared: An asset register should be prepared.

Who prepares it: The relevant department head/team members should prepare the asset register. For example, an HR asset inventory should be prepared by HR and the IT assets inventory should be prepared by the IT team/department.

For external audit: An external auditor may check for an asset register during the ISO 27001 audit.

A.8.1.2 Ownership of Assets (ISO 27001 Control)

Assets maintained in the inventory should be owned.

Evidence that can be prepared: Asset management policy and an asset register.

Who prepares it: The information security team should prepare the asset management policy and the relevant asset owner/department should prepare the asset register.

For external audit: An external auditor may check for this evidence, to verify that asset management practices are followed and managed throughout the asset’s lifecycle.

A.8.1.3 Acceptable Use of Assets (ISO 27001 Control)

Rules for the acceptable use of information and assets associated with information and information processing facilities should be identified, documented, and implemented.

Explanation: Assets are used by the organization and their suppliers or vendors and they must understand the information security requirement associated with each asset. Hence, they should be responsible for the assets provided to them for official use.

Evidence that can be prepared: Acceptable usages policy.

Who prepares it: The information security team and the relevant asset owner/department prepares the acceptable usages policies.

For external audit: An external auditor may check for the acceptable usages policy during the ISO 27001 audit.

A.8.1.4 Return of Assets (Control ISO 27001)

All employees and external party users should return all the organizational assets in their possession upon termination of their employment, contract, or agreement.

Explanation/what is required: This control explains the return of assets. For example, the employee or the vendor must return all the organizational assets when their project, contract, or agreement is closed. Upon termination of employment, assets such as laptops, company IDs, or any other asset provided by the company must be returned.

If an employee or external party is leaving the organization, they must document any job knowledge that is required for the smooth operation of the company. This document is sometimes known as knowledge transfer (KT)

Evidence that can be prepared: The exit form should indicate whether all assets have been returned.

Who prepares it: Each department head is responsible for collecting their assets and keeping records of that process.

For external audit: An external auditor may check for evidence in the form of physical or soft copies of reports or documents.

A.8.2.1 Classification of Information (Control ISO 27001)

Information should be classified in terms of legal requirements, value, criticality, and sensitivity to unauthorized disclosure or modification.

Explanation/what is required: The control says that classification of information should be done based on criticality, value, and sensitivity. The information classification should be done based on a risk assessment activity. Information classification must be defined based on the business need and there must be a process for defining and documenting information classification.

The frequency of information classification should be defined in the policy and should be updated based on the value and criticality of the information.

Evidence that can be prepared: Information classification policy and information classification guideline.

Who prepares it: The Information security team is responsible for preparing the information classification policy and guideline.

For external audit: The external auditor in the ISO 27001 audit will check for this document.

A.8.2.2 Labeling of Information (Control ISO 27001)

An appropriate set of procedures for information labeling should be developed and implemented in accordance with the information classification scheme adopted by the organization.

Evidence that can be prepared: Information classification policy and information classification guideline.

Who prepares it: The information security team is responsible for preparing the information classification policy and guideline.

For external audit: The auditor will look at the records for information labeling along with the policy document.

A.8.2.3 Handling of Assets (Control ISO 27001)

Procedures for handling assets should be developed and implemented in accordance with the information classification scheme adopted by the organization.

Evidence that can be prepared: Asset tracker and procedures for asset handling.

Who prepares it: Asset owners are responsible for handling assets and the information security team will facilitate with the asset handling procedure by getting input from various departments.

For external audit: The auditor will look at the records for asset handling along with the policy document.

A.8.3.1 Management of Removable Media (Control ISO 27001)

Procedures should be implemented for the removable of media in accordance with the classification scheme adopted by the organization.

Evidence that can be prepared: Prepare the procedure for the management of removable devices.

Who prepares it: The IT team is responsible for records related to media transfer. Policies should also be defined and implemented with the support of the information security team.

For external audit: The external auditor will look for this document.

A.8.3.2 Disposal of Media (Control ISO 27001)

Media should be disposed of securely when it’s no longer required, using formal procedures.

Evidence that can be prepared: The procedure document can be prepared to explain how you securely dispose of the media.

Who prepares it: The disposal of media is the responsibility of the IT departments and they must also prepare the procedure for securing media disposal with the help of the information security team.

For external audit: The external auditor will look for media disposal policy and procedure. They may ask for the media disposal records.

A.8.3.3 Physical Media Transfer (Control ISO 27001)

Media containing valuable information should be protected against unauthorized access, misuse, or corruption during transportation.

Evidence that can be prepared: A tracking log can be maintained to track media transfer. Tracking slips can be kept for record purposes.

Who prepares it: The admin from the IT team and the facility team should be responsible for creating the procedure and keeping the records in place.

For external audit: The external auditor may ask for the records and processes used to secure physical media transfer.

A.9.1.1 Access Control Policy (ISO 27001 Control)

As access control policy should be established, documented, and reviewed based on the business and information security requirements.

Explanation/what is required: The requirement is to design a policy for managing access rights permissions to information and various assets of the organization. It is important that access controls rights are specific to each user role.

Evidence that can be prepared: Access control policy and risk tracker (with identified risks as part of access permissions).

Who prepares it: Information security needs to get input from various departments including critical ones, such as the IT Helpdesk team, to define access control policy.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the access control policy in order to verify how the organization has defined and communicated the policy to all stakeholders.

A.9.1.2 Access to Networks and Network Services (ISO 27001 Control)

Users should only be provided access to the network and network services that they have been specifically authorized to use.

Explanation/what is required: The requirement is the same as the objective says, organizations must ensure only authorized users/employees are provided access to organization network and network services. Any unauthorized use can pose a threat to the organization’s information.

Evidence that can be prepared: Access control policy, network control policy, network diagram, and network monitoring logs

Who prepares it: The IT Helpdesk team along with the information security team would prepare the evidence.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has defined and implemented network policy, measures taken to protect network and network services.

A.9.2.1 User Registration and De-Registration (ISO 27001 Control)

A formal user registration and de-registration process should be implemented to enable assignment of access rights.

Evidence that can be prepared: Access control policy, user registration/de-registration procedures, requests raised for user registration/de-registration, evidence for user registration and disabling of user IDs, list of active and disabled user IDs, and monitoring records of user IDs at regular intervals

Who prepares it: The IT Helpdesk team along with the information security team would prepare the evidence.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has defined and implemented user registration and de-registration procedure. They might also check when user/employees left the organization and see Whether user IDs are disabled immediately or not.

A.9.2.2 User access provisioning (ISO 27001 Control)

A formal user access provisioning process should be implemented to assign or revoke access rights for all user types to all systems and services.

Explanation/what is required: The following points could be covered, based on organization business needs.

Before providing user access to the organization system and services, appropriate approvals must be taken from the owner of those system and services. It must be ensured that access rights are granted as per the defined policy and the roles defined for each user/designation. IDs of users whose roles have changed or have left the organization must be disabled immediately. Maintain the list of active and disabled user IDs.

Evidence that can be prepared: Access control policy, requests raised for the users for granting/revoking access, evidence for granting/revoking access for the users, list of active and disabled user IDs, monitoring records of user IDs at regular intervals

Who prepares it: The IT Helpdesk team along with the information security team would prepare the evidence.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has granted and revoked access to the users for specific information systems and services.

A.9.2.3 Management of Privileged Access Rights (ISO 27001 Control)

The allocation and use of privileged access rights should be restricted and controlled.

Evidence that can be prepared: Privileged user access control policy, requests raised for the privileged users ID, evidence for granting/revoking access for the privileged users ID, list of active and disabled privileged users ID, and monitoring records of privileged users ID at regular intervals

Who prepares it: The IT Helpdesk team along with the information security team would prepare the evidence.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has managed privileged user IDs access permission rights.

A.9.2.4 Management of Secret Authentication Information of Users (ISO 27001 Control)

The allocation of secret authentication information should be controlled through a formal management process.

Evidence that can be prepared: Password control policy, procedure how secret authentication information will be created, shared, and maintained

Who prepares it: The IT Helpdesk team along with the information security team would prepare the evidence.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will create, share, and maintain secret authentication information for employees/contractors.

A.9.2.5 Review of Users Access Rights (ISO 27001 Control)

Asset owners should review users access rights at regular intervals.

Evidence that can be prepared: Password control policy, review of user access rights permissions, logs of privileged user IDs access changes, and list of disable privileged user IDs

Who prepares it: The IT Helpdesk team along with the information security team would prepare the evidence.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will review the user access rights permissions at regular intervals to avoid any security breaches.

A.9.2.6 Removal or Adjustment of Access Rights (ISO 27001 Control)

The access rights of all employees and external users to information and information processing facilities should be removed upon termination of their employment, contract, or agreement or adjusted upon change.

Evidence that can be prepared: Access control policy, disable requests for the user IDs/password, and list of disable user IDs/password

Who prepares it: the Human resources team raises the disable requests for the user IDs/password with the IT Helpdesk team, who will disable and maintain appropriate record/evidence. The information security team will review and provide consulting about the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will review and disable user IDs/passwords of users.

A.9.3.1 Use of Secret Authentication Information (ISO 27001 Control)

User should be required to follow the organization’s practices when using secret authentication information.

Explanation/what is required: Secret authentication information shared with the user/employee must be kept confidential. It is advisable not to keep secret authentication information in written form, i.e. on paper. If password vaults are used then it can be stored, as they are more secure.

It is advisable to change secret authentication information, when there is an indication that it has been compromised. In such scenarios it must be changed immediately.

Evidence that can be prepared: Access control policy, secret authentication information policy, requests for the secret authentication information, list of users with secret authentication

Who prepares it: The IT Helpdesk team will share the secret authentication information and will maintain associated record/evidence. The information security team would review and provide consulting about the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will share secret authentication information with the user/employee and how it will be protected by user/employee while using it for the official purposes.

A.9.4.1 Information access restriction (ISO 27001 Control)

Access to information and application system functions should be restricted in accordance with the access control policy.

Evidence that can be prepared: Access control policy, list of users with access permission rights i.e. read, write, and delete for all applications, and list of active and disabled users.

Who prepares it: The IT Helpdesk team will prepare and maintain record/evidence. The information security team would review and provide consulting on the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will manage users with access permission rights (i.e. read, write, and delete) for all applications’ data/information.

A.9.4.2 Secure Log-On Procedures (ISO 27001 Control)

Where required by the access control policy, access to systems and applications should be controlled by a secure log-on procedure.

Evidence that can be prepared: Access control policy, secure log on procedure, and list of secure log-on incidents

Who prepares it: The IT Helpdesk team will prepare and maintain record/evidence. The information security team would review and provide consulting on the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization is managing secure log-on procedure to ensure only valid authorized users gain access to the systems.

A.9.4.3 Password Management System (ISO 27001 Control)

Password management systems should be interactive and should ensure quality passwords.

Evidence that can be prepared: Password creation policy, list of unique passwords per user ID, list of previous used passwords, configure system setting to change passwords every 90 days

Who prepares it: The IT Helpdesk team will prepare and maintain record/evidence. The information security team would review and provide consulting on the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will manage password management system to ensure no unauthorized access attempts are made.

A.9.4.4 Use of Privileged Utility Programs (ISO 27001 Control)

The use of utility programs that might be capable of overriding system and application controls should be restricted and tightly controlled.

Explanation/what is required: The organization must implement security controls to prevent utility programs from overriding the system on its own.

Evidence that can be prepared: List of utility programs in use, log information of the utility program, and list of disabled utility programs

Who prepares it: The IT Helpdesk team will prepare and maintain record/evidence. The information security team would review and provide consulting on the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will manage the usage of utility programs and preventing them from overriding the systems on their own.

A.9.4.5 Access Control to Program Source Code (ISO 27001 Control)

Access to program source code should be restricted.

Explanation/what is required: Organizations must implement security controls to restrict the access to program source code, to prevent unauthorized or unintentional changes to the source code. Organizations must assess the storage location of the source code, to manage the access in a better way.

Evidence that can be prepared: List of authorized users access to program source code, audit log of all successful and unsuccessful access attempts to the program source libraries, and list of users with disabled access (who left organization or change in their roles)

Who prepares it: The IT Helpdesk team will prepare and maintain record/evidence. The information security team would review and provide consulting on the process.

For external audit: An external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization will restrict the access to program source code to prevent the unauthorized access, unintentional changes, and source code from being copied.

A.11.1.1 Physical Security Perimeter

Control: Security perimeters should be defined and used to protect areas that contain either sensitive or critical information and information processing facilities.

Explanation: The boundaries of the organization must be secured and defined. The expectation here is to have a secure fence or building wall that can protect critical information from compromise. The sensitive assets can be kept under secured room and in lockers.

A.11.1.2 Physical Entry Controls

Control: Secure areas should be protected by appropriate entry controls to ensure that only authorized personnel are allowed access.

A.11.1.3 Securing Offices, Rooms, and Facilities

Control: Physical security of offices, rooms, and facilities should be designed and applied.

A.11.1.4 Protecting Against External and Environmental Threats

Control: Physical protection against natural disasters, malicious attacks, or accidents should be designed and applied.

Explanation: This control covers how you protect your organization from natural disasters and malicious attack or accidents. Here you need to identify potential natural or man-made disasters. Take a few examples of environmental threats such as floods, tornado, earthquake, lightning, fire, etc. Man-made threats can be water leakage from the company facility or any other things that make the environment difficult to work for the employees.

The external auditor will check for evidence that you identified all the potential threats and vulnerabilities and you also accessed or treated the environmental risks.

A.11.1.5 Working in Secure Areas

Control: Procedures for working in secure areas should be designed and applied.

Evidence that can be prepared: A procedure or policy document for keeping work area secured. Also, the auditor can ask for supporting evidence.

A.11.1.6 Delivery and Loading Areas

Control: Access points such as delivery and loading areas and other points where unauthorized persons could enter the premises should be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access.

Explanation: This control covers the delivery and loading areas protection. The focus is on keeping unauthorized people away from the processing information facilities and to keeping them in an isolated area if possible under the supervision of CCTV recording 24/7. If this control does not apply to your organization, it can be updated in the SOA (Statement of Applicability) document as Not Applicable.

Evidence that can be prepared: A procedure or policy document can be written which clearly defines who all can enter the delivery and loading premises.

A.11.2.1 Equipment Siting and Protection

Control: Equipment should be sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access.

Evidence that can be prepared: Clear desk/screen policy and the risk assessment document

Who prepares it: The IT team is responsible for securing equipment siting and protection.

For external audit: The external auditor conducting the ISO 27001 audit may ask for evidence.

A.11.2.2 Supporting Utilities (Control ISO 27001)

Equipment should be protected from power failures and other disruptions caused by failures in supporting utilities.

Who prepares it: The IT and the Admin teams are responsible for securing the supporting utilities and upkeep of records.

For external audit: The external auditor conducting the ISO 27001 audit may ask for this evidence.

A.11.2.3 Cabling Security (Control ISO 27001)

Power and telecommunications cabling carrying data or supporting information services should be protected from interception, interference, or damage.

Evidence that can be prepared: Access control to the cable/network room and maintenance and inspection record of cables.

Who prepares it: The IT team is responsible for the cabling security along with other relevant stakeholders if available.

For external audit: The external auditor may physically verify the cabling security and can ask for some evidence for maintenance and upkeep of cables.

A.11.2.4 Equipment Maintenance (Control ISO 27001)

Equipment should be correctly maintained to ensure its continued availability and integrity.

Evidence to be prepared:

Maintenance record for all equipment, list of assets under maintenance.

Who prepares it: The IT or Admin team is responsible for the regular maintenance of equipment.

For external audit: The external auditor conducting the ISO 27001 audit may ask for this evidence.

A.11.2.5 Removal of Assets (Control ISO 27001)

Equipment, information, or software should not be taken off-site without prior authorization.

Evidence that can be prepared: Gate pass for equipment taken off-premises.

Who prepares it: The IT team, along with the admin team, is responsible for securing the removal of assets.

For external audit: The external auditor conducting the ISO 27001 audit may ask for this evidence.

A.11.2.7 Secure Disposal or Reuse of Equipment (Control ISO 27001)

All items of equipment containing storage media should be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.

Evidence that can be prepared: Media disposal and reuse policy, and encryption policy

Who prepares it: The IT team is responsible for defining and documenting the media disposal and encryption policy along with other stakeholders.

For external audit: The external auditor conducting the ISO 27001 audit may ask for this evidence.

A.11.2.8 Unattended User Equipment (Control ISO 27001)

Users should ensure that unattended equipment has appropriate protection.

Evidence that can be prepared: A log document for keys and drawers assigned to individuals and a session report from the server.

Who prepares it: The IT team is responsible for defining policy and procedure to protect unattended users’ system or equipment.

For external audit: The external auditor may check for the list of keys or lockers allocated to individuals or may ask for related evidence.

A.11.2.9 Clear Desk and Clear Screen Policy (Control ISO 27001)

A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities should be adopted.

Evidence that can be prepared: Clear desk and screen policy and an access control policy

Who prepares it: The IT team is responsible for defining the clear desk/screen policy.

For external audit: The external auditor conducting the ISO 27001 audit may ask for the evidence.

A.12.1.1 Documented Operating Procedures (ISO 27001 Control)

Operating procedures should be documented and made available to all users who need them.

Explanation/what is required: All the standard operating procedures related to business processes must be defined and made available to all the employees and contractors to perform the daily tasks in smooth and secure manner. This procedure will ensure that everybody understands their roles. It will help reduce the probability of information security risks happening.

Evidence that can be prepared: All the required standard operating procedures.

Who prepares it: All the department stakeholders will define the procedures with the help of the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the standard operating procedures, and determine how easily they are accessible for the employees who need them to execute the tasks as new employees keeps joining the company. They must be made aware of the path/portal from where they can access this information.

A.12.1.2 Change Management (ISO 27001 Control)

Change to the organization business processes, information processing facilities, and systems that affect information security should be controlled.

Explanation/what is required: Whenever a change occurs in the organization in terms of business processes or tools/applications, responsibilities etc., that change must be planned and executed in a controlled manner. When changes occur, it becomes important to re-analyze the security controls, as they might need changes too. All the security risks must be analyzed thoroughly for their potential impact on the security controls and appropriate approvals to be taken from the change control board (CCB) before implementing change management. Any security risk you skip can lead to a threat to the company information once it is released/implemented into the system.

Who prepares it: The information security department, with the help of the subject matter experts selected for the implementation team, should define the change management procedure, as it needs to cover all aspects of business operations. Concerned department stakeholders should prepare the change and impact analysis form and maintain the change log/tracker on a regular basis.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the change management procedures. They will confirm that the change control board is created to review/approve the changes before they are implemented and released into the system or business operations for employees/contractors to follow.

Also, the change and impact analysis form and the change log/tracker will be verified for any current changes.

A.12.1.3 Capacity Management (ISO 27001 Control)

The use of resources should be monitored and tuned, and projections made of future capacity requirements to ensure the required system performance.

Explanation/what is required: The requirement is whenever the IT systems reach their maximum capacity levels (such as server disk space). Overloaded systems usually don’t run at optimum efficiency levels, which downgrades the service levels for your system users/customers, and it will directly impact the business. It is important to keep analyzing and monitoring the performance of your systems on a regular basis. Once you start analyzing the usage of your systems, you need to forecast whether there is any need to upgrade the systems in terms of numbers or capacity to deliver the optimum performance levels.

Who prepares it: The information security department, with the help of the subject matter expects selected for the implementation team, should define the capacity management procedure, as it needs to cover all aspects of the business.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the capacity management procedures, to check how capacity management I monitored, forecasted, and planned for the systems to deliver optimum performance levels.

A.12.1.4 Separation of Development, Testing, and Operational Environment (ISO 27001 Control)

Development, testing, and operational environments should be separated to reduce the risks of anybody having unauthorized access or changes to the operational environment.

Explanation/what is required: The requirement is to maintain the development, testing, and operational environments separately, employees/contractors working on these environments their access must be checked and controlled, so that they do not perform any unauthorized actions or changes in the system. These must be detectable easily for all the verification and future audit purposes, as any incident occurs this information is always helpful.

Evidence that can be prepared: The environment creation procedures.

Who prepares it: The information security department, with the help of the subject matter expects selected for the implementation team, should define the environment creation guideline.

Project managers should define all the access controls for all the different environments for their project team members. Access control reviews must be performed on a regular basis and records must be maintained.

The IT helpdesk team creates and maintains separate environments for development, testing, and operations.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the environment creation guideline, to check how the environment is created and access control levels are planned, given, and monitored on a regular basis.

A.12.2.1 Controls Against Malware (ISO 27001 Control)

Detection, prevention, and recovery controls to protect against malware should be implemented, combined with appropriate user awareness.

Explanation/what is required: As you are aware, malware is a serious threat so organizations must analyze and implement appropriate security controls, including educating the employees on a regular basis to prevent malware attacks. It is important that organizations install malware detection software as it will scan all the incoming data and will block any malware threat. The malware detection software may not be able to protect your systems in all the scenarios, so the focus must be more on prevention methods.

Evidence that can be prepared: An authorized software usage policy to prohibit employees from using any unauthorized/unapproved software/tools. An antivirus policy because all systems must be installed with the antivirus/antimalware software to prevent any form of information security attack.

Standard operating procedures could be prepared that can guide teams during a malware attack as what should be done and what the responsibilities are of employees/resolution teams. Also, it could be the part of business continuity planning as well, as if systems are down due to a malware attack then how to recover from it, for e.g. all crucial/important data and software is backed up and could be restored faster to make your organizations systems up and running.

Records of scan results showing prevention/detection/removal of malware.

Employee training/awareness plan and participation evidence i.e. training attendees and training material etc.

Records of regular patch updates to the malware/antivirus detection software.

Who prepares it: The information security department, with the help of the IT Helpdesk team, which is part of implementation team, should define the policies and procedures.

The IT Helpdesk team maintains all the records of scan results, showing prevention/detection/removal of malware. It also patches the update records. The information security team maintains the employees training/awareness plan and the training participation records.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the policies and procedures. Malware/antivirus software installed on organization systems/machines should be up to date and working. Records of scan results/regular patch updates. Employee training evidence.

A.12.3.1 Information Backup (ISO 27001 Control)

Backup copies of information, software, and system images should be taken and tested regularly in accordance with an agreed backup policy.

Explanation/what is required: Organizations must define a backup policy that can be followed to prevent the loss of data. The policy should cover how the backup activities will be done to protect the information. Once the data backup is done, it needs to be stored. It is important to define how the data will be stored on tapes, on cloud, etc. Also, how long will the data be retained, such as for or years or seven years, for example. The backup data must be tested on a regular basis to check whether it can be restored easily and is working as required.

As per the ISO 27001 standard it is the requirement that backup data/information be stored far from the main office site/location, to protect it from any type of damage due to natural unexpected disaster at the main office, this will help also help to restore the data safely whenever required. Also, the site or location where the data would be kept for storage must be access controlled, and no unauthorized individuals should be allowed to gain access. The location should be compliant to standard security requirements (fire proof, able to handle floods/earthquake, etc.).

The organization should analyze and define their own backup policy/procedure. As each organization can have different requirements, some may require real-time imaging of the data as they might be processing financial transaction.

Who prepares it: The information security department with the help of the IT Helpdesk team, which is part of implementation team, should define the policies and procedures.

For external audit: The external auditor conducting the ISO 27001 certification audit will check for the policies and procedures. They check how the back procedure is followed as a practice in the organization and whether it is compliant as per the ISO 27001 standards.

A.12.4.1 Event Logging (ISO 27001 Control)

Event logs recording user activities, exceptions, faults, and information security events should be produced, kept, and regularly reviewed.

Explanation/what is required: Organizations must create the provisions and implement security controls so that they can record all the user activities that they are doing on the organization systems allotted to them. This ensures that they are not misusing or trying to gain any unauthorized access or sharing the information outside the organization. This will be stored in the form of event logs.

Apart from the user/employee activities, it is also important to know if there are any system level faults/errors or exceptions scenarios. This information could also be available via the stored event logs.

Evidence that can be prepared:

Who prepares it: The IT Helpdesk team can prepare all the evidence/documents by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure and records in order to understand how user activities and system faults/errors are tracked and monitored.

A.12.4.2 Protection of Log Information (ISO 27001 Control)

Logging facilities and log information should be protected against tampering and unauthorized access.

Explanation/what is required: Organizations must create the provisions and implement security controls to prevent the logs from being tampered with. If these logs are tampered with, the purpose of storing them would not make sense.

Hence, it is important to detect whenever there are changes or deletions to the logs. Also, you may need to monitor if there is enough storage space to record all the log events. If there is a space issue then log information may be overwritten.

Evidence that can be prepared: Implemented security tools that will help to detect and record the logs of unauthorized changes or access to the logs monitor the disk space left to record the logs without any interruption.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting with the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the controls/records in order to understand how logs are protected from being tampered and from unauthorized access.

A.12.4.3 Administrator and Operator Logs (ISO 27001 Control)

System administrator and system operator activities should be logged, and the logs should be protected and regularly reviewed.

Explanation/what is required: Organizations must create the provisions and implement security controls to prevent logs from being tampered with by the employees who are designated as the administrator. They could modify the log data which is an information security breach.

Evidence that can be prepared: Implemented security tools help to detect and record the logs of administrator activities and a regular review of administrator activities logs.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the controls/records in order to understand how administrator logs are protected.

A.12.4.4 Clock synchronization (ISO 27001 Control)

The clocks of all relevant information processing systems within an organization or security domain should be synchronized to a single reference time source.

Explanation/what is required: Organizations must ensure that the clocks of all the information processing systems within their organization/scope are automatically synchronized with an accurate time source. It is very important that time source is reliable because the purpose is to record the accurate timestamps of the security events that occur in your organization on a specific day/time.

Hence, these logs and records are required for investigation purposes internally due to disciplinary issues or could be required by the legal authorities. Because of this it is important that all computer clocks and telephone systems must display accurate time, and this can be done through network time protocol mechanism, which will help to synchronize clocks on computers, across networks (Internet or local area networks—LANs and all the servers).

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the controls/records in order to verify whether all information processing systems of the organization are displaying the correct clock synchronization from a reliable time source.

A.12.5.1 Installation of Software on Operational Systems (ISO 27001 Control)

Procedures should be implemented to control the installation of software on operational systems.

Explanation/what is required: Organizations must create provisions and implement security controls so that they can prevent employees/contractors from installing software that is unauthorized/unapproved. It must be done only by the trained administrator once they receive approval from authorizing body members.

The main purpose of preventing such installations is to avoid any security threat/attack. If employee/contractor installs any malicious software on their allotted computer systems, it could pose a big threat and would become easier for any hacker to install malware.

Hence, it is advisable that computer systems of employee/contractors not bee allowed to install software. Employees must be routed to a Helpdesk system to log a request to install required software. The request then must be approved by the requestor immediate supervisor and to a final approver who has authority to accept or reject the request upon assessing the security threat that might occur.

It is very important that organizations/teams assess all the scenarios i.e. operational and security related before implementing any software changes to the operational systems. Whenever any new software version changes and must be installed, teams must have the rollback plan and must retain previous versions of the software as a contingency. Hence it is advisable that all new software and new versions of software be thoroughly tested on individual systems first to assess any problems before declaring them as fit for implementation and use.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy/procedure/security controls/records in order to verify that unauthorized/unapproved software is not installed on computer systems/or any other devices by the employees/contractors and only trained administrator have installed them upon acquiring the necessary approvals.

A.12.6.1 Management of Technical Vulnerabilities (ISO 27001 Control)

Information about technical vulnerabilities of information systems being used should be obtained in a timely fashion. The organization’s exposure to such vulnerabilities should be evaluated and appropriate measures taken to address the associated risk.

Explanation/what is required: Organizations must create the provisions and implement security controls so that they can prevent the exploitation of the identified technical vulnerabilities. Before proceeding further, it is important to understand what vulnerability is.

Each vulnerability will be different depending on the business or domain they are responsible for. Technical teams/experts must analyze and perform tests accordingly.

Who prepares it: The IT Helpdesk team for network vulnerability testing and for application vulnerability could be a separate technical team of experts. They can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy/procedure/security controls/records. They verify that organizations are detecting vulnerabilities and are taking necessary actions on a regular basis to secure organization information processing systems.

A.12.6.2 Restrictions on Software Installation (ISO 27001 Control)

Rules governing the installation of software by users should be established and implemented.

Explanation/what is required: Organizations must create the provisions and implement security controls to restrict the users/employees to install software on their computer systems. Organizations can create the list of software that the user/employee can install. The list must be communicated to reduce the risk of any threats arising from unapproved/unauthorized software installation.

For this control to work effectively, users/employees must be provided with least privileges. These privileges should be provided based on the user/employee role and must be monitored on a regular basis.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy/procedure/security controls/records. They verify how organizations have implemented the controls to restrict the users/employees from installing any software.

A.12.7.1 Information system audit controls (ISO 27001 Control)

Audit requirements and activities involving verification of operational systems should be carefully planned and agreed to minimize disruptions to business processes.

Explanation/what is required: Though audit is a mandatory exercise for any organization, it should be planned carefully to minimize the disruptions to the operations and its systems, which might occur during the audit verification exercise.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy/procedure/security controls/records. To verify how organizations has implemented the controls to minimize the impact on operations/systems due to audit verification exercises.

A.13.1.1 Network Controls (ISO 27001 Control)

Networks should be managed and controlled to protect information in systems and applications.

Who prepares it: The information security team needs to get input from various departments, including critical ones like the IT Helpdesk team, to define the access control policy.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has defined and communicated the policy to all stakeholders.

A.13.1.2 Security of Network Services (ISO 27001 Control)

Security mechanisms, service levels, and management requirements of all network services should be identified and included in network services agreements, whether these services are provided in-house or outsourced.

Explanation/what is required: Organizations hire network service providers for their Internet service requirements, it is important to assess whether service providers are capable to provide Internet services by following secure methods. To minimize information security risks and its impact, organizations must have network services agreement signed with the service provider by clearly defining the required service levels.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the network services agreement done with the network service provider. They verify how the organization has defined the agreement with the vendor to safeguard their organization information.

A.13.1.3 Segregation in Networks (ISO 27001 Control)

Groups of information services, users, and information systems should be segregated on networks.

Explanation/what is required: Segregate them to make them work separately in a secure manner, because this way it will not be easy for hackers to identify the structure of your organization network and will help in preventing network intrusion attacks. The main aim of network segregation is to put restrictions on accessing sensitive information, hosts, and services. Hence, segregation measures must be assessed as per the access control policy before implementation, as it can impact the network performance.

Who prepares it: The information security team facilitates in defining the network control policy by getting input from the IT Helpdesk team. The IT Helpdesk team defines the network diagram showing the segregated network.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence to verify how the organization has done the networks segregation to restrict the access for preventing network intrusion attacks.

A.13.2.1 Information Transfer Policies and Procedures (ISO 27001 Control)

Formal transfer policies, procedures, and controls should be in place to protect the transfer of information using all types of communication facilities.

Explanation/what is required: Organizations should define policies and procedures for implementing controls in safeguarding the transfer of information by employees/contractors at work.

Organizations can identify many more controls, by assessing the tools/equipment used for transferring the information. As tools/technologies keep changing, you need to always assess risks to prevent mistakes and breaches while using them, as any security incident may also lead to legal implications.

Who prepares it: The information security team helps define the information transfer policy and procedure by getting input from the IT Helpdesk team. The IT Helpdesk team implements the security controls.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence. They verify how security controls are implemented for safeguarding transfer of information via various modes of communication.

A.13.2.2 Agreements on Information Transfer (ISO 27001 Control)

Agreements should address the secure transfer of business information between the organization and external parties.

Who prepares it: The information security team facilitates in defining the information transfer policy and agreements. Before agreements are finalized they must be reviewed and approved by the legal team to prevent any liabilities of the organization during an information security breach.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how agreements are framed and what controls are covered as part of the agreement.

A.13.2.3 Electronic Messaging (ISO 27001 Control)

Information involved in electronic messaging should be appropriately protected.

There could be many more areas, which an organization must assess before allowing the use of electronic messaging.

Evidence that can be prepared: Electronic messaging policy

Who prepares it: The information security team will facilitate in defining the electronic messaging policy in discussion with the IT/Helpdesk team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the electronic messaging policy is defined and implemented in your organization.

A.13.2.4 Confidentiality or Non-Disclosure Agreements (ISO 27001 Control)

Requirements for confidentiality or non-disclosure agreements reflecting the organization needs for the protection of information should be identified, regularly reviewed, and documented.

Explanation/what is required: Organizations must create non-disclosure agreements (NDAs), either with external parties or with the employees as required, to protect the company information. NDAs cover the legal aspects to make the parties liable for protecting the information.

There could be many more points, which an organization must assess before finalizing on the non-disclosure agreement

Evidence that can be prepared: Non-disclosure agreement

Who prepares it: The legal team will facilitate in defining/reviewing and finalizing the non-disclosure agreement.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the non-disclosure agreement is defined and shared/signed with external parties or with employees to safeguard company information.

A.14.1.1 Information Security Requirements Analysis and Specification (Control ISO 27001)

The information security-related requirements should be included in the requirements for new information systems or enhancements to existing information systems.

Evidence that can be prepared: Requirements document with security requirements and test records

Who prepares it: The requirements document should be prepared by the software development team along with relevant stakeholders.

For external audit: The external auditor will look for the evidence of security requirements. For example, the requirement document can be checked for whether you are covering the security requirement or not.

A.14.1.2 Securing Application Services on Public Networks (Control ISO 27001)

The information involved in application services passing over public networks should be protected from fraudulent activity, contract dispute, and unauthorized disclosure and modification.

Explanation/what is required: The software application uses lots of data and these data travel on public networks. This control covers the security of application services over the public network. For example, the video learning platform wants to restrict the download of paid videos on a public network and this becomes one of the security requirements.

Evidence that can be prepared: Network security evidence such monitoring logs and authentication mechanism

Who prepares it: The software development team along with the IT team is responsible for preparing the required evidence along with relevant stakeholders.

For external audit: The auditor may check for security events logs, payment logs, and system error logs.

A.14.1.3 Protecting Application Services Transactions (Control ISO 27001)

The information involved in application service transactions should be protected to prevent incomplete transmission, misrouting, unauthorized message alteration, unauthorized disclosure, and unauthorized message duplication or replay.

Evidence that can be prepared: Payment logs, digital signatures and certificates

Who prepares it: The IT and software development teams are responsible for the security of application services.

For external audit: The external auditor may check for storage of certificates and ask for the logs and enquire about what kind of encryption tools are used.

A.14.2.1 Secure development policy (Control ISO 27001)

Rules for the development of software and systems should be established and applied to developments within the organization.

Evidence that can be prepared: A secure code repository and version control. The coding guidelines for each programming language used in the organization.

Who prepares it: The software development team is responsible for preparing the coding guidelines and the IT/Infrastructure team is responsible for keeping the development environment secure.

For external audit: The external auditor will try to understand how you are securing your development environment and how the version control is done.

A.14.2.2 System Change Control Procedures (Control ISO 27001)

Changes to systems within the development lifecycle should be controlled using formal change control procedures.

Who prepares it: The software development is responsible for preparing the evidence document and other required controls.

For external audit: The external auditor can ask for a change-log document and/or the procedure to manage changes within the software development lifecycle.

A.14.2.3 Technical Review of Applications after Operating Platform Changes (Control ISO 27001)

When operating platforms are changed, business-critical applications should be reviewed and tested to ensure there is no adverse impact on organizational operations or security.

Evidence that can be prepared: Test case document and test results

Who prepares it: The software development team is responsible for the technical review of the application after a change in the operating platform.

For external audit: The external auditor may ask for a test case document or evidence of technical review.

A.14.2.5 Secure System Engineering Principles (Control ISO 27001)

Principles for engineering secure systems should be established, documented, maintained, and applied to any information system implementation efforts.

Evidence that can be prepared: Coding guidelines for all programming languages.

Peer code review process can be defined and documented.

Who prepares it: The software development team is responsible for establishing secure engineering principles.

For external audit: The auditor may ask for the guidelines you use to protect the code from unauthorized access and may ask for some related evidence.

A.14.2.6 Secure Development Environment (Control ISO 27001)

Organizations should establish and appropriately protect secure development environments for system development and integration efforts that cover the entire system development lifecycle.

Explanation/what is required: The control covers the security of the development environment. This includes people, processes, and associated technology for development integration.

Evidence that can be prepared: Segregation of development environment. Secure code repository. Procedure for code deployment from one development environment to another.

Who prepares it: The software development team is responsible for maintaining the secure development environment.

For external audit: The auditor may check the evidence for segregation of development environment.

A.14.2.7 Outsourced Development (Control ISO 27001)

The organization should supervise and monitor the activity of outsourced system development

Who prepares it: Management, along with relevant stakeholders , will be responsible for agreement along with the legal team and the software development team for test results and audit.

For external audit: The auditor may check the agreement or legal binding document between both parties.

A.14.2.8 System Security Testing (Control ISO 27001)

Testing the security functionality should be carried out during development .

Explanation/what is required: This control covers system security testing, which is performed during the development cycle. The security testing should be performed rigorously for the development project. Independent software testing should be performed for the acceptance of software application/product.

Evidence that can be prepared: Security test cases for the application/software product and security test results.

Who prepares it: The software development team is responsible for security testing of software development.

For external audit: The external auditor conducting the ISO 27001 audit can ask for the evidence.

A.14.2.9 System Acceptance Testing (Control ISO 27001)

Acceptance testing programs and related criteria should be established for new information systems, upgrades, and new versions.

Explanation/what is required: System acceptance testing should include testing of information security requirements. Organizations can leverage automated tools such as code scanner and vulnerability assessment.

Evidence that can be prepared: Security test cases and user acceptance test result

Who prepares it: The IT/Software development team is responsible for system acceptance testing.

For external audit: The external auditor conducting the ISO 27001 audit may check the security test case and results.

A.14.3.1 Protection of Test Data (Control ISO 27001)

Test data should be selected carefully, protected, and controlled.

Evidence that can be prepared: Test data and audit trail log for test data

Who prepares it: The software development team is responsible for the protection of test data.

For external audit: The external auditor conducting the ISO 27001 audit may ask for audit tail log of test data or other related evidence.

A.15.1.1 Information Security Policy for Supplier Relationships (ISO 27001 Control)

Information security requirements for mitigating the risks associated with supplier’s access to the organization’s assets should be agreed with the supplier and documented.

Explanation/what is required: Organizations must identify all the essential security controls and communicate to all employees/contractors/suppliers by creating a policy. Organizations need to mandate that suppliers adhere to the organizational policy and no unauthorized attempts be made for gaining access to the organization information and assets. It is important to define a clear procedure to implement identified security controls to guide the implementation teams.

How will incident management be done, if any supplier related incidents occur. The organization must plan and conduct awareness sessions for members of the supplier’s organization that would be accessing your organization’s information and assets.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy/procedure/security controls/records in order to verify how organizations have implemented the security controls for preventing unauthorized access.

A.15.1.2 Addressing Security Within Supplier Agreements (ISO 27001 Control)

All relevant information security requirements should be established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure components for the organization information.

Explanation/what is required: Once the supplier agreement is established between your organization and the supplier, both are aware of their obligations. This will also ensure that there are no misunderstandings between the organizations/parties. The agreement must be agreed and signed.

Policies to be followed as required by the work scope and contract:

It is important to include that your organization has the right to audit supplier organization whenever there is a security incident, or any type of issue observed for investigation purposes.

There could be many more points that can be mentioned inside the agreement to avoid any conflicts between your organization and the supplier. These are just examples for reference purposes only. Organizations may add more depending on their business/project scope.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy and the supplier agreement. To verify whether organizations have established the supplier agreement with the vendor/supplier, the agreement covers all the essential points to safeguard the organization’s interests and avoid any conflicts, and whether the agreement was signed or expired will also be audited.

A.15.1.3 Information and Communication Technology Supply Chain (ISO 27001 Control)

Agreements with suppliers should include requirements to address the information security risks associated with information and communications technology services and product supply chain.

There could be many more points inside the agreement. These are just examples for reference purposes only. Organizations may add more depending on their business/project scope.

Who prepares it: The information security team prepares the supplier relationship policy in discussion with various departments/implementation teams.

Concerned department heads prepare the agreements based on the services acquired from each supplier. Agreements must be reviewed by the legal team to avoid any conflicts and legal issues in the future.

Concerned departments prepare the procedure and results for monitoring and validating products and services.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy and the supplier agreement. To verify whether organizations have established the supplier agreement with the vendor/supplier, the agreement covers all the essential points to safeguard the products and services of supply chain.

A.15.2.1 Monitoring and Review of Supplier Services (ISO 27001 Control)

Organizations should regularly monitor, review, and audit supplier service delivery.

Explanation/what is required: Once the supplier starts providing their services, they must be regularly monitored, reviewed, and audited.

There could be many more points that can be mentioned for monitoring the performance of supplier performance. These points are for reference purposes only. Organizations may add more depending on their business/project scope

Who prepares it: The information security team prepares the supplier relationship policy in discussion with various departments/implementation teams.

Concerned department heads prepare the agreements based on the services acquired from each supplier. Agreements must be reviewed by the legal team to avoid any conflicts and legal issues in the future.

Concerned departments prepare the procedure and results for monitoring and validating products and services.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy and the supplier agreement. They verify how monitoring, reviewing, and auditing activities have been performed by your organization and follow up on the closure of identified issues.

A.15.2.2 Managing Changes to Supplier Services (ISO 27001 Control)

Changes to the provision of services by suppliers, including maintaining and improving existing information security policies, procedures, and controls should be managed, considering of the criticality of business information, systems, and processes involved and re-assessment of risks.

Explanation/what is required: Once the supplier starts providing their services, changes to the services might be required. Once the agreement is revised, risk assessment must be done to identify the existence of new risks.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the policy and the supplier agreement. They verify how supplier agreements are revised based on the organization’s business needs. The risks are reassessed based on the changes.

A.16.1.1 Responsibilities and Procedures (ISO 27001 Control)

Management responsibilities and procedures should be established to ensure a quick, effective, and orderly response to information security incidents.

Explanation/what is required: Management must ensure that incident management procedures are defined and communicated to all within the organization.

It is important that skilled employees handle the response to the incidents to ensure that incidents are resolved in an effective manner.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records to verify how the organization has defined and managed incident management activities, how incidents are reported, and the resolution status communicated with the incident reporter.

A.16.1.2 Reporting Information Security Events (ISO Control)

Information security events should be reported through appropriate management channels as quickly as possible.

Explanation/what is required: The requirement is whenever any employee or contractor observes any security events in the system, it must be reported to the incident response team as quickly as possible, so that they can respond to the incident faster to minimize its impact on the organization information security. It is important that employee/contractor must be made aware of the procedures for reporting the security events and knows to whom to report any security event.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records in order to verify how the organization has defined and managed incident management activities, how incidents are reported, and how the resolution status was communicated to the incident reporter.

A.16.1.3 Reporting Information Security Weaknesses (ISO Control)

Employees and contractors using the organization’s information systems and services should be required to note and report any observed or suspected information security weaknesses in systems or services.

Explanation/what is required: Whenever any employee or contractor observes a security weaknesses in the system, they must report it to the incident response team as quickly as possible. It is important that the reporting mechanism be easy to use and readily available.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records in order to verify how employee/contractors report the security weaknesses and what reporting mechanisms are provided.

A.16.1.4 Assessment of and Decision on Information Security Events (ISO Control)

Information security events should be assessed, and it should be decided if they are to be classified as information security incidents.

Explanation/what is required: Assess the information security event to decide whether the security event is really an information security incident, assessment to be done by the point of contact, incident response team by referring to the incident classification scale, as this will also help to assess the impact and priority of an incident. For future reference purposes, all the security events assessment results must be recorded.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records in order to verify how security events are assessed and classified as an information security incident. Also, they check how the details of the security events assessments results are recorded for future verification purposes.

A.16.1.5 Response to Information Security Incidents (ISO Control)

Information security events should be responded to in accordance with the documented procedures.

Explanation/what is required: The information security incident must be responded to by the designated member/point of contact of the organization. There could be scenarios where members from outside the organization need to respond to the security incident as well.

Once all the required actions are taken on the incident, the status should change to closed and all the details should be recorded.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records in order to verify how security incident responses are communicated and recorded by the organization.

A.16.1.6 Learning from Information Security Incidents (ISO Control)

Knowledge gained from analyzing and resolving information security should be used to reduce the likelihood or impact of future incidents.

Explanation/what is required: Organizations must analyze all the data collected during the evaluation of information security incident. This data will help to assess whether similar type of incidents may occur on a frequent basis. After the analysis of such data, organizations must identify appropriate security controls for implementation to minimize the occurrence and impact of information security incident. The whole purpose of this control is to plan and implement improvements.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records in order to verify how the security incident evaluation results are analyzed.

A.16.1.7 Collection of Evidence (ISO Control)

The organization should define and apply procedures for the identification, collection, acquisition, and preservation of information, all of which can serve as evidence.

Explanation/what is required: Organizations must create the provisions to protect and safely store the information that could serve as the potential evidence, which would be required whenever any disciplinary process is initiated. It is important that access to stored evidence must always be monitored, that they are not altered or deleted by unauthorized persons as they can hamper in the legal proceedings. Sometimes it becomes necessary that a lawyer or the police be involved as soon as possible.

Who prepares it: The IT Helpdesk team can prepare all the evidence/records by consulting the information security team.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the procedure/records in order to verify how security controls are implemented and monitored to protect the evidence from being altered or deleted.

A.17.1.1 Planning Information Security Continuity (ISO 27001 Control)

The organization should determine its requirements for information security and the continuity of information security management in adverse situations e.g. during a crisis or disaster.

Explanation/what is required: Perform robust planning for the organization’s information security management in unexpected adverse situations. These situations are explained in earlier chapters—a fire, electricity/power blackout, floods, cyber-attack by a hacker. If there is no preparation/planning done, there could be big negative impact. Recovery from such situations could take a lot of time and money. It is therefore advisable that organizations conduct impact analysis on their business continuity requirements and plan for a strategy that will help them execute the disaster recovery plan quickly.

Evidence that can be prepared: Business impact analysis document. business continuity and disaster recovery policy.

Who prepares it: Information security would need to get input from various departments, including critical ones like the IT Helpdesk team, to conduct a business impact analysis and prepare a business continuity and disaster recovery policy.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the business impact analysis and business continuity and disaster recovery policy. They verify how the organization has conducted the impact analysis to analyze all their critical business needs.

A.17.1.2 Implementing Information Security Continuity (ISO 27001 Control)

The organization should establish, document, implement, and maintain processes, procedures, and controls to ensure the required level of continuity for information security during an adverse situation.

Explanation/what is required: To face any adverse situation, the organization needs a lot of preparation. This includes approved documented plans, response and recovery procedures that explain the steps to be followed for different types of situations that may occur, and clear roles and responsibilities of employees/contractors/suppliers etc. with authorization levels to avoid miscommunicating. Preparing for business continuity is not a small task. It requires expertise with experienced skilled professionals who do a lot of analysis and planning. It is advisable that the organization identify their predetermined levels of information security they need to maintain after an adverse situation in order to run their business operations smoothly.

Evidence that can be prepared: Disaster response and recovery procedure and business continuity plan document

Who prepares it: Information security needs to get input from various departments including critical ones, such as the IT Helpdesk team, to prepare a business continuity and disaster recovery procedure and a business continuity plan document.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has done the planning and prepared their organization, i.e., what procedures will be followed by the teams to deal with adverse situations.

A.17.1.3 Verify, Review, and Evaluate Information Security Continuity (ISO 27001 Control)

The organization should verify the established and implemented information security continuity controls at regular intervals in order to ensure that they are valid and effective during adverse situations.

Explanation/what is required: Review and check whether there are any operational changes in the organization that require the business continuity planning and procedures to change.

For example, it is best to conduct a fire drill exercise for your organization/employees/emergency response teams as they would be aware and prepared to handle the situations effectively. During such situations, fire alarms should work, doors should be automatically open, water sprinklers must sprinkle water to douse the fire, and many more.

Wherever and whenever required, test your procedures, tools, technology, infrastructure etc. to ensure they are up to date, relevant, and would be enough to help your organization.

Evidence that can be prepared: Disaster response and recovery test procedure and test/review records

Who prepares it: the Information security, team along with the various departments stakeholders, will prepare test procedures and prepare test/review records after conducting various tests/reviews.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has identified relevant security controls and tested them to prepare for any adverse situations.

A.17.2.1 Availability of Information Processing Facilities (ISO 27001 Control)

Information processing facilities should be implemented with redundancy enough to meet availability requirements.

Evidence that can be prepared: Redundancy test planning, test records, and the risk tracker (for new risks identified during redundancy availability testing)

Who prepares it: The IT Helpdesk team, along with the information security team, will do redundancy test planning and prepare test records after conducting various tests. The risk tracker will be updated if there are new identified risks.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has identified relevant redundancy controls and tested them to prepare for any adverse situations.

A.18.1.1 Identification of Applicable Legislation and Contractual Requirements (ISO 27001 Control)

All relevant legislative statutory, regulatory, and contractual requirements and the organization’s approach to meet these requirements should be explicitly identified, documented, and kept up to date for each information system.

Explanation/what is required: Based on their business scope, an organization must identify and document all the applicable laws and contractual requirements that they need to comply to. Laws must be not only applicable to the country in which your organization is located, but also to the countries where your products and services will be sold, as well as from client and supplier perspective too. Whenever any changes happen in any laws or contractual obligations, organizations must identify and revise the relevant documents.

Evidence that can be prepared: Document covering all applicable laws, agreement/contracts covering obligations, and the risk tracker (for new risks identified due to law or contractual obligations)

Who prepares it: Legal/law, the human resources team, and the information security team will identify and document all applicable laws and agreements/contracts covering obligations. The risk tracker will be updated if there are new identified risks.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has identified relevant laws and contractual obligations to avoid from legal breaches.

A.18.1.2 Intellectual Property Rights (ISO 27001 Control)

Appropriate procedures should be implemented to ensure compliance with legislative, regulatory, and contractual requirements related to intellectual property rights and use of proprietary software products.

Explanation/what is required: An organization must protect information/software/tools/source code or any other material that could be considered intellectual property. Intellectual property protection is important because it is something created by your organization. If it is copied or stolen then it would be considered a breach of intellectual property rights.

It is something created by your client or supplier, but your organization is accessing/using it, so your organization must comply with all the laws and contractual obligations. Hence, your organization can create a documented procedure that can be followed to ensure compliance is always achieved. All the impacted teams/managers/stakeholders must be aware of all the legal and contractual obligations related to their departments, as failing to comply may result in legal penalties and impact the organization’s image.

Evidence that can be prepared: Document policies and procedures for managing intellectual property, agreement/contracts, the risk tracker (for new risks identified due to legal or contractual obligations)

Who prepares it: Legal/law, the human resources team, and the information security team will identify and document evidence.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has identified and implemented security controls to protect intellectual property rights.

A.18.1.3 Protection of Records (ISO 27001 Control)

Records should be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with legislative, regulatory, contractual, and business requirements.

Explanation/what is required: An organization must avoid breach of intellectual property rights. To do this, the organization must identify and implement all the required security controls.

Evidence that can be prepared: Data retention policy and procedure, tools/files where data is stored, list of people with access, and review of access permissions

Who prepares it: Department heads/managers along with the information security team will identify and document evidence.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has identified and implemented security controls for the protection of records.

A.18.1.4 Privacy and Protection of Personally Identifiable Information (ISO 27001 Control)

Privacy and protection of personally identifiable information should be ensured as required in relevant legislations and regulations where applicable.

Explanation/what is required: An organization must create the provisions to safeguard the personally identifiable information of employees/contractors/clients/users/suppliers, etc. The organization must be aware of personally identifiable information i.e. personal identification number, credit card details, health information, etc. It is very important that organizations get consent from all employees/contractors/clients/users/suppliers before storing their personal information for official purposes. The organization can define a procedure to explain how this information will be stored and protected from unauthorized access. All stakeholders must understand their roles and responsibilities and the importance of safeguarding such information.

Evidence that can be prepared: Protection of personally identifiable information policy and procedures, consent evidence i.e. via paper forms signed or online application acceptances, list of people with access to the information, review of access permissions, users request records to delete their personal information, and information disposal evidence

Who prepares it: Department heads/managers along with the information security team will identify and document evidence.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization identified and implemented security controls for the privacy and protection of personal identifiable information.

A.18.1.5 Regulation of Cryptography Controls (ISO 27001 Control)

Cryptographic controls should be used in compliance with all relevant agreements, legislation, and regulations.

Explanation/what is required: An organization must use the cryptographic controls in compliance with all relevant agreements, legislation, and regulations, as there could be restrictions on the way it needs to be implemented. Failure to comply may result in fines or could impact the company image. Hence, organizations are advised to discuss with their legal team to analyze the specific legal requirements in countries where they are operate.

Evidence that can be prepared: Cryptography usage policy and evidence of cryptography usage

Who prepares it: Department heads/managers along with the information security team will identify and document evidence.

For external audit: The external auditor conducting the ISO 27001 certification audit will check the evidence in order to verify how the organization has identified and implemented cryptographic controls.

A.18.2.1 independent Review of Information Security (ISO 27001 Control)

The organization’s approach to managing and implementing information security (i.e., control objectives, controls, policies, processes, and procedures for information security) should be reviewed independently at planned intervals or when significant changes occur.

Explanation/what is required: The requirement is that an organization must plan independent reviews at regular intervals, which are driven by management. This is to ensure that implemented information security management system—the policies, procedures, and security controls—are compliant and suitable for use. Wherever there are improvements identified and changes needed, they must be promptly implemented.

If these reviews are conducted by internal teams, the reviewer/auditor must be from a of different area or department so that there is no bias while conducting the review. The review could also be conducted by an external agency. The identified reviewer must be skilled and experienced. Results of these reviews must be presented to management for their awareness and to seek any feedback. When non-compliance is identified, proper corrective actions must be identified to fix it.

Who prepares it: The information security team is responsible for reviewing security along with the relevant stakeholders.

For external audit: The external auditor conducting the ISO 27001 audit may check for all the stated evidence.