ISO/IEC 27001:2022

Write, approve and publish a top-level security policy plus topic-specific policies, and review them on a set cadence and after major change.

Name who owns what in security and make the allocation explicit and traceable.

Collect and analyse threat information and turn it into decisions, not just unread feeds.

Maintain a current asset inventory with owners.

Define and enforce rules for how information and assets may be used and handled.

Recover all organizational assets on exit or role change.

Classify information by confidentiality, integrity, availability and interested-party requirements.

Label information consistently with the classification scheme so handling rules can follow it.

Put rules, procedures or agreements in place for every way information moves, inside and outside the organization.

Set rules for physical and logical access based on business and security requirements.

Manage the full life cycle of identities.

Control allocation and handling of passwords, keys and other authentication secrets, and advise users on good practice.

Provision, review, modify and remove access rights in line with the access control policy.

Define and apply processes to manage the security risk suppliers introduce.

Establish and agree the relevant security requirements in each supplier contract.

Extend security requirements down the ICT products and services supply chain.

Regularly monitor, review and manage change in supplier security practice and service delivery.

Govern acquisition, use, management and exit of cloud services against your security requirements.

Define incident roles, processes and readiness before an incident happens.

Triage security events and decide which become incidents.

Respond to incidents according to the documented procedures.

Feed lessons from incidents back into stronger controls.

Have procedures to identify, collect, acquire and preserve evidence related to security events.

Plan how to keep information security at the right level during disruption.

Plan, implement, maintain and test ICT readiness against business continuity objectives.

Identify, document and keep current the legal and contractual obligations relevant to security, and your approach to meeting them.

Protect records from loss, destruction, falsification, unauthorized access and unauthorized release.

Identify and meet privacy and PII-protection requirements from law, regulation and contract.

Have the security approach and its implementation reviewed independently on a cadence and after significant change.

Regularly check that people actually comply with the security policies, rules and standards.

Document operating procedures for information processing facilities and make them available to those who need them.

Background-check candidates and personnel proportional to risk and classification, within the law.

State the security responsibilities of both the person and the organization in the employment agreement.

Give personnel and relevant parties appropriate, current security training for their role.

Have a formal, communicated disciplinary process for security policy violations.

Define and enforce security responsibilities that remain valid after an exit or role change.

Identify, document, review and sign NDAs that reflect the organization's protection needs.

Apply security measures when people access, process or store information outside the organization's premises.

Give people an easy, timely channel to report observed or suspected security events.

Define and use security perimeters to protect areas holding information and assets.

Protect secure areas with appropriate entry controls and access points.

Continuously monitor premises for unauthorized physical access.

Design and apply protection against natural disasters and other physical and environmental threats.

Enforce clear-desk rules for papers and media and clear-screen rules for processing facilities.

Manage storage media across acquisition, use, transport and disposal per classification and handling rules.

Verify that sensitive data and licensed software are removed or securely overwritten before disposal or re-use.

Protect information stored on, processed by or reachable through user endpoints.

Restrict and manage the allocation and use of privileged access.

Restrict access to information and assets per the access control policy.

Implement authentication technologies and procedures based on access restrictions and policy.

Implement malware protection backed by user awareness.

Obtain vulnerability information, evaluate exposure, and take appropriate remediation.

Establish, document, implement, monitor and review secure configurations for hardware, software, services and networks.

Delete information in systems, devices and media when no longer required.

Use data masking in line with access policy, business need and applicable law.

Maintain and regularly test backups of information, software and systems per the backup policy.

Build enough redundancy into processing facilities to meet availability requirements.

Produce, store, protect and analyse logs of activities, exceptions and faults.

Monitor networks, systems and applications for anomalies and act on potential incidents.

Securely manage software installation on production systems.

Secure, manage and control networks and network devices.

Identify, implement and monitor security mechanisms and service levels for network services.

Segregate groups of services, users and systems in the network.

Manage access to external websites to reduce exposure to malicious content.

Define and implement rules for effective use of cryptography and key management.

Establish and apply rules for secure development of software and systems.

Identify, specify and approve security requirements when developing or acquiring applications.

Establish and apply secure engineering principles to system development.

Apply secure coding principles to software development.

Define and run security testing across the development life cycle.

Direct, monitor and review outsourced system development.

Put changes to facilities and systems through change management procedures.

Select, protect and manage test information appropriately.