|
5 Organizational measures
5.1 Information Security Policy
5.2 Information Security Roles and Responsibilities
5.3 Segregation of duties
5.4 Management responsibilities
5.5 Contact with authorities
5.6 Contact with special interest groups
5.7 Threat Intelligence
5.8 Information Security in Project Management
5.9 Inventory of information and other associated assets
5.10 Acceptable Use of Information and Other Related Assets
5.11 Return of assets
5.12 Classification of Information
5.13 Labelling of information
5.14 Transfer of Information
5.15 Access security
5.16 Identity management
5.17 Authentication Information
5.18 Access rights
5.19 Information security in supplier relationships
5.20 Approach to information security within supplier agreements
5.21 Information security management in the ICT supply chain
5.22 Monitoring, Assessment, and Change Management of Vendor Services
5.23 Information security when using cloud services
5.24 Planning and Preparation of Information Security Incidents
5.25 Assessment and decision on information security events
5.26 Response to Information Security Incidents
5.27 Learning from Information Security Incidents
5.28 Collection of evidence
5.29 Information Security During Disruption
5.30 ICT readiness for business continuity
5.31 Identification of legal, statutory, regulatory and contractual requirements
5.32 Intellectual Property Rights
5.33 Data protection
5.34 Privacy and Protection of PII
5.35 Independent Information Security Assessment
5.36 Compliance with Information Security Policies and Standards
5.37 Documented Operating Procedures
6. Measures with regard to people
6.1 Screening
6.2 Working conditions
6.3 Information Security Awareness, Education and Training
6.4 Disciplinary process
6.5 Responsibilities after termination or change of employment
6.6 Non-disclosure or non-disclosure agreements
6.7 Remote Work
6.8 Reporting of Information Security Events
7. Physical measures
7.1 Physical Protection Zone
7.2 Physical Access Controls
7.3 Securing offices, rooms and facilities
7.4 Physical Security Monitoring
7.5 Protection against Physical and Environmental Threats
7.6 Working in secure areas
7.7 Clear desk, clear screen
7.8 Equipment Placement and Protection
7.9 Securing assets outside the premises
7.10 Storage Media
7.11 Supporting Systems
7.12 Cabling Protection
7.13 Equipment Maintenance
7.14 Safe disposal or reuse of equipment
8. Technical measures
8.1 End-user equipment
8.2 Special access rights
8.3 Restriction of Access to Information
8.4 Access to source code
8.5 Secure Authentication
8.6 Capacity Management
8.7 Malware Protection
8.8 Technical Vulnerability Management
8.9 Configuration Management
8.10 Deleting Information
8.11 Data Masking
8.12 Data Breach Prevention
8.13 Backup Information
8.14 Redundancy of Information Processing Facilities
8.15 Logging
8.16 Monitoring of activities
8.17 Clock Synchronization
8.18 Use of Privileged Utilities
8.19 Installation of Software on Operational Systems
8.20 Network Operation
8.21 Security of Network Services
8.22 Segregation in networks
8.23 Web Filtering
8.24 Use of cryptography
8.25 Safe Development Lifecycle
8.26 Application Security Requirements
8.27 Secure System Architecture and Engineering Principles
8.28 Secure Programming
8.29 Security Testing in Development and Adoption
8.30 Outsourced development
8.31 Separation of Development, Test, and Production Environments
8.32 Change Management
8.33 Test Information
8.34 Protection of information systems during audit and testing
|