audit-labs/control-coverage

  1# ISO/IEC 27001:2022 — Annex A (all 93 controls, four themes).
  2#
  3# This is exactly the list a Statement of Applicability enumerates. A control's
  4# full code is "ISO:<id>", matching the codes audit-report rulesets cite.
  5#
  6# COPYRIGHT: ISO/IEC 27001:2022 is copyright ISO/IEC. Only the Annex A control
  7# identifiers (e.g. A.5.17) and their short titles are reproduced here as labels;
  8# the normative control text and implementation guidance are not. For the
  9# authoritative wording, obtain the standard from ISO. These control-to-signal
 10# mappings are the maintainers' interpretation and are not reviewed or endorsed
 11# by ISO/IEC. See ../../MAPPING.md.
 12framework: ISO
 13name: ISO/IEC 27001:2022 Annex A
 14version: "2022"
 15coverage: complete
 16source: ISO/IEC 27001:2022 Annex A (identifiers and short titles only)
 17controls:
 18  # A.5 — Organizational controls
 19  - {id: A.5.1, family: Organizational, title: "Policies for information security."}
 20  - {id: A.5.2, family: Organizational, title: "Information security roles and responsibilities."}
 21  - {id: A.5.3, family: Organizational, title: "Segregation of duties."}
 22  - {id: A.5.4, family: Organizational, title: "Management responsibilities."}
 23  - {id: A.5.5, family: Organizational, title: "Contact with authorities."}
 24  - {id: A.5.6, family: Organizational, title: "Contact with special interest groups."}
 25  - {id: A.5.7, family: Organizational, title: "Threat intelligence."}
 26  - {id: A.5.8, family: Organizational, title: "Information security in project management."}
 27  - {id: A.5.9, family: Organizational, title: "Inventory of information and other associated assets."}
 28  - {id: A.5.10, family: Organizational, title: "Acceptable use of information and other associated assets."}
 29  - {id: A.5.11, family: Organizational, title: "Return of assets."}
 30  - {id: A.5.12, family: Organizational, title: "Classification of information."}
 31  - {id: A.5.13, family: Organizational, title: "Labelling of information."}
 32  - {id: A.5.14, family: Organizational, title: "Information transfer."}
 33  - {id: A.5.15, family: Organizational, title: "Access control."}
 34  - {id: A.5.16, family: Organizational, title: "Identity management."}
 35  - {id: A.5.17, family: Organizational, title: "Authentication information."}
 36  - {id: A.5.18, family: Organizational, title: "Access rights."}
 37  - {id: A.5.19, family: Organizational, title: "Information security in supplier relationships."}
 38  - {id: A.5.20, family: Organizational, title: "Addressing information security within supplier agreements."}
 39  - {id: A.5.21, family: Organizational, title: "Managing information security in the ICT supply chain."}
 40  - {id: A.5.22, family: Organizational, title: "Monitoring, review and change management of supplier services."}
 41  - {id: A.5.23, family: Organizational, title: "Information security for use of cloud services."}
 42  - {id: A.5.24, family: Organizational, title: "Information security incident management planning and preparation."}
 43  - {id: A.5.25, family: Organizational, title: "Assessment and decision on information security events."}
 44  - {id: A.5.26, family: Organizational, title: "Response to information security incidents."}
 45  - {id: A.5.27, family: Organizational, title: "Learning from information security incidents."}
 46  - {id: A.5.28, family: Organizational, title: "Collection of evidence."}
 47  - {id: A.5.29, family: Organizational, title: "Information security during disruption."}
 48  - {id: A.5.30, family: Organizational, title: "ICT readiness for business continuity."}
 49  - {id: A.5.31, family: Organizational, title: "Legal, statutory, regulatory and contractual requirements."}
 50  - {id: A.5.32, family: Organizational, title: "Intellectual property rights."}
 51  - {id: A.5.33, family: Organizational, title: "Protection of records."}
 52  - {id: A.5.34, family: Organizational, title: "Privacy and protection of personally identifiable information (PII)."}
 53  - {id: A.5.35, family: Organizational, title: "Independent review of information security."}
 54  - {id: A.5.36, family: Organizational, title: "Compliance with policies, rules and standards for information security."}
 55  - {id: A.5.37, family: Organizational, title: "Documented operating procedures."}
 56  # A.6 — People controls
 57  - {id: A.6.1, family: People, title: "Screening."}
 58  - {id: A.6.2, family: People, title: "Terms and conditions of employment."}
 59  - {id: A.6.3, family: People, title: "Information security awareness, education and training."}
 60  - {id: A.6.4, family: People, title: "Disciplinary process."}
 61  - {id: A.6.5, family: People, title: "Responsibilities after termination or change of employment."}
 62  - {id: A.6.6, family: People, title: "Confidentiality or non-disclosure agreements."}
 63  - {id: A.6.7, family: People, title: "Remote working."}
 64  - {id: A.6.8, family: People, title: "Information security event reporting."}
 65  # A.7 — Physical controls
 66  - {id: A.7.1, family: Physical, title: "Physical security perimeters."}
 67  - {id: A.7.2, family: Physical, title: "Physical entry."}
 68  - {id: A.7.3, family: Physical, title: "Securing offices, rooms and facilities."}
 69  - {id: A.7.4, family: Physical, title: "Physical security monitoring."}
 70  - {id: A.7.5, family: Physical, title: "Protecting against physical and environmental threats."}
 71  - {id: A.7.6, family: Physical, title: "Working in secure areas."}
 72  - {id: A.7.7, family: Physical, title: "Clear desk and clear screen."}
 73  - {id: A.7.8, family: Physical, title: "Equipment siting and protection."}
 74  - {id: A.7.9, family: Physical, title: "Security of assets off-premises."}
 75  - {id: A.7.10, family: Physical, title: "Storage media."}
 76  - {id: A.7.11, family: Physical, title: "Supporting utilities."}
 77  - {id: A.7.12, family: Physical, title: "Cabling security."}
 78  - {id: A.7.13, family: Physical, title: "Equipment maintenance."}
 79  - {id: A.7.14, family: Physical, title: "Secure disposal or re-use of equipment."}
 80  # A.8 — Technological controls
 81  - {id: A.8.1, family: Technological, title: "User endpoint devices."}
 82  - {id: A.8.2, family: Technological, title: "Privileged access rights."}
 83  - {id: A.8.3, family: Technological, title: "Information access restriction."}
 84  - {id: A.8.4, family: Technological, title: "Access to source code."}
 85  - {id: A.8.5, family: Technological, title: "Secure authentication."}
 86  - {id: A.8.6, family: Technological, title: "Capacity management."}
 87  - {id: A.8.7, family: Technological, title: "Protection against malware."}
 88  - {id: A.8.8, family: Technological, title: "Management of technical vulnerabilities."}
 89  - {id: A.8.9, family: Technological, title: "Configuration management."}
 90  - {id: A.8.10, family: Technological, title: "Information deletion."}
 91  - {id: A.8.11, family: Technological, title: "Data masking."}
 92  - {id: A.8.12, family: Technological, title: "Data leakage prevention."}
 93  - {id: A.8.13, family: Technological, title: "Information backup."}
 94  - {id: A.8.14, family: Technological, title: "Redundancy of information processing facilities."}
 95  - {id: A.8.15, family: Technological, title: "Logging."}
 96  - {id: A.8.16, family: Technological, title: "Monitoring activities."}
 97  - {id: A.8.17, family: Technological, title: "Clock synchronization."}
 98  - {id: A.8.18, family: Technological, title: "Use of privileged utility programs."}
 99  - {id: A.8.19, family: Technological, title: "Installation of software on operational systems."}
100  - {id: A.8.20, family: Technological, title: "Networks security."}
101  - {id: A.8.21, family: Technological, title: "Security of network services."}
102  - {id: A.8.22, family: Technological, title: "Segregation of networks."}
103  - {id: A.8.23, family: Technological, title: "Web filtering."}
104  - {id: A.8.24, family: Technological, title: "Use of cryptography."}
105  - {id: A.8.25, family: Technological, title: "Secure development life cycle."}
106  - {id: A.8.26, family: Technological, title: "Application security requirements."}
107  - {id: A.8.27, family: Technological, title: "Secure system architecture and engineering principles."}
108  - {id: A.8.28, family: Technological, title: "Secure coding."}
109  - {id: A.8.29, family: Technological, title: "Security testing in development and acceptance."}
110  - {id: A.8.30, family: Technological, title: "Outsourced development."}
111  - {id: A.8.31, family: Technological, title: "Separation of development, test and production environments."}
112  - {id: A.8.32, family: Technological, title: "Change management."}
113  - {id: A.8.33, family: Technological, title: "Test information."}
114  - {id: A.8.34, family: Technological, title: "Protection of information systems during audit testing."}