ISO 27002 controls

Here we list all the ISO 27002 controls required by the standard (sections 5-18 and subheadings) each linked into a description and our take on how they should be interpreted:

Bear with us as we add this content, we do intend it to be as comprehensive as our ISO 9001 breakdown.

Section 5 Information Security Policies

Section 6 Organisation of Information Security

Section 7 Human Resource Security

Section 8 Asset Management

Section 9 Access Control

Section 10 Cryptography

Section 11 Physical and Environmental Security

Section 12 Operations Security

Section 13 Communications Security

Section 14 System Acquisition, development and maintenance

Section 15 Supplier Relationships

Section 16 Information Security Incident Management

Section 17 Business Continuity Management

Section 18 : Compliance

Incidentally other standards do exits which largely cover the same activities mentioned above, such as CIS / SANS 20 whose 20 guidelines are here borrowed from Wikipedia:

CSC 1: Inventory of Authorized and Unauthorized Devices
CSC 2: Inventory of Authorized and Unauthorized Software
CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
CSC 4: Continuous Vulnerability Assessment and Remediation
CSC 5: Controlled Use of Administrative Privileges
CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs
CSC 7: Email and Web Browser Protections
CSC 8: Malware Defenses
CSC 9: Limitation and Control of Network Ports, Protocols, and Services
CSC 10: Data Recovery Capability
CSC 11: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
CSC 12: Boundary Defense
CSC 13: Data Protection
CSC 14: Controlled Access Based on the Need to Know
CSC 15: Wireless Access Control
CSC 16: Account Monitoring and Control
CSC 17: Security Skills Assessment and Appropriate Training to Fill Gaps
CSC 18: Application Software Security
CSC 19: Incident Response and Management
CSC 20: Penetration Tests and Red Team Exercises