ISO 27001

Cyber security in contracts

Formal adoption of security policies

Critical

High

Normal

Low

ISMS description and maintenance

Critical

High

Normal

Low

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

5.2: Information security roles and responsibilities

Defining information security roles and responsibilities based on organizational needs is essential to establish a clear structure for information security management. Responsibilities include protecting assets, executing information security processes and managing risks. Organizational approaches to information security management vary based on size and resources, ranging from dedicated roles to integrated duties within existing positions.

Related tasks

Defining security roles and responsibilities

Critical

High

Normal

Low

Amount, competence and adequacy of key cyber security personnel

Critical

High

Normal

Low

5.3: Segregation of duties

Segregation of duties is implemented to separate conflicting responsibilities among individuals, aiming to prevent one person from performing conflicting tasks alone and reducing the risk of fraud and error while maintaining information security.

Related tasks

Segregation of information security related duties

Critical

High

Normal

Low

5.4: Management responsibilities

Management's responsibility is to make sure all staff are aware and follow the information security rules outlined in the company policies and procedures. Management needs to comprehend their pivotal role in information security and take necessary actions to ensure that all employees are fully aware of their information security responsibilities. Employees should also understand their role of ensuring that their security responsibilities are met.

Related tasks

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

Cyber security training

Management commitment to cyber security management and management system

Critical

High

Normal

Low

General security competence and awareness of personnel

Critical

High

Normal

Low

Agreements and monitoring

5.5: Contact with authorities

The organization must establish and uphold communication channels with relevant authorities to ensure a proper exchange of information regarding information security between the organization and the corresponding legal, regulatory, and supervisory entities.

Related tasks

Reporting personal data breaches to authorities / data subjects

Critical

High

Normal

Low

Data breach management

Keeping contact with relevant authorities

Critical

High

Normal

Low

Agreements and monitoring

5.6: Contact with special interest groups

The organization should create and uphold connections with special interest groups or other specialized security forums and professional associations in order to facilitate the proper exchange of information concerning information security. These contacts can provide many benefits for example a good way to stay tuned on the best practices of the industry, offer early warnings of potential threats and grant access to the expertise of professionals that organization may not have in-house.

Related tasks

Contact with industry-specific interest groups

Critical

High

Normal

Low

5.7: Threat intelligence

To mitigate the risk of unauthorized physical access, damage, and interference to an organization's information and associated assets within offices, rooms, and facilities, it is crucial to design and implement robust physical security measures. This can be done e.g. designing buildings to be discreet, with minimal indicators of their purpose to outsiders and restricting access to directories, internal telephone books, and online maps that identify locations of confidential information processing facilities.

Related tasks

The goals of threat intelligence and the collection of information related to information security threats

Critical

High

Normal

Low

Regular analysis and utilization of information related to information security threats

Critical

High

Normal

Low

Consideration of threat intelligence findings in the information security risk management process

Critical

High

Normal

Low

Sharing threat intelligence

Critical

High

Normal

Low

5.8: Information security in project management

Integration of information security within project management is vital to effectively handle information security risks associated with projects and deliverables throughout the entire project life cycle.

Information security requirements should be determined using various methods and can be derived from activities such as threat modeling, incident reviews, vulnerability thresholds, or contingency planning. Information security requirements are applicable to all types of projects, not just ICT development projects.

Related tasks

Process for including information security aspects in project management

Critical

High

Normal

Low

Risk management

Processing principles and accountability

5.9: Inventory of information and other associated assets

Organizations should create and sustain a comprehensive record of information and related resources, along with their respective owners. Organization needs to recognize information and associated assets to safeguard their security and properly allocate ownership.

Ownership should be set for newly created or transferred assets and reassigned as needed during role changes. Asset owners are responsible for proper management, including inventory, classification, protection, and periodic review.

Related tasks

Data store listing and owner assignment

Critical

High

Normal

Low

Data system listing and owner assignment

Critical

High

Normal

Low

Data system management

Documentation of personal data outside data systems

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Documentation of assets inventories outside the ISMS

Critical

High

Normal

Low

Equipment maintenance and safety

Documentation of other protected assets

Critical

High

Normal

Low

Listing offered digital services and naming owners

Critical

High

Normal

Low

Cloud service management

Non-electronic data and copies

5.10: Acceptable use of information and other associated assets

Guidelines outlining the proper utilization and protocols for managing information and related assets must be recognized, recorded, and put into practice. This is done to guarantee the adequate protection, utilization, and responsible management of information and its associated assets.

Related tasks

Personnel guidelines for safe disposal of paper data

Critical

High

Normal

Low

Personnel guidelines for file usage and local data

Critical

High

Normal

Low

Incident management and response

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

Cyber security training

Personnel guidelines for safe data system and authentication info usage

Critical

High

Normal

Low

Data system management

Personnel guidelines for reporting security incidents

Critical

High

Normal

Low

Personnel guidelines for safe processing of personal and confidential data

Critical

High

Normal

Low

Processing principles and accountability

Personnel guidelines for safe usage of mobile devices

Critical

High

Normal

Low

Mobile device management

5.11: Return of assets

Upon change or termination of their employment, contract, or agreement, personnel and relevant parties must return all organization-owned assets in their possession to safeguard the organization's property during the transition process.

Related tasks

Process for removing hardware and access rights at termination of employment relationship

Critical

High

Normal

Low

Special supervision of dismissed workers

Critical

High

Normal

Low

5.12: Classification of information

The information should be classified based on the organization's information security requirements, considering factors such as confidentiality, integrity, availability, and relevant stakeholder needs. The goal is to identify and understand the protection needs of information based on its relevance to the organization. Classifying information streamlines its management and protection, minimizing the necessity for individual risk assessments.

Related tasks

Documentation of data classes for data sets

Critical

High

Normal

Low

Definition of data classifications and class-specific security procedures

Critical

High

Normal

Low

5.13: Labelling of information

Organizations should develop and implement procedures for information labeling in alignment with the organization's classification scheme to improve communication and enable automation of information processing and management. Personnel and relevant parties should be informed about labeling procedures. Comprehensive training should be available to ensure accurate labeling and proper handling of information by all personnel.

Related tasks

Marking of equipment that needs safe disposal

Critical

High

Normal

Low

Definitions and instructions on information classifications

Critical

High

Normal

Low

Cyber security in contracts

5.14: Information transfer

The organization should have rules and procedures in place for the transfer of information within an organization and between the organization and external parties. This is crucial for ensuring the security of the transferred information. Rules and procedures should cover all kinds of methods of transfer, e.g. electronic, physical storage media and verbal transfer.

Related tasks

Maintaining confidentiality agreements

Critical

High

Normal

Low

Using a selected web browser and checking for updates

Critical

High

Normal

Low

Enabling and configuring mailbox audit logs

Critical

High

Normal

Low

Mailbox audit log monitoring

Critical

High

Normal

Low

Email authentication: SPF

Critical

High

Normal

Low

Email authentication: DKIM

Critical

High

Normal

Low

Email authentication: DMARC

Critical

High

Normal

Low

Use of anti-phishing policies

Critical

High

Normal

Low

Data transfer and disclosure

Inventory and documentation of data processing agreements

Critical

High

Normal

Low

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Agreements and monitoring

5.15: Access control

Organization should create rules for who can access information and related assets, both physically and electronically. The goal is to allow authorized access while preventing unauthorized access. Information and asset owners should establish security and business requirements for sufficient access control. This should be reflected in a specific access control policy and communicated to relevant stakeholders.

Related tasks

Need to know -principle in access management

Critical

High

Normal

Low

Defining and documenting access roles

Critical

High

Normal

Low

Implementing formal access control processes

Critical

High

Normal

Low

5.16: Identity management

The organization should actively manage the complete life cycle of identities to uniquely identify individuals and systems accessing organizations information and assets. For example individual identities should be uniquely linked to a single person to ensure accountability for their actions. Shared identities, assigned to multiple individuals, are only allowed when necessary for business or operational reasons, subject to specific approval and documentation.

Related tasks

Avoiding and documenting shared user accounts

Critical

High

Normal

Low

Process for removing hardware and access rights at termination of employment relationship

Critical

High

Normal

Low

Process for granting access rights at the start of employment relationships

Critical

High

Normal

Low