ISO 27001:2022

Identify the internal and external issues that affect the organisation's ability to achieve the intended outcomes of its information security management system, and keep that understanding current.

Determine which parties are relevant to the ISMS, what their information security requirements are, and which of those requirements will be addressed through the management system.

Define and document the boundaries and applicability of the ISMS, taking account of the context, interested parties, interfaces, and dependencies with other organisations.

Establish, implement, maintain, and continually improve the ISMS, including the processes needed and their interactions, in line with this standard.

Top management must demonstrate active leadership for the ISMS: setting direction, ensuring resources, integrating security into business processes, and holding people accountable for results.

Top management must establish an information security policy that fits the organisation's purpose, sets objectives or a framework for them, commits to meeting requirements and to continual improvement, and is communicated and available.

Assign and communicate responsibility and authority for the ISMS, including who ensures it conforms to the standard and who reports on its performance to top management.

When planning the ISMS, consider the context and interested-party requirements to determine the risks and opportunities that must be addressed to assure intended outcomes, prevent undesired effects, and drive improvement.

Define and apply a repeatable risk assessment process with clear criteria, that identifies information security risks, their owners, and analyses and evaluates them to produce consistent, comparable results.

Define a risk treatment process that selects appropriate options and controls, compares them against Annex A, produces a Statement of Applicability, formulates a treatment plan, and obtains risk owner approval and acceptance of residual risk.

Set measurable information security objectives consistent with the policy, plan how to achieve them (what, resources, responsibility, timing, evaluation), and keep documented information about them.

When the organisation determines a need to change the ISMS, carry out those changes in a planned manner rather than ad hoc.

Determine and provide the resources needed to establish, implement, maintain, and continually improve the ISMS.

Determine the competence needed for people whose work affects information security performance, ensure they are competent through education, training, or experience, and retain evidence of it.

Ensure people doing work under the organisation's control are aware of the security policy, their contribution to the ISMS, and the implications of not conforming.

Determine the internal and external communications relevant to the ISMS: what to communicate, when, with whom, and how.

The ISMS must include the documented information required by the standard plus whatever the organisation deems necessary for its effectiveness.

When creating or updating documented information, ensure appropriate identification, format, and review and approval for suitability and adequacy.

Control documented information so it is available and suitable where needed and adequately protected, covering distribution, access, storage, version control, retention, and disposal, including documents of external origin.

Plan, implement, and control the processes needed to meet requirements and treat risks, keep documented information to give confidence processes ran as planned, and control planned and unintended changes.

Perform information security risk assessments at planned intervals and when significant changes occur, using the defined criteria, and retain the results as documented information.

Implement the risk treatment plan and retain documented information on the results of the treatment.

Determine what needs monitoring and measuring, by which methods, and when, so the ISMS's security performance and effectiveness can be evaluated, and retain the evidence.

Conduct internal audits at planned intervals to confirm the ISMS conforms to the organisation's own requirements and the standard, and that it is effectively implemented and maintained.

Plan, establish, and maintain an audit programme, defining criteria and scope, selecting objective auditors, and reporting results to relevant management, with documented evidence retained.

Top management must review the ISMS at planned intervals to ensure it remains suitable, adequate, and effective.

The management review must consider inputs such as prior action status, changes in context, interested-party needs, performance and audit results, feedback, risk assessment outcomes, and improvement opportunities.

The results of the management review must include decisions on continual improvement and any changes needed to the ISMS, and be retained as documented information.

Continually improve the suitability, adequacy, and effectiveness of the ISMS.

React to nonconformities, correct them, evaluate whether corrective action is needed to prevent recurrence, implement and review that action, and retain evidence of the nonconformity and the response.

Establish and maintain a documented information security policy, supported by topic-specific policies, that defines management direction and the organisation's approach to information security. Review periodically and after significant changes.

Clearly define and assign who is responsible for which aspects of information security. Everyone with a stake should know what is expected of them and who to escalate to.

Split conflicting tasks across different people so no single person can both perform and conceal a fraud, error, or unauthorised action. Where organisation size makes this impractical, compensate with monitoring or review.

Management must actively require personnel and contractors to apply information security in line with policies and procedures, and must visibly support the security program.

Maintain documented contacts with relevant authorities (law enforcement, regulators, national CERTs) so the organisation can engage them quickly when an incident or legal matter requires it.

Maintain contact with security communities, industry groups, and professional bodies to stay current on threats, defences, and best practices.

Collect and analyse information about current and emerging information security threats relevant to the organisation, and use what you learn to inform defences.

Build information security considerations into how projects are planned and run, so security requirements are addressed before delivery rather than retrofitted after.

Maintain an inventory of information and information-processing assets, with each item having an identified owner accountable for it.

Document and communicate rules for the acceptable use and handling of information and assets so users know what is and is not allowed.

Ensure personnel and external party users return all organisational assets in their possession on termination of employment, contract, or agreement.

Classify information by sensitivity and criticality so handling rules can apply consistently. The classification scheme should reflect legal, regulatory, and business needs.

Apply labels to information (digital or physical) so its classification is visible and the right handling rules are applied automatically.

Establish rules and controls for transferring information inside the organisation and to external parties, covering electronic, physical, and verbal transfer.

Define and enforce rules that govern who gets access to which information and other assets, based on business and security requirements.

Manage the full lifecycle of identities used by people and systems — creation, modification, removal — so each identity is tied to a real, accountable owner.

Manage authentication information (passwords, keys, tokens) securely throughout its lifecycle: allocation, storage, distribution, rotation, and revocation.

Provision, review, modify, and revoke access rights in line with the organisation's access control policy. Reviews should happen periodically and on role change.

Identify and document the information security risks associated with supplier relationships, and put processes in place to manage them.

Capture the organisation's information security expectations in contracts with suppliers, scaled to the type of access and relationship involved.

Define and manage information security requirements specifically for the ICT supply chain (hardware, software, services) to address risks like tampered components and compromised vendors.

Regularly monitor, review, and audit supplier security practices and service delivery; manage changes to supplier services so security posture is not degraded over time.

Establish processes for acquiring, using, managing, and exiting cloud services in line with the organisation's information security requirements.

Plan and prepare for managing information security incidents — define roles, processes, communication paths, and decision-making authority before an incident occurs.

Assess reported information security events and decide whether each one should be classified as an incident, with documented criteria for that decision.

Respond to information security incidents according to documented procedures, with appropriate escalation, containment, communication, and recovery steps.

After incidents, capture lessons learned and feed them back into policies, procedures, and controls to reduce the likelihood and impact of recurrence.

Establish procedures for identifying, collecting, acquiring, and preserving evidence related to information security events in a way that is defensible in disciplinary or legal proceedings.

Plan how information security is maintained during disruption (outages, crises, recovery) so security does not lapse when the organisation is under stress.

Plan, implement, maintain, and test the ICT readiness needed to meet business continuity objectives and recovery time/point requirements.

Identify, document, and keep up to date the legal, statutory, regulatory, and contractual requirements relevant to information security, along with the organisation's approach to meeting them.

Implement procedures to ensure compliance with intellectual property rights — licensing, attribution, restrictions on use — for software and other protected material.

Protect records from loss, destruction, falsification, unauthorised access, and unauthorised release, in line with legal, regulatory, contractual, and business requirements.

Identify and meet privacy and personally identifiable information (PII) protection requirements applicable to the organisation, including those imposed by law and regulation.

Independently review the organisation's approach to managing information security and its implementation at planned intervals or after significant changes.

Verify that information security is being implemented and operated in accordance with the organisation's policies, rules, and applicable standards.

Document operating procedures for information processing activities and make them available to those who need them, so consistent execution is possible across the team.

Perform background verification checks on candidates for employment proportional to the role's access to information and risk, in line with applicable law.

Employment contracts should state the employee's and the organisation's responsibilities for information security, so expectations are unambiguous from day one.

Provide ongoing awareness, education, and training for all personnel (and relevant external parties) on the organisation's information security policies and their role in upholding them.

Establish a formal disciplinary process for personnel who have committed an information security breach, and communicate it so it acts as a deterrent.

Define and enforce information security responsibilities that remain in effect after termination or change of role, and make sure they are communicated at the relevant moments.

Use confidentiality or non-disclosure agreements that reflect the organisation's information protection needs, with personnel and relevant external parties, and review them periodically.

Implement security measures specific to remote working to protect information accessed, processed, or stored outside the organisation's premises.

Provide a clear mechanism for personnel to report observed or suspected information security events promptly, without friction or fear of blame.

Define and use physical security perimeters to protect areas containing information and information processing facilities.

Protect secure areas with appropriate entry controls so only authorised people can enter, with records of who went where and when.

Design and apply physical security measures to offices, rooms, and facilities containing information and information processing assets.

Continuously monitor physical premises for unauthorised access using appropriate detection mechanisms — alarms, surveillance, intrusion detection.

Design and implement protection against physical and environmental threats — fire, flood, earthquake, civil unrest — proportional to the risk and the value of the assets at stake.

Define and apply security measures for working in secure areas, including supervision of personnel and control of equipment brought in or taken out.

Apply clear-desk and clear-screen rules to reduce the risk of unauthorised access to information left visible on desks or on unattended screens.

Site equipment so it is protected from environmental threats, opportunities for unauthorised observation, and physical interference.

Protect assets that are taken off-premises (laptops, devices, documents) with measures appropriate to the risks they face outside the secure perimeter.

Manage storage media (USB drives, tapes, disks, removable media) throughout their lifecycle — acquisition, use, transport, disposal — with classification-appropriate protection.

Protect information processing facilities from disruption caused by failures in supporting utilities — power, cooling, water, telecommunications.

Protect power, data, and telecommunications cabling against interception, interference, or physical damage.

Maintain equipment correctly to ensure continued availability and integrity of information, and protect information when equipment is being serviced (especially by external technicians).

Verify that sensitive data and licensed software has been removed or securely overwritten before equipment is disposed of, sold, or re-used.

Protect information stored on, processed by, or accessible from user endpoint devices (laptops, mobile devices, workstations) through configuration, policy, and centralised management.

Restrict, review, and monitor the allocation and use of privileged access rights — those that grant broader permissions than ordinary users — so they are used only when necessary.

Restrict access to information and other assets in line with the access control policy, so people can only reach what they need for their role.

Restrict access to program source code, software libraries, and related artefacts to authorised personnel, and manage changes through documented processes.

Implement secure authentication technologies and procedures appropriate to the sensitivity of what is being protected, including multi-factor authentication where warranted.

Monitor and adjust resource usage so the required system performance, capacity, and availability are sustained as demand evolves.

Implement layered protection against malware — detection, prevention, recovery, and user awareness — to keep systems and information safe from malicious code.

Identify, assess, and remediate technical vulnerabilities in systems and software in a timely way, with priority based on risk.

Establish and maintain secure configurations for hardware, software, services, and networks, and manage changes to those configurations under formal control.

Delete information stored in systems, devices, and other media when it is no longer required, using methods appropriate to its classification.

Where appropriate, apply data masking techniques (anonymisation, pseudonymisation, tokenisation) to limit exposure of sensitive data — especially in non-production environments.

Apply measures to detect and prevent the unauthorised disclosure or exfiltration of sensitive information from systems, networks, and endpoints.

Maintain backups of information, software, and system images, and test restoration regularly to ensure recoverability after loss or corruption.

Implement redundancy in information processing facilities sufficient to meet availability requirements set by the business.

Produce, store, and protect logs of events, exceptions, faults, and security-relevant activity, and make sure they are useful for investigation later.

Continuously monitor networks, systems, and applications for anomalous behaviour and potential security events, and act on what is detected.

Synchronise the clocks of all information processing systems to a reliable time source so logs and events can be correlated accurately across systems.

Restrict and tightly control the use of utility programs that could override system or application controls, since they are a frequent vector for abuse.

Implement procedures to control the installation of software on operational systems, including approval workflows and limits on who can install what.

Manage and control networks to protect the information in systems and applications connected to them.

Define and document the security mechanisms, service levels, and management requirements of all network services, whether provided internally or externally.

Segregate networks into separate groups (by service, user community, sensitivity) and control traffic between them with rules appropriate to each segment.

Manage access to external websites to reduce exposure to malicious content and unwanted services.

Define and implement rules for the effective use of cryptography, including cryptographic key management, for protecting information confidentiality, integrity, and authenticity.

Establish and apply rules for secure software and systems development across the entire development lifecycle, not just at security review gates.

Identify, specify, and approve information security requirements for new or modified applications before development or acquisition begins.

Establish, document, and apply secure architecture and engineering principles to the design and implementation of information systems.

Apply secure coding principles and standards during software development to reduce the introduction of vulnerabilities.

Include security testing in development and acceptance processes so vulnerabilities are caught before software reaches production.

When outsourcing software development, define and enforce the security requirements that apply to the development activity and its outputs, and verify they are met.

Keep development, test, and production environments separated to reduce the risk of unauthorised access or unintended changes affecting production.

Subject changes to information processing facilities and systems to formal change management processes that control the risk of unintended consequences.

Select and protect test data carefully; avoid using real personal data in non-production environments unless adequately masked or otherwise protected.

Plan and agree audit tests of operational systems with management to minimise disruption to business processes during the test.