ISO/IEC 27001:2022 — controls and assessment | Manzill Compliance

Compliance assessment

123 controls in 11 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Context of the organization4

4.1Understanding the organization and its contextNot assessed 4.2Understanding the needs and expectations of interested partiesNot assessed 4.3Determining the scope of the information security management systemNot assessed 4.4Information security management systemNot assessed

Leadership3

5.1Leadership and commitmentNot assessed 5.2PolicyNot assessed 5.3Organizational roles, responsibilities and authoritiesNot assessed

Planning5

6.1.1General - Actions to address risks and opportunitiesNot assessed 6.1.2Information security risk assessment - Actions to address risks and opportunitiesNot assessed 6.1.3Information security risk treatment - Actions to address risks and opportunitiesNot assessed 6.2Information security objectives and planning to achieve themNot assessed 6.3Planning of changesNot assessed

Support7

7.1ResourcesNot assessed 7.2CompetenceNot assessed 7.3AwarenessNot assessed 7.4CommunicationNot assessed 7.5.1General - Documented informationNot assessed 7.5.2Creating and updating - Documented informationNot assessed 7.5.3Control of documented information - Documented informationNot assessed

Operation3

8.1Operational planning and controlNot assessed 8.2Information security risk assessmentNot assessed 8.3Information security risk treatmentNot assessed

Performance evaluation6

9.1Monitoring, measurement, analysis and evaluationNot assessed 9.2.1General - Internal auditNot assessed 9.2.2Internal audit programmeNot assessed 9.3.1General - Management reviewNot assessed 9.3.2Management review inputsNot assessed 9.3.3Management review resultsNot assessed

Improvement2

10.1Continual improvementNot assessed 10.2Nonconformity and corrective actionNot assessed

Organizational controls37

A.5.1Policies for information securityNot assessed A.5.2Information security roles and responsibilitiesNot assessed A.5.3Segregation of dutiesNot assessed A.5.4Management responsibilitiesNot assessed A.5.5Contact with authoritiesNot assessed A.5.6Contact with special interest groupsNot assessed A.5.7Threat intelligenceNot assessed A.5.8Information security in project managementNot assessed A.5.9Inventory of information and other associated assetsNot assessed A.5.10Acceptable use of information and other associated assetsNot assessed A.5.11Return of assetsNot assessed A.5.12Classification of informationNot assessed A.5.13Labelling of informationNot assessed A.5.14Information transferNot assessed A.5.15Access controlNot assessed A.5.16Identity managementNot assessed A.5.17Authentication informationNot assessed A.5.18Access rightsNot assessed A.5.19Information security in supplier relationshipsNot assessed A.5.20Addressing information security within supplier agreementsNot assessed A.5.21Managing information security in the information and communication technology (ICT) supply chainNot assessed A.5.22Monitoring, review and change management of supplier servicesNot assessed A.5.23Information security for use of cloud servicesNot assessed A.5.24Information security incident management planning and preparationNot assessed A.5.25Assessment and decision on information security eventsNot assessed A.5.26Response to information security incidentsNot assessed A.5.27Learning from information security incidentsNot assessed A.5.28Collection of evidenceNot assessed A.5.29Information security during disruptionNot assessed A.5.30ICT readiness for business continuityNot assessed A.5.31Legal, statutory, regulatory and contractual requirementsNot assessed A.5.32Intellectual property rightsNot assessed A.5.33Protection of recordsNot assessed A.5.34Privacy and protection of personal identifiable information (PII)Not assessed A.5.35Independent review of information securityNot assessed A.5.36Compliance with policies, rules and standards for information securityNot assessed A.5.37Documented operating proceduresNot assessed

People controls8

A.6.1ScreeningNot assessed A.6.2Terms and conditions of employmentNot assessed A.6.3Information security awareness, education and trainingNot assessed A.6.4Disciplinary processNot assessed A.6.5Responsibilities after termination or change of employmentNot assessed A.6.6Confidentiality or non-disclosure agreementsNot assessed A.6.7Remote workingNot assessed A.6.8Information security event reportingNot assessed

Physical controls14

A.7.1Physical security perimetersNot assessed A.7.2Physical entryNot assessed A.7.3Securing offices, rooms and facilitiesNot assessed A.7.4Physical security monitoringNot assessed A.7.5Protecting against physical and environmental threatsNot assessed A.7.6Working in secure areasNot assessed A.7.7Clear desk and clear screenNot assessed A.7.8Equipment siting and protectionNot assessed A.7.9Security of assets off-premisesNot assessed A.7.10Storage mediaNot assessed A.7.11Supporting utilitiesNot assessed A.7.12Cabling securityNot assessed A.7.13Equipment maintenanceNot assessed A.7.14Secure disposal or re-use of equipmentNot assessed

Technological controls34

A.8.1User end point devicesNot assessed A.8.2Privileged access rightsNot assessed A.8.3Information access restrictionNot assessed A.8.4Access to source codeNot assessed A.8.5Secure authenticationNot assessed A.8.6Capacity managementNot assessed A.8.7Protection against malwareNot assessed A.8.8Management of technical vulnerabilitiesNot assessed A.8.9Configuration managementNot assessed A.8.10Information deletionNot assessed A.8.11Data maskingNot assessed A.8.12Data leakage preventionNot assessed A.8.13Information backupNot assessed A.8.14Redundancy of information processing facilitiesNot assessed A.8.15LoggingNot assessed A.8.16Monitoring activitiesNot assessed A.8.17Clock synchronizationNot assessed A.8.18Use of privileged c programsNot assessed A.8.19Installation of software on operational systemsNot assessed A.8.20Networks securityNot assessed A.8.21Security of network servicesNot assessed A.8.22Segregation of networksNot assessed A.8.23Web filteringNot assessed A.8.24Use of cryptographyNot assessed A.8.25Secure development life cycleNot assessed A.8.26Application security requirementsNot assessed A.8.27Secure system architecture and engineering principlesNot assessed A.8.28Secure codingNot assessed A.8.29Security testing in development and acceptanceNot assessed A.8.30Outsourced developmentNot assessed A.8.31Separation of development, test and production environmentsNot assessed A.8.32Change managementNot assessed A.8.33Test informationNot assessed A.8.34Protection of information systems during audit testingNot assessed