ISO 27001 Annex A Checklist

Employment contractual agreements state personnel's and organisation's responsibilities for information security.

Personnel and relevant interested parties receive appropriate information security awareness, education and training and regular updates of the organisation's information security policy.

A disciplinary process formalised and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.

Information security responsibilities and duties remaining valid after termination or change of employment defined, enforced and communicated to relevant personnel.

Confidentiality or non-disclosure agreements reflecting the organisation's needs for protecting information identified, documented, regularly reviewed and signed by personnel.

Security measures implemented when personnel work remotely to protect information accessed, processed or stored outside the organisation's premises.

Organisation provides a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

Secure areas protected by appropriate entry controls and access points.

Physical security for offices, rooms and facilities designed and implemented.

Premises monitored continuously for unauthorised physical access.

Protection against physical and environmental threats such as natural disasters and other intentional or unintentional physical threats to infrastructure designed and implemented.

Security measures for working in secure areas designed and implemented.

Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities defined and appropriately enforced.

Equipment sited securely and protected.

Off-site assets protected.

Storage media managed through its life cycle of acquisition, use, transportation and disposal in accordance with the organisation's classification scheme and handling requirements.

Information processing facilities protected from power failures and other disruptions caused by failures in supporting utilities.

Cables carrying power, data or supporting information services protected from interception, interference or damage.

Equipment maintained correctly to ensure availability, integrity and confidentiality of information.

Items of equipment verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.

Allocation and use of privileged access rights restricted and managed.

Access to information and other associated assets restricted in accordance with the established topic-specific policy on access control.

Read and write access to source code, development tools and software libraries managed appropriately.

Secure authentication technologies and procedures implemented based on information access restrictions and the topic-specific policy on access control.

Use of resources monitored and adjusted in line with current and expected capacity requirements.

Protection against malware implemented and supported by appropriate user awareness.

Information about technical vulnerabilities of information systems in use obtained in a timely fashion, the organisation's exposure to such vulnerabilities evaluated and appropriate measures taken.

Configurations, including security configurations, of hardware, software, services and networks established, documented, implemented, monitored and reviewed.

Information stored in information systems, devices or in any other storage media deleted when no longer required.

Data masking used in accordance with the organisation's topic-specific policy on access control and other related topic-specific policies, and business requirements.

Data leakage prevention measures applied to systems, networks and any other devices that process, store or transmit sensitive information.

Backup copies of information, software and systems maintained and regularly tested in accordance with the agreed topic-specific policy on backup.

Information processing facilities implemented with redundancy sufficient to meet availability requirements.

Logs that record activities, exceptions, faults and other relevant events produced, stored, protected and analysed.

Networks, systems and applications monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

Clocks of information processing systems used by the organisation synchronised to approved time sources.

Use of utility programs that can be capable of overriding system and application controls restricted and tightly controlled.

Procedures and measures implemented to securely manage software installation on operational systems.

Networks and network devices secured, managed and controlled to protect information in systems and applications.

Security mechanisms, service levels and service requirements of network services identified, implemented and monitored.

Groups of information services, users and information systems segregated in the organisation's networks.

Access to external websites managed to reduce exposure to malicious content.

Rules for the effective use of cryptography, including cryptographic key management, defined and implemented.

Rules for secure development of software and systems established and applied.

Information security requirements identified, specified and approved when developing or acquiring applications.

Principles for engineering secure systems established, documented, maintained and applied to any information system development activities.

Secure coding principles applied to software development.

Security testing processes defined and implemented in the development life cycle.

Organisation directs, monitors and reviews the activities related to outsourced system development.

Development, testing and production environments separated and secured.

Changes to information processing facilities and information systems subject to change management procedures.

Test information appropriately selected, protected and managed.

Audit tests and other assurance activities involving assessment of operational systems planned and agreed between the tester and appropriate management.