ISO/IEC 27001

• 1. Why Organization need ISO 27001
  • 1.1 Who need ISO 27001
  • 1.2 How to Select an Auditor for ISO 27001
  • 1.3 How to Select an ISO 27001 Auditor When You Have a Budget Constraint
  • 1.4 When Do You Need ISO 27001?
  • 1.5 Industries That Most Commonly Need ISO 27001
  • 1.6 When Do You Not Need ISO 27001?
• 2. ISO 27001 Annex A Controls – Organizational Controls (A.5 – 37 controls)
  • ISO 27001 Annex A 5.1 Policies for information security
  • ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets
  • ISO 27001 Annex A 5.11 Return of assets
  • ISO 27001 Annex A 5.12 Classification of information
  • ISO 27001 Annex A 5.13 Labelling of information
  • ISO 27001 Annex A 5.14 Information transfer
  • ISO 27001 Annex A 5.15 Access control
  • ISO 27001 Annex A 5.16 Identity management
  • ISO 27001 Annex A 5.17 Authentication information
  • ISO 27001 Annex A 5.18 Access rights – change
  • ISO 27001 Annex A 5.19 Information security in supplier relationships
  • ISO 27001 Annex A 5.2 Information security roles and responsibilities
  • ISO 27001 Annex A 5.20 Addressing information security within supplier agreements
  • ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain
  • ISO 27001 Annex A 5.22 Monitoring, review and change management of supplier services
  • ISO 27001 Annex A 5.23 Information security for use of cloud services
  • ISO 27001 Annex A 5.3 Segregation of duties
  • ISO 27001 Annex A 5.4 Management responsibilities
  • ISO 27001 Annex A 5.5 Contact with authorities
  • ISO 27001 Annex A 5.6 Contact with special interest groups
  • ISO 27001 Annex A 5.7 Threat intelligence
  • ISO 27001 Annex A 5.8 Information security in project management
  • ISO 27001 Annex A 5.9 Inventory of information and other associated assets
  • ISO 27001 Annex A 5.24 Information security incident management planning and preparation
  • ISO 27001 Annex A 5.25 Assessment and decision on information security events
  • ISO 27001 Annex A 5.26 Response to information security incidents
  • ISO 27001 Annex A 5.27 Learning from information security incidents
  • ISO 27001 Annex A 5.28 Collection of evidence
  • ISO 27001 Annex A 5.29 Information security during disruption
  • ISO 27001 Annex A 5.30 ICT readiness for business continuity
  • ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements
  • ISO 27001 Annex A 5.32 Intellectual property rights
  • ISO 27001 Annex A 5.33 Protection of records
  • ISO 27001 Annex A 5.34 Privacy and protection of PII
  • ISO 27001 Annex A 5.35 Independent review of information security
  • ISO 27001 Annex A 5.36 Compliance with policies and standards for information security
  • ISO 27001 Annex A 5.37 Documented operating procedures
  • Information Transfer Policy
• 3. ISO 27001 Annex A Controls – People Controls (A.6 – 8 controls)
  • ISO 27001 Annex A 6.1 Screening
  • ISO 27001 Annex A 6.2 Terms and conditions of employment
  • ISO 27001 Annex A 6.3 Information security awareness, education and training
  • ISO 27001 Annex A 6.4 Disciplinary process
  • ISO 27001 Annex A 6.5 Responsibilities after termination or change of employment
  • ISO 27001 Annex A 6.6 Confidentiality or non-disclosure agreements
  • ISO 27001 Annex A 6.7 Remote working
  • ISO 27001 Annex A 6.8 Information security event reporting
• 4. ISO 27001 Annex A Controls – Physical Controls (A.7 – 14 controls)
  • ISO 27001 Annex A 7.1: Physical Security Perimeters
  • ISO 27001 Annex A 7.10 Storage media
  • ISO 27001 Annex A 7.11 Supporting utilities
  • ISO 27001 Annex A 7.12 Cabling security
  • ISO 27001 Annex A 7.13 Equipment maintenance
  • ISO 27001 Annex A 7.14 Secure disposal or re-use of equipment
  • ISO 27001 Annex A 7.2 Physical entry controls
  • ISO 27001 Annex A 7.3 Securing offices, rooms and facilities
  • ISO 27001 Annex A 7.4 Physical security monitoring
  • ISO 27001 Annex A 7.5 Protecting against physical and environmental threats
  • ISO 27001 Annex A 7.6 Working in secure areas
  • ISO 27001 Annex A 7.7 Clear desk and clear screen
  • ISO 27001 Annex A 7.8 Equipment siting and protection
  • ISO 27001 Annex A 7.9 Security of assets off-premises
• 5. ISO 27001 Annex A – 8 Technological controls
  • ISO 27001 Annex A 8.1 User endpoint devices
  • ISO 27001 Annex A 8.10 Information deletion
  • ISO 27001 Annex A 8.11 Data masking
  • ISO 27001 Annex A 8.12 Data leakage prevention
  • ISO 27001 Annex A 8.13 Information backup
  • ISO 27001 Annex A 8.14 Redundancy of information processing facilities
  • ISO 27001 Annex A 8.15 Logging
  • ISO 27001 Annex A 8.16: Monitoring Activities
  • ISO 27001 Annex A 8.17 Clock synchronisation
  • ISO 27001 Annex A 8.18 Use of privileged utility programs
  • ISO 27001 Annex A 8.19 Installation of software on operational systems
  • ISO 27001 Annex A 8.2 Privileged access rights
  • ISO 27001 Annex A 8.20 Network controls
  • ISO 27001 Annex A 8.21 Security of network services
  • ISO 27001 Annex A 8.22: Segregation of Networks
  • ISO 27001 Annex A 8.23 Web filtering
  • ISO 27001 Annex A 8.24 Use of cryptography
  • ISO 27001 Annex A 8.25 Secure development lifecycle
  • ISO 27001 Annex A 8.26 Application security requirements
  • ISO 27001 Annex A 8.27 Secure system architecture and engineering principles
  • ISO 27001 Annex A 8.29 Security testing in development and acceptance
  • ISO 27001 Annex A 8.3 Information access restriction
  • ISO 27001 Annex A 8.30 Outsourced development
  • ISO 27001 Annex A 8.32 Change management
  • ISO 27001 Annex A 8.33 Test information
  • ISO 27001 Annex A 8.34 Protection of information systems during audit and testing
  • ISO 27001 Annex A 8.4 Access to source code
  • ISO 27001 Annex A 8.5 Secure authentication
  • ISO 27001 Annex A 8.6 Capacity management
  • ISO 27001 Annex A 8.7 Protection against malware
  • ISO 27001 Annex A 8.8 Management of technical vulnerabilities
  • ISO 27001 Annex A 8.9 Configuration management
  • SO 27001 Annex A 8.31 Separation of development, test and production environments
• Other Doc
  • Example: AWS SaaS Startup
  • ISO 27001 Risk Assessment Guide
  • How to Prepare an ISO 27001 Statement of Applicability — AWS SaaS Startup Example
  • ISO 27001 Statement of Applicability (SoA) Guide
  • ISO 27001 Implementation Guide for Startups
  • ISO 27001 Implementation Guide for Startups
  • ISO 27001 Internal Audit Checklist
  • ISO 27001 RACI Matrix
  • ISO 27001 Risk Assessment Guide
  • ISO 27001 Roles & Responsibilities Template
  • ISO 27001 Access Control Policy
  • Segregation of Duties Policy
  • Incident Response Plan
  • ISO 27001 Authority & Regulatory Contact Register
  • ISO 27001 Management Review Guide
  • ISO 27001 Security Awareness Policy
  • Data Breach Response Procedure
  • Regulatory Compliance Register
  • Security Incident Management Procedure
  • Draft Special Interest Group Register
  • External Security Information Monitoring Procedure
  • Threat Intelligence Procedure
  • Vulnerability Management Procedure
  • Security Risk Assessment Template
  • Threat Assessment Template
  • Threat Intelligence Procedure
  • Project Risk Assessment Template
  • Project Security Checklist
  • Project Security Requirements Template
  • Secure Development Checklist
  • Security Architecture Review Template
  • Security Testing Checklist
  • Threat Intelligence Register
  • Acceptable Use Policy
  • Access Revocation Checklist
  • AI Acceptable Use Policy
  • Asset Classification Procedure
  • Asset Ownership Register
  • Asset Return Checklist
  • BYOD (Bring Your Own Device) Policy
  • Cloud Asset Inventory
  • Contractor Offboarding Checklist
  • Data Handling Guidelines
  • Data Inventory Template
  • Employee IT Usage Policy
  • Employee Offboarding Checklist
  • Go-Live Security Approval Form
  • Information & Asset Inventory Template
  • Information Classification Policy
  • ISO 27001 Asset Lifecycle Management Procedure
  • IT Asset Handover Form
  • Lost/Stolen Asset Incident Form
  • Remote Working Policy
  • SaaS Application Register
  • Security Awareness Training Material
  • Access Control Matrix
  • Approved Information Transfer Channels
  • Confidential Document Template
  • External Data Sharing Procedure
  • Information Handling Procedure
  • Information Transfer Training
  • Privileged Access Register
  • Restricted Document Template
  • Secure File Transfer Checklist
  • Secure Information Transfer Procedure
  • Third-Party Information Sharing Agreement
  • User Access Request
  • User Access Review Checklist
  • Access Review Report
  • Joiner-Mover-Leaver Procedure
  • Third-Party Access Procedure
  • Identity Management Policy
  • User Account Management Procedure
  • Authentication & Password Policy
  • Contractor Account Procedure
  • Identity Register
  • Identity Review Checklist
  • PI Key Management Procedure
  • Privileged Identity Management Procedure
  • Secrets Management Procedure
  • Service Account Register
  • Authentication Information Register
  • Credential Compromise Response Procedure
  • Credential Reset Procedure
  • User Access Management Procedure
  • User Access Request Form
  • User Onboarding & Authentication Procedure
  • Access Rights Register
  • Contractor Access Review Checklist
  • Periodic Access Review Template
  • Privileged Access Review Template
  • Critical Supplier Register
  • Supplier Contract Security Checklist
  • Supplier Offboarding Checklist
  • Supplier Onboarding Checklist
  • Supplier Register
  • Supplier Risk Assessment Template
  • Supplier Security Addendum
  • Supplier Security Management Policy
  • Supplier Security Questionnaire
  • Supplier Security Requirements Template
  • Supplier Security Review Template
  • Third-Party Due Diligence Checklist
  • Data Processing Agreement Checklist
  • Supplier Risk Assessment
  • ICT Dependency Register
  • ICT Supply Chain Security Policy
  • Supplier Contract Review Checklist
  • Supplier Due Diligence Questionnaire
  • Critical Technology Dependency Assessment
  • Draft Supplier Monitoring & Review Policy
  • Software Bill of Materials (SBOM) Template
  • Software Dependency Inventory
  • Subprocessor Review Checklist
  • Supplier Change Assessment Template
  • Supplier Change Management Procedure
  • Supplier Monitoring Procedure
  • Supplier Monitoring Register
  • Supplier Security Evidence Review Checklist
  • Supply Chain Risk Assessment
  • Supply Chain Security Incident Response Procedure
  • Third-Party Component Vulnerability Procedure
  • Third-Party Software Assessment Checklist
  • Cloud Provider Due Diligence Questionnaire
  • Cloud Secure Configuration Standard
  • Cloud Security Policy
  • Cloud Security Risk Assessment
  • Cloud Services Register
  • Critical Supplier Review Template
  • Supplier Corrective Action Register
  • Cloud Access Review Checklist
  • Cloud Backup and Recovery Procedure
  • Cloud Exit Checklist
  • Cloud Incident Response Procedure
  • SaaS / Shadow IT Register
  • Incident Response Procedure
  • Information Security Incident Management Policy
  • Incident Response Playbook – Account Compromise
  • Incident Response Playbook – Data Breach
  • Incident Response Playbook – Ransomware
  • Incident Response Playbook – Phishing
  • Corrective Action Tracker
  • Incident Closure Report
  • Incident Investigation Template
  • Incident Response Playbook – Cloud Compromise
  • Incident Severity Matrix
  • Incident Timeline Template
  • Incident Escalation Matrix
  • Incident Response Team RACI
  • Incident Register
  • Incident Reporting Form
  • Security Incident Communication Procedure
  • Evidence Preservation Procedure
  • Incident Response Tabletop Exercise Template
  • Incident Response Tabletop Exercise Template
  • Information Security Event Assessment Procedure
  • Security Event Classification Matrix
  • Security Event Reporting Form
  • Event-to-Incident Decision Checklist
  • Security Alert Investigation Checklist
  • Security Event Register
  • Corrective Action Tracker
  • Evidence Collection Form
  • Evidence Collection Procedure
  • Evidence Register
  • Incident Response Playbook
  • Incident Trend Report
  • ISMS Improvement Log
  • Lessons Learned Register
  • Post-Incident Review Template
  • Root Cause Analysis Template
  • Business Continuity & Information Security Policy
  • Business Continuity Plan
  • Business Continuity Testing Checklist
  • Chain-of-Custody Form
  • Digital Forensics Procedure
  • Disaster Recovery Plan
  • Emergency Access Procedure
  • Emergency Change Procedure
  • Incident Investigation Report
  • Information Security During Disruption Procedure
  • Security Log Retention Standard
  • Disaster Recovery Test Report
• 6. ISO 27001 Implementation
  • Bulls Eype APPROACH …. … many stend will be in piplne
  • Butterfly approach – many compliance alredy in palce + one approach + Mnay sub orgnizations are also there ….. we need to balance many orgnaizaioton ..
  • How to Implement in Difence
  • How to Implement in FMCCG
  • How to Implement in IT Company
  • How to Implement in James
  • How to Implement in Manufecting company
  • How to Implement in Pharm Company
  • How to Implement in sharemarket
  • Orgnization to Std approach -Dept tp deprt
  • Stad to ornigzation approch
• 7. ISO 27001 Audit
  • Approcj – Generaal
  • Cerftifiaion audit
  • Non cerfitficaion audit
  • Theam based Or cleint based