Controls library.
1,484 controls across 5 frameworks, quoted as published and explained in plain English.
Controls
1,484 controls
Loading the full library…
The full library could not load just now, so only the first controls are listed and filters are off. Reload the page to try again.
- A.5.1Policies for information securityHave clear, approved security policies that everyone knows about and follows.ISO 27001Organisational controls
- A.5.2Defining Information Security Roles and ResponsibilitiesClearly assign security roles and duties to ensure nothing is overlooked.ISO 27001Organisational controls
- A.5.3Segregation of DutiesEnsure no one person can perform conflicting duties alone to prevent misuse.ISO 27001Organisational controls
- A.5.4Management responsibilities for information securityManagers must ensure everyone follows and supports the organisation's security policies.ISO 27001Organisational controls
- A.5.5Establish and Maintain Contact with AuthoritiesEnsure you can quickly contact authorities like police or regulators for security issues.ISO 27001Organisational controls
- A.5.6Contact with special interest groupsMaintain ties with security groups to stay updated on threats and best practices.ISO 27001Organisational controls
- A.5.7Threat Intelligence Collection and AnalysisGather and study threat information to improve your security measures and readiness.ISO 27001Organisational controls
- A.5.8Information security in project managementInclude security checks in all projects to prevent risks from new systems.ISO 27001Organisational controls
- A.5.9Inventory management of information and associated assetsKeep an updated list of information and assets, specifying who owns and manages each.ISO 27001Organisational controls
- A.5.10Acceptable Use Policies for Information and AssetsCreate and communicate rules for how information and assets should be used to ensure security.ISO 27001Organisational controls
- A.5.11Return of Organisation's Assets upon DepartureEnsure that employees and external parties return all company assets when their job or contract ends.ISO 27001Organisational controls
- A.5.12Information Classification Policy and PracticesClassify data based on security needs so everyone handles it correctly.ISO 27001Organisational controls
- A.5.13Labelling of InformationCreate and use clear labels to show how sensitive information is, so it is correctly handled.ISO 27001Organisational controls
- A.5.14Information Transfer Policies and ProceduresEnsure secure and controlled transfer of information within and outside the organisation.ISO 27001Organisational controls
- A.5.15Access Control Policies and ProceduresSet and apply rules for who can access information and systems based on their security needs.ISO 27001Organisational controls
- A.5.16Identity life cycle managementEnsure all user and system identities are managed from creation to deactivation.ISO 27001Organisational controls
- A.5.17Management of Authentication InformationEnsure secure and proper handling of passwords and authentication details.ISO 27001Organisational controls
- A.5.18Managing Access Rights to Information AssetsRegularly check and adjust who can access sensitive information based on business rules.ISO 27001Organisational controls
- A.5.19Managing Information Security in Supplier RelationshipsEnsure suppliers of products/services do not pose security risks through defined processes.ISO 27001Organisational controls
- A.5.20Integrating security clauses in supplier agreementsEnsure suppliers meet agreed security requirements relevant to their relationship.ISO 27001Organisational controls
- A.5.21Managing Information Security in the ICT Supply ChainEnsure ICT supply chain security by managing risks with processes and procedures.ISO 27001Organisational controls
- A.5.22Monitoring and Managing Supplier ServicesKeep track of and adapt to changes in how suppliers handle security and service delivery.ISO 27001Organisational controls
- A.5.23Cloud Service Security ManagementEnsure secure cloud service use with proper procedures for acquisition, management, and exit.ISO 27001Organisational controls
- A.5.24Information security incident management planning and preparationEnsure your organisation is ready to manage security incidents with clear processes and responsible roles.ISO 27001Organisational controls
- A.5.25Assessment and decision on information security eventsEvaluate security events to determine which are serious enough to be called incidents.ISO 27001Organisational controls
- A.5.26Response to Information Security IncidentsEnsure security incidents are handled quickly and effectively following set procedures.ISO 27001Organisational controls
- A.5.27Learning from information security incidentsUse knowledge from past incidents to boost security and prevent future issues.ISO 27001Organisational controls
- A.5.28Procedures for Collecting and Preserving EvidenceSet up clear steps to gather and maintain evidence of security incidents securely.ISO 27001Organisational controls
- A.5.29Maintain information security during disruptionsPlan to keep information secure even when normal operations are interrupted.ISO 27001Organisational controls
- A.5.30ICT Readiness for Business ContinuityEnsure ICT systems are ready to support business goals during disruptions through proper planning and testing.ISO 27001Organisational controls
- A.5.31Compliance with Information Security Legal RequirementsIdentify and stay updated on information security legal obligations to avoid breaches.ISO 27001Organisational controls
- A.5.32Intellectual Property Rights ProtectionDevelop procedures to safeguard intellectual property rights to avoid legal issues.ISO 27001Organisational controls
- A.5.33Protection of RecordsEnsure records are safe from loss, damage, falsification, and unauthorised access.ISO 27001Organisational controls
- A.5.34Privacy and Protection of Personally Identifiable InformationEnsure privacy and PII protection according to laws and contracts.ISO 27001Organisational controls
- A.5.35Independent review of information securityEnsure independent reviews of information security management at regular intervals or after significant changes.ISO 27001Organisational controls
- A.5.36Review compliance with information security policiesRegularly check if your organisation's security policies and rules are being followed.ISO 27001Organisational controls
- A.5.37Documented Operating Procedures for Information ProcessingEnsure procedures are written down and accessible to those who need them.ISO 27001Organisational controls
- A.6.1Personnel Background VerificationConduct background checks on all job candidates before hiring to manage risks.ISO 27001People controls
- A.6.2Terms and conditions of employment for securityEnsure job agreements state everyone's info security duties clearly.ISO 27001People controls
- A.6.3Information security awareness, education and training programEnsure everyone gets regular training and updates on information security relevant to their job.ISO 27001People controls
- A.6.4Disciplinary Process for Information Security ViolationsEnsure staff understand consequences for breaking security rules to prevent violations.ISO 27001People controls
- A.6.5Responsibilities after employment termination or role changeEnsure security responsibilities are clear when employment ends or roles change.ISO 27001People controls
- A.6.6Confidentiality and Non-disclosure AgreementsEnsure all relevant parties sign agreements to protect confidential information.ISO 27001People controls
- A.6.7Remote Working Security MeasuresImplement security measures to protect company info when working outside the office.ISO 27001People controls
- A.6.8Mechanisms for Reporting Security EventsEnsure staff can quickly report security problems through official channels to prevent bigger issues.ISO 27001People controls
- A.7.1Physical Security PerimetersDefine clear physical boundaries to protect sensitive areas and assets from unauthorised access.ISO 27001Physical controls
- A.7.2Physical access controls for secure areasEnsure only authorised people can enter secure areas and prevent unauthorised access.ISO 27001Physical controls
- A.7.3Physical Security for Offices and FacilitiesEnsure physical security to prevent unauthorised access to offices and facilities.ISO 27001Physical controls
- A.7.4Continuous monitoring of physical access to premisesUse systems like CCTV and alarms to detect unauthorised physical entry.ISO 27001Physical controls
- A.7.5Protecting against physical and environmental threatsPlan and implement actions to prevent damage from natural and human threats to physical infrastructure.ISO 27001Physical controls
No controls match these filters
Try fewer filters, or a control ID such as A.5.15 or ISM-0974.
- Working through ISO 27001? Use the free ISO 27001 Annex A checklist, no account needed.
- Comparing to global GRC platforms? See Control Stack vs Drata, Vanta and Scytale.