Organisational controls

search account_circle

verifiedISO 27001

Organisational controls

37 controls in this part of theISO 27001. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Policies for information security

Have clear, approved security policies that everyone knows about and follows.

Defining Information Security Roles and Responsibilities

Clearly assign security roles and duties to ensure nothing is overlooked.

Segregation of Duties

Ensure no one person can perform conflicting duties alone to prevent misuse.

Management responsibilities for information security

Managers must ensure everyone follows and supports the organisation's security policies.

Establish and Maintain Contact with Authorities

Ensure you can quickly contact authorities like police or regulators for security issues.

Contact with special interest groups

Maintain ties with security groups to stay updated on threats and best practices.

Threat Intelligence Collection and Analysis

Gather and study threat information to improve your security measures and readiness.

Information security in project management

Include security checks in all projects to prevent risks from new systems.

Inventory management of information and associated assets

Keep an updated list of information and assets, specifying who owns and manages each.

Acceptable Use Policies for Information and Assets

Create and communicate rules for how information and assets should be used to ensure security.

Return of Organisation's Assets upon Departure

Ensure that employees and external parties return all company assets when their job or contract ends

Information Classification Policy and Practices

Classify data based on security needs so everyone handles it correctly.

Labelling of Information

Create and use clear labels to show how sensitive information is, so it is correctly handled.

Information Transfer Policies and Procedures

Ensure secure and controlled transfer of information within and outside the organisation.

Access Control Policies and Procedures

Set and apply rules for who can access information and systems based on their security needs.

Identity life cycle management

Ensure all user and system identities are managed from creation to deactivation.

Management of Authentication Information

Ensure secure and proper handling of passwords and authentication details.

Managing Access Rights to Information Assets

Regularly check and adjust who can access sensitive information based on business rules.

Managing Information Security in Supplier Relationships

Ensure suppliers of products/services do not pose security risks through defined processes.

Integrating security clauses in supplier agreements

Ensure suppliers meet agreed security requirements relevant to their relationship.

Managing Information Security in the ICT Supply Chain

Ensure ICT supply chain security by managing risks with processes and procedures.

Monitoring and Managing Supplier Services

Keep track of and adapt to changes in how suppliers handle security and service delivery.

Cloud Service Security Management

Ensure secure cloud service use with proper procedures for acquisition, management, and exit.

Information security incident management planning and preparation

Ensure your organisation is ready to manage security incidents with clear processes and responsible

Assessment and decision on information security events

Evaluate security events to determine which are serious enough to be called incidents.

Response to Information Security Incidents

Ensure security incidents are handled quickly and effectively following set procedures.

Learning from information security incidents

Use knowledge from past incidents to boost security and prevent future issues.

Procedures for Collecting and Preserving Evidence

Set up clear steps to gather and maintain evidence of security incidents securely.

Maintain information security during disruptions

Plan to keep information secure even when normal operations are interrupted.

ICT Readiness for Business Continuity

Ensure ICT systems are ready to support business goals during disruptions through proper planning an

Compliance with Information Security Legal Requirements

Identify and stay updated on information security legal obligations to avoid breaches.

Intellectual Property Rights Protection

Develop procedures to safeguard intellectual property rights to avoid legal issues.

Protection of Records

Ensure records are safe from loss, damage, falsification, and unauthorised access.

Privacy and Protection of Personally Identifiable Information

Ensure privacy and PII protection according to laws and contracts.

Independent review of information security

Ensure independent reviews of information security management at regular intervals or after signific

Review compliance with information security policies

Regularly check if your organisation's security policies and rules are being followed.

Documented Operating Procedures for Information Processing

Ensure procedures are written down and accessible to those who need them.

Back to the full ISO/IEC 27001:2022 control list, or browse the complete control library.