Technological controls

search account_circle

verifiedISO 27001

Technological controls

34 controls in this part of theISO 27001. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Protection of User Endpoint Devices

Ensure all laptops, mobiles, and tablets are secure to protect stored information.

Management of Privileged Access Rights

Control and limit who gets special access to sensitive systems to keep them secure.

Restrict access to information and assets

Limit access to information based on set policies to prevent unauthorised use.

Access management for source code and tools

Control who can read and change source code to avoid risks and maintain security.

Secure authentication technologies and procedures

Use secure methods to confirm identities and control access to systems and data.

Capacity Management for Resource Use

Ensure resources are monitored and adjusted to meet current and future needs to prevent system slowd

Protection against malware

Implement measures and train users to prevent and detect malware threats.

Management of Technical Vulnerabilities

Identify and address software vulnerabilities to prevent exploitation and security risks.

Configuration Management for Secure IT Systems

Set and keep secure settings for all IT systems and watch for changes.

Secure deletion of information when no longer needed

Delete data you don't need anymore to reduce risk and comply with laws.

Data Masking for Sensitive Information

Use data masking to hide sensitive info based on policy requirements and legal obligations.

Data Leakage Prevention Measures

Implement measures to stop sensitive data from being leaked or stolen from your systems.

Backup and Recovery Procedures for Data

Keep and test backups of data and systems regularly as per backup policy.

Redundancy of Information Processing Facilities

Ensure systems have backups to avoid downtime and data loss.

Logging of Activities and Events

Keep detailed logs of activities and events to detect attacks and ensure accountability.

Monitoring Networks and Systems for Anomalous Behaviour

Regularly check networks and systems for unusual activity to address potential security threats.

Clock synchronisation for information systems

Ensure all system clocks are set to the same time source to aid in event tracking and investigations

Use of Privileged Utility Programs

Restrict and control programs that can override system controls to prevent unauthorised access.

Secure Software Installation Procedures

Ensure software installations are controlled to prevent security risks.

Network and Network Devices Security

Secure and manage networks to prevent unauthorized access to your information.

Security of Network Services

Ensure network services are secure, reliable, and meet agreed-upon standards.

Network Segregation for Security

Separate network groups to limit risks and control access between services, users, and systems.

Web Filtering to Reduce Malicious Website Exposure

Limit access to risky websites to avoid malware and phishing threats.

Effective Use of Cryptography and Key Management

Create and enforce rules for using cryptography and managing keys effectively.

Secure Development Lifecycle

Set rules for secure software and system development to avoid costly production issues.

Defining Security Requirements for Applications

Ensure security needs are clear and approved when creating or buying applications.

Secure system architecture and engineering principles

Create and use guidelines for building secure systems in all development projects.

Secure Coding Practices in Software Development

Ensure software is built securely to prevent vulnerabilities.

Security testing in development and acceptance

Ensure security tests are part of the development process to find issues early.

Management of Outsourced System Development

Ensure your organisation oversees and checks outsourced development to maintain security.

Separation of Development, Test, and Production Environments

Ensure development, testing, and production systems are separate to avoid disrupting live services.

Change management procedures for information systems

Ensure all system changes follow a formal, approved process to prevent issues.

Test Information Selection and Protection

Choose and protect test data carefully to avoid exposing sensitive information.

Protection of information systems during audits

Ensure audit activities are planned and agreed with management to prevent system disruptions.

Back to the full ISO/IEC 27001:2022 control list, or browse the complete control library.