ISO 27001:2022 Annex A Checklist

Have clear, approved security policies that everyone knows about and follows.

Clearly assign security roles and duties to ensure nothing is overlooked.

Ensure no one person can perform conflicting duties alone to prevent misuse.

Managers must ensure everyone follows and supports the organisation's security policies.

Ensure you can quickly contact authorities like police or regulators for security issues.

Maintain ties with security groups to stay updated on threats and best practices.

Gather and study threat information to improve your security measures and readiness.

Include security checks in all projects to prevent risks from new systems.

Keep an updated list of information and assets, specifying who owns and manages each.

Create and communicate rules for how information and assets should be used to ensure security.

Ensure that employees and external parties return all company assets when their job or contract ends.

Classify data based on security needs so everyone handles it correctly.

Create and use clear labels to show how sensitive information is, so it is correctly handled.

Ensure secure and controlled transfer of information within and outside the organisation.

Set and apply rules for who can access information and systems based on their security needs.

Ensure all user and system identities are managed from creation to deactivation.

Ensure secure and proper handling of passwords and authentication details.

Regularly check and adjust who can access sensitive information based on business rules.

Ensure suppliers of products/services do not pose security risks through defined processes.

Ensure suppliers meet agreed security requirements relevant to their relationship.

Ensure ICT supply chain security by managing risks with processes and procedures.

Keep track of and adapt to changes in how suppliers handle security and service delivery.

Ensure secure cloud service use with proper procedures for acquisition, management, and exit.

Ensure your organisation is ready to manage security incidents with clear processes and responsible roles.

Evaluate security events to determine which are serious enough to be called incidents.

Ensure security incidents are handled quickly and effectively following set procedures.

Use knowledge from past incidents to boost security and prevent future issues.

Set up clear steps to gather and maintain evidence of security incidents securely.

Plan to keep information secure even when normal operations are interrupted.

Ensure ICT systems are ready to support business goals during disruptions through proper planning and testing.

Identify and stay updated on information security legal obligations to avoid breaches.

Develop procedures to safeguard intellectual property rights to avoid legal issues.

Ensure records are safe from loss, damage, falsification, and unauthorised access.

Ensure privacy and PII protection according to laws and contracts.

Ensure independent reviews of information security management at regular intervals or after significant changes.

Regularly check if your organisation's security policies and rules are being followed.

Ensure procedures are written down and accessible to those who need them.

Conduct background checks on all job candidates before hiring to manage risks.

Ensure job agreements state everyone's info security duties clearly.

Ensure everyone gets regular training and updates on information security relevant to their job.

Ensure staff understand consequences for breaking security rules to prevent violations.

Ensure security responsibilities are clear when employment ends or roles change.

Ensure all relevant parties sign agreements to protect confidential information.

Implement security measures to protect company info when working outside the office.

Ensure staff can quickly report security problems through official channels to prevent bigger issues.

Define clear physical boundaries to protect sensitive areas and assets from unauthorized access.

Ensure only authorised people can enter secure areas and prevent unauthorised access.

Ensure physical security to prevent unauthorized access to offices and facilities.

Use systems like CCTV and alarms to detect unauthorized physical entry.

Plan and implement actions to prevent damage from natural and human threats to physical infrastructure.

Implement security measures to control and protect activities in secure areas.

Ensure desks and screens are clear of sensitive info to prevent unauthorized access.

Ensure equipment is placed safely to prevent damage or unauthorised access.

Ensure assets used outside the office are protected from theft or loss.

Manage storage media safely from purchase to disposal based on your risk policies.

Make sure key equipment is safe from power and utility failures to avoid data loss.

Ensure cables are protected from interception, damage, or interference to prevent security risks.

Ensure all equipment is regularly maintained to prevent failures and protect data.

Ensure device data is erased or secured before disposal or reuse to prevent data breaches.

Ensure all laptops, mobiles, and tablets are secure to protect stored information.

Control and limit who gets special access to sensitive systems to keep them secure.

Limit access to information based on set policies to prevent unauthorised use.

Control who can read and change source code to avoid risks and maintain security.

Use secure methods to confirm identities and control access to systems and data.

Ensure resources are monitored and adjusted to meet current and future needs to prevent system slowdowns or failures.

Implement measures and train users to prevent and detect malware threats.

Identify and address software vulnerabilities to prevent exploitation and security risks.

Set and keep secure settings for all IT systems and watch for changes.

Delete data you don't need anymore to reduce risk and comply with laws.

Use data masking to hide sensitive info based on policy requirements and legal obligations.

Implement measures to stop sensitive data from being leaked or stolen from your systems.

Keep and test backups of data and systems regularly as per backup policy.

Ensure systems have backups to avoid downtime and data loss.

Keep detailed logs of activities and events to detect attacks and ensure accountability.

Regularly check networks and systems for unusual activity to address potential security threats.

Ensure all system clocks are set to the same time source to aid in event tracking and investigations.

Restrict and control programs that can override system controls to prevent unauthorised access.

Ensure software installations are controlled to prevent security risks.

Secure and manage networks to prevent unauthorized access to your information.

Ensure network services are secure, reliable, and meet agreed-upon standards.

Separate network groups to limit risks and control access between services, users, and systems.

Limit access to risky websites to avoid malware and phishing threats.

Create and enforce rules for using cryptography and managing keys effectively.

Set rules for secure software and system development to avoid costly production issues.

Ensure security needs are clear and approved when creating or buying applications.

Create and use guidelines for building secure systems in all development projects.

Ensure software is built securely to prevent vulnerabilities.

Ensure security tests are part of the development process to find issues early.

Ensure your organisation oversees and checks outsourced development to maintain security.

Ensure development, testing, and production systems are separate to avoid disrupting live services.

Ensure all system changes follow a formal, approved process to prevent issues.

Choose and protect test data carefully to avoid exposing sensitive information.

Ensure audit activities are planned and agreed with management to prevent system disruptions.