ISO 27001

: 2013
Control #

A.5.1.1

A.5.1.2

A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5

A.6.2.1

A.6.2.2
A.7.1.1
A.7.1.2
A.7.2.1
A.7.2.2
A.7.2.3
A.7.3.1
A.8.1.1
A.8.1.2
A.8.1.3
A.8.1.4
A.8.2.1
A.8.2.2
A.8.2.3
A.8.3.1
A.8.3.2
A.8.3.3
A.9.1.1
A.9.1.2
A.9.2.1
A.9.2.2
A.9.2.3
A.9.2.4
A.9.2.5
A.9.2.6
A.9.3.1
A.9.4.1
A.9.4.2
A.9.4.3
A.9.4.4
A.9.4.5
A.10.1.1
A.10.1.2
A.11.1.1
A.11.1.2
A.11.1.3
A.11.1.4
A.11.1.5
A.11.1.6
A.11.2.1
A.11.2.2
A.11.2.3
A.11.2.4
A.11.2.5
A.11.2.6
A.11.2.7
A.11.2.8
A.11.2.9
A.12.1.1
A.12.1.2
A.12.1.3
A.12.1.4
A.12.2.1
A.12.3.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.4.4
A.12.5.1
A.12.6.1
A.12.6.2
A.12.7.1
A.13.1.1
A.13.1.2
A.13.1.3

A.13.2.1

A.13.2.2
A.13.2.3
A.13.2.4
A.14.1.1
A.14.1.2
A.14.1.3
A.14.2.1
A.14.2.2
A.14.2.3
A.14.2.4
A.14.2.5
A.14.2.6
A.14.2.7
A.14.2.8
A.14.2.9
A.14.3.1
A.15.1.1
A.15.1.2
A.15.1.3
A.15.2.1
A.15.2.2
A.16.1.1
A.16.1.2
A.16.1.3
A.16.1.4
A.16.1.5
A.16.1.6
A.16.1.7
A.17.1.1
A.17.1.2
A.17.1.3
A.17.2.1
A.18.1.1
A.18.1.2
A.18.1.3
A.18.1.4
A.18.1.5
A.18.2.1
A.18.2.2
A.18.2.3
 Mapped NESA
ISO 27001:2013 Control
IA Control #

Policies for information security

M1.2.1,
M.1.2.2
Review of the policies for information security
M1.2.1(6),
M.1.2.2(8)
Information security roles and responsibilities M.1.1.3
Segregation of duties T.3.2.4
Contact with authorities M.1.3.3
Contact with special interest groups M.1.3.4
Information security in project management Missing
Mobile device policy
T.5.1.1(4,5)
T.5.7.1(1)
Teleworking T.5.7.2
Screening M.4.2.1
Terms and conditions of employment M.4.2.2
Management responsibilities M.4.3.1
Information security awareness, education, and training M.3.2.1
Disciplinary process M.4.3.2
Termination or change of employment responsibilities M.4.4.1
Inventory of assets T.1.2.1
Ownership of assets T.1.2.2
Acceptable use of assets T.1.2.3
Return of assets M.4.4.2
Classification of information T.1.3.1
Labelling of Information T.1.3.2
Handling of Assets T.1.3.3
Management of removable media T.1.4.1
Disposal of media T.1.4.2
Physical media transfer T.4.2.3
Access control policy T.5.1.1
Access to networks and network services T.5.4.1
User registration and de-registration T.5.2.1
User access provisioning T.5.2.1
Management of privileged access rights T.5.2.2
Management of secret authentication information of users T.5.2.3
Review of user access rights T.5.2.4
Removal or adjustment of access rights M.4.4.3
Use of secret authentication information T.5.3.1
Information access restriction T.5.6.1
Secure logon procedures T.5.5.1
Password management system T.5.5.3
Use of privileged utility programs T.5.5.4
Access control to program source code T.7.5.3
Policy on the use of cryptographic controls T.7.4.1
Key Management T.7.4.2
Physical security perimeter T.2.2.1
Physical entry controls T.2.2.2
Securing offices, rooms and facilities T.2.2.3
Protecting against external and environmental threats T.2.2.4
Working in secure areas T.2.2.5
Delivery and loading areas T.2.2.6
Equipment siting and protection T.2.3.1
Supporting utilities T.2.3.2
Cabling security T.2.3.3
Equipment maintenance T.2.3.4
Removal of assets T.2.3.7
Security of equipment and assets off-premises T.2.3.5
Secure disposal or reuse of equipment T.2.3.6
Unattended user equipment T.2.3.8
Clear desk and clear screen policy T.2.3.9
Documented operating procedures T.3.2.2
Change management T.3.2.3
Capacity management T.3.3.1
Separation of development, testing, and operational environments T.3.2.5
Controls against malware T.3.4.1
Information backup T.3.5.1
Event logging T.3.6.2
Protection of log information T.3.6.4
Administrator and operator logs T.3.6.5
Clock synchronization T.3.6.7
Installation of software on operational systems T.7.5.1
Management of technical vulnerabilities T.7.7.1
Restrictions on software installation Missing
Information systems audit controls M.5.5.1
Network controls T.4.5.1
Security of network services T.4.5.2
Segregation in networks T.4.5.3
Information transfer policies and procedures
T.4.1.1
T.4.2.1
Agreements on information transfer T.4.2.2
Electronic messaging T.4.2.4
Confidentiality or nondisclosure agreements M.1.3.2
Information security requirements analysis and specification T.7.2.1
Securing application services on public networks T.4.3.1
Protecting application services transactions T.4.3.2
Secure development policy T.7.1.1
System change control procedures T.7.6.1
Technical review of applications after operating platform changes T.7.6.2
Restrictions on changes to software packages T.7.6.3
Secure system engineering principles Missing
Secure development environment Missing
Outsourced development T.7.6.5
System security testing Missing
System acceptance testing T.3.3.2
Protection of test data T.7.5.2
Information security policy for supplier relationships M.1.3.6
Address security within supplier agreements M.1.3.7
Information and communication technology supply chain M.1.3.5
Monitoring and review of supplier services T.6.2.2
Managing changes to supplier services T.6.2.3
Responsibilities and procedures T.8.2.1
Reporting information security events Missing
Reporting information security weaknesses Missing
Assessment of and decision on information security events Missing
Response to information security incidents Missing
Learning from information security incidents T.8.2.8
Collection of evidence T.8.2.9
Planning information security continuity T.9.2.1
Implementing information security continuity T.9.2.2
Verify, review, and evaluate information security continuity T.9.3.1
Availability of information processing facilities Missing
Identification of applicable legislation and contractual requirements M.5.2.1
Intellectual property rights M.5.2.2
Protection of records M.5.2.3
Privacy and protection of personal information M.5.2.4
Regulation of cryptographic controls M.5.2.6
Independent review of information security M.6.2.2
Compliance with security policies and standards M.5.3.1
Technical compliance review M.5.4.1