Organizational Controls
Annex A.5 — 37 organisational controls covering policies, roles, supplier relationships, and incident management.
Policies for information security
Policies for information security.
Information security roles and responsibilities
Information security roles and responsibilities.
Segregation of duties
Segregation of duties.
Management responsibilities
Management responsibilities.
Contact with authorities
Contact with authorities.
Contact with special interest groups
Contact with special interest groups.
Threat intelligence
Threat intelligence.
Information security in project management
Information security in project management.
Inventory of information and other associated assets
Inventory of information and other associated assets.
Acceptable use of information and other associated assets
Acceptable use of information and other associated assets.
Return of assets
Return of assets.
Classification of information
Classification of information.
Labelling of information
Labelling of information.
Information transfer
Information transfer.
Access control
Access control.
Identity management
Identity management.
Authentication information
Authentication information.
Access rights
Access rights.
Information security in supplier relationships
Information security in supplier relationships.
Addressing information security within supplier agreements
Addressing information security within supplier agreements.
Managing information security in the ICT supply chain
Managing information security in the ICT supply chain.
Monitoring, review and change management of supplier services
Monitoring, review and change management of supplier services.
Information security for use of cloud services
Information security for use of cloud services.
Information security incident management planning and preparation
Information security incident management planning and preparation.
Assessment and decision on information security events
Assessment and decision on information security events.
Response to information security incidents
Response to information security incidents.
Learning from information security incidents
Learning from information security incidents.
Collection of evidence
Collection of evidence.
Information security during disruption
Information security during disruption.
ICT readiness for business continuity
ICT readiness for business continuity.
Legal, statutory, regulatory and contractual requirements
Legal, statutory, regulatory and contractual requirements.
Intellectual property rights
Intellectual property rights.
Protection of records
Protection of records.
Privacy and protection of PII
Privacy and protection of PII.
Independent review of information security
Independent review of information security.
Compliance with policies, rules and standards for information security
Compliance with policies, rules and standards for information security.
Documented operating procedures
Documented operating procedures.