Technological Controls
Annex A.8 — 34 controls covering access, cryptography, secure development, and monitoring.
User end point devices
User end point devices.
Privileged access rights
Privileged access rights.
Information access restriction
Information access restriction.
Access to source code
Access to source code.
Secure authentication
Secure authentication.
Capacity management
Capacity management.
Protection against malware
Protection against malware.
Management of technical vulnerabilities
Management of technical vulnerabilities.
Configuration management
Configuration management.
Information deletion
Information deletion.
Data masking
Data masking.
Data leakage prevention
Data leakage prevention.
Information backup
Information backup.
Redundancy of information processing facilities
Redundancy of information processing facilities.
Logging
Logging.
Monitoring activities
Monitoring activities.
Clock synchronization
Clock synchronization.
Use of privileged utility programs
Use of privileged utility programs.
Installation of software on operational systems
Installation of software on operational systems.
Networks security
Networks security.
Security of network services
Security of network services.
Segregation of networks
Segregation of networks.
Web filtering
Web filtering.
Use of cryptography
Use of cryptography.
Secure development life cycle
Secure development life cycle.
Application security requirements
Application security requirements.
Secure system architecture and engineering principles
Secure system architecture and engineering principles.
Secure coding
Secure coding.
Security testing in development and acceptance
Security testing in development and acceptance.
Outsourced development
Outsourced development.
Separation of development, test and production environments
Separation of development, test and production environments.
Change management
Change management.
Test information
Test information.
Protection of information systems during audit testing
Protection of information systems during audit testing.