ISO 27001 Requirement 8.2 – Information Security Risk Assessment

ISO 27001:2022 requirements

• 4.1 Understanding the organisation and its context

• 4.2 Understanding the needs and expectations of interested parties

• 4.3 Determining the scope of the ISMS

• 4.4 Information security management system (ISMS)

• 5.1 Leadership and commitment

• 5.2 Information Security Policy

• 5.3 Organisational roles, responsibilities and authorities

• 6.1 Actions to address risks and opportunities

• 6.2 Information security objectives and planning to achieve them

• 7.1 Resources

• 7.2 Competence

• 7.3 Awareness

• 7.4 Communication

• 7.5 Documented information

• 8.1 Operational planning and control

• 8.2 Information security risk assessment

• 8.3 Information security risk treatment

• 9.1 Monitoring, measurement, analysis and evaluation

• 9.2 Internal audit

• 9.3 Management review

• 10.1 Nonconformity and corrective action

• 10.2 Continual improvement

ISO 27001:2022 Annex A Controls

Organisational Controls

• A 5.1 Information Security Policies

• A 5.2 Information Security Roles and Responsibilities

• A 5.3 Segregation of Duties

• A 5.4 Management Responsibilities

• A 5.5 Contact With Government Authorities

• A 5.6 Contact With Special Interest Groups

• A 5.7 Threat Intelligence

• A 5.8 Information Security in Project Management

• A 5.9 Inventory of Information and Other Associated Assets

• A 5.10 Acceptable Use of Information and Other Associated Assets

• A 5.11 Return of Assets

• A 5.12 Classification of Information

• A 5.13 Labelling of Information

• A 5.14 Information Transfer

• A 5.15 Access Control

• A 5.16 Identity Management

• A 5.17 Authentication Information

• A 5.18 Access Rights

• A 5.19 Information Security in Supplier Relationships

• A 5.20 Addressing Information Security Within Supplier Agreements

• A 5.21 Managing Information Security in the ICT Supply Chain

• A 5.22 Monitoring and Review and Change Management of Supplier Services

• A 5.23 Information Security for Use of Cloud Services

• A 5.24 Information Security Incident Management Planning and Preparation

• A 5.25 Assessment and Decision on Information Security Events

• A 5.26 Response to Information Security Incidents

• A 5.27 Learning From Information Security Incidents

• A 5.28 Collection of Evidence

• A 5.29 Information Security During Disruption

• A 5.30 ICT Readiness for Business Continuity

• A 5.31 Legal, Statutory, Regulatory and Contractual Requirements

• A 5.32 Intellectual Property Rights

• A 5.33 Protection of Records

• A 5.34 Privacy and Protection of PII

• A 5.35 Independent Review of Information Security

• A 5.36 Compliance With Policies, Rules and Standards for Information Security

• A 5.37 Documented Operating Procedures

People Controls

• A 6.1 Screening

• A 6.2 Terms and Conditions of Employment

• A 6.3 Information Security Awareness, Education, and Training

• A 6.4 Disciplinary Process

• A 6.5 Responsibilities After Termination or Change of Employment

• A 6.6 Confidentiality or Non-Disclosure Agreements

• A 6.7 Remote Working

• A 6.8 Information Security Event Reporting

Physical Controls

• A 7.1 Physical Security Perimeters

• A 7.2 Physical Entry

• A 7.3 Securing Offices, Rooms and Facilities

• A 7.4 Physical Security Monitoring

• A 7.5 Protecting Against Physical and Environmental Threats

• A 7.6 Working In Secure Areas

• A 7.7 Clear Desk and Clear Screen

• A 7.8 Equipment Siting and Protection

• A 7.9 Security of Assets Off-Premises

• A 7.10 Storage Media

• A 7.11 Supporting Utilities

• A 7.12 Cabling Security

• A 7.13 Equipment Maintenance

• A 7.14 Secure Disposal or Re-Use of Equipment

Technological Controls

• A 8.1 User Endpoint Devices

• A 8.2 Privileged Access Rights

• A 8.3 Information Access Restriction

• A 8.4 Access to Source Code

• A 8.5 Secure Authentication

• A 8.6 Capacity Management

• A 8.7 Protection Against Malware

• A 8.8 Management of Technical Vulnerabilities

• A 8.9 Configuration Management

• A 8.10 Information Deletion

• A 8.11 Data Masking

• A 8.12 Data Leakage Prevention

• A 8.13 Information Backup

• A 8.14 Redundancy of Information Processing Facilities

• A 8.15 Logging

• A 8.16 Monitoring Activities

• A 8.17 Clock Synchronisation

• A 8.18 Use of Privileged Utility Programs

• A 8.19 Installation of Software on Operational Systems

• A 8.20 Network Security

• A 8.21 Security of Network Services

• A 8.22 Segregation of Networks

• A 8.23 Web Filtering

• A 8.24 Use of Cryptography

• A 8.25 Secure Development Life Cycle

• A 8.26 Application Security Requirements

• A 8.27 Secure System Architecture and Engineering Principles

• A 8.28 Secure Coding

• A 8.29 Security Testing in Development and Acceptance

• A 8.30 Outsourced Development

• A 8.31 Separation of Development, Test and Production Environments

• A 8.32 Change Management

• A 8.33 Test Information

• A 8.34 Protection of Information Systems During Audit Testing

About ISO 27001

• About ISO 27001

• Achieve ISO 27001

• ISO 27001 Requirements & Controls

• Asset management

• ISO 27001 Certification

• What is an ISMS?

• Key considerations for your ISMS

• Migrating your ISMS to ISMS.online

• ISO 27002 explained