ISO/IEC 27001:2022: the evidence behind each requirement
123 requirements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.
Clauses 4 to 10 are the management-system requirements: none of them can be excluded when an organisation claims conformity. The 93 Annex A controls are a reference set: one may be excluded with a justification in the Statement of Applicability. Certification bodies assess conformity; the evidence lists here are what auditors commonly ask for, not a list the standard prescribes.
Clause 4
4.1Understanding the organization and its context hard4.2Understanding the needs and expectations of interested parties hard4.3Determining the scope of the information security management system hard4.4Information security management system hardClause 5
5.1Leadership and commitment hard5.2Policy hard5.3Organizational roles, responsibilities and authorities hardClause 6
6.1.1Actions to address risks and opportunities: general hard6.1.2Information security risk assessment hard6.1.3Information security risk treatment hard6.2Information security objectives and planning to achieve them hard6.3Planning of changes hardClause 7
7.1Resources hard7.2Competence hard7.3Awareness moderate7.4Communication hard7.5.1Documented information: general hard7.5.2Documented information: creating and updating hard7.5.3Documented information: control moderateClause 8
8.1Operational planning and control moderate8.2Information security risk assessment hard8.3Information security risk treatment hardClause 9
9.1Monitoring, measurement, analysis and evaluation hard9.2.1Internal audit: general hard9.2.2Internal audit programme hard9.3.1Management review: general hard9.3.2Management review inputs hard9.3.3Management review results moderateClause 10
Organizational controls
A.5.1Policies for information security hardA.5.2Information security roles and responsibilities hardA.5.3Segregation of duties easyA.5.4Management responsibilities hardA.5.5Contact with authorities hardA.5.6Contact with special interest groups hardA.5.7Threat intelligence hardA.5.8Information security in project management hardA.5.9Inventory of information and other associated assets hardA.5.10Acceptable use of information and other associated assets hardA.5.11Return of assets hardA.5.12Classification of information hardA.5.13Labelling of information hardA.5.14Information transfer hardA.5.15Access control hardA.5.16Identity management hardA.5.17Authentication information hardA.5.18Access rights hardA.5.19Information security in supplier relationships hardA.5.20Addressing information security within supplier agreements hardA.5.21Managing information security in the information and communication technology (ICT) supply chain hardA.5.22Monitoring, review and change management of supplier services hardA.5.23Information security for use of cloud services hardA.5.24Information security incident management planning and preparation hardA.5.25Assessment and decision on information security events hardA.5.26Response to information security incidents moderateA.5.27Learning from information security incidents hardA.5.28Collection of evidence hardA.5.29Information security during disruption hardA.5.30ICT readiness for business continuity hardA.5.31Legal, statutory, regulatory and contractual requirements hardA.5.32Intellectual property rights hardA.5.33Protection of records hardA.5.34Privacy and protection of personal identifiable information (PII) hardA.5.35Independent review of information security hardA.5.36Compliance with policies, rules and standards for information security hardA.5.37Documented operating procedures hardPeople controls
A.6.1Screening hardA.6.2Terms and conditions of employment hardA.6.3Information security awareness, education and training hardA.6.4Disciplinary process hardA.6.5Responsibilities after termination or change of employment hardA.6.6Confidentiality or non-disclosure agreements hardA.6.7Remote working moderateA.6.8Information security event reporting hardPhysical controls
A.7.1Physical security perimeters hardA.7.2Physical entry easyA.7.3Securing offices, rooms and facilities hardA.7.4Physical security monitoring hardA.7.5Protecting against physical and environmental threats hardA.7.6Working in secure areas hardA.7.7Clear desk and clear screen moderateA.7.8Equipment siting and protection moderateA.7.9Security of assets off-premises easyA.7.10Storage media hardA.7.11Supporting utilities hardA.7.12Cabling security hardA.7.13Equipment maintenance hardA.7.14Secure disposal or re-use of equipment hardTechnological controls
A.8.1User end point devices moderateA.8.2Privileged access rights moderateA.8.3Information access restriction hardA.8.4Access to source code moderateA.8.5Secure authentication easyA.8.6Capacity management hardA.8.7Protection against malware easyA.8.8Management of technical vulnerabilities hardA.8.9Configuration management easyA.8.10Information deletion hardA.8.11Data masking hardA.8.12Data leakage prevention easyA.8.13Information backup moderateA.8.14Redundancy of information processing facilities hardA.8.15Logging easyA.8.16Monitoring activities moderateA.8.17Clock synchronization hardA.8.18Use of privileged utility programs moderateA.8.19Installation of software on operational systems moderateA.8.20Networks security moderateA.8.21Security of network services moderateA.8.22Segregation of networks moderateA.8.23Web filtering moderateA.8.24Use of cryptography hardA.8.25Secure development life cycle hardA.8.26Application security requirements hardA.8.27Secure system architecture and engineering principles hardA.8.28Secure coding hardA.8.29Security testing in development and acceptance hardA.8.30Outsourced development hardA.8.31Separation of development, test and production environments hardA.8.32Change management moderateA.8.33Test information moderateA.8.34Protection of information systems during audit testing hard