ISO 27001:2022 Requirements &
Controls

Policies, procedures, and organizational structures for information security management.

Key Controls:

• Information security policies (5.1)
• Information security roles and responsibilities (5.2)
• Segregation of duties (5.3)
• Management responsibilities (5.4)
• Contact with authorities (5.5)
• Asset management (5.9)
• Acceptable use of assets (5.10)
• Return of assets (5.11)
• Classification of information (5.12)
• Labelling of information (5.13)

Human resource security controls covering the employee lifecycle.

Key Controls:

• Screening (6.1)
• Terms and conditions of employment (6.2)
• Information security awareness, education and training (6.3)
• Disciplinary process (6.4)
• Responsibilities after termination (6.5)
• Confidentiality or non-disclosure agreements (6.6)
• Remote working (6.7)
• Information security event reporting (6.8)

Physical security controls to protect facilities, equipment, and assets.

Key Controls:

• Physical security perimeters (7.1)
• Physical entry (7.2)
• Securing offices, rooms and facilities (7.3)
• Physical security monitoring (7.4)
• Protecting against physical and environmental threats (7.5)
• Working in secure areas (7.6)
• Clear desk and clear screen (7.7)
• Equipment siting and protection (7.8)
• Security of assets off-premises (7.9)
• Storage media (7.10)

Technical security controls for systems, networks, and data protection.

Key Controls:

• User endpoint devices (8.1)
• Privileged access rights (8.2)
• Information access restriction (8.3)
• Secure authentication (8.5)
• Protection against malware (8.7)
• Configuration management (8.9)
• Information backup (8.13)
• Logging (8.15)
• Networks security (8.20)
• Use of cryptography (8.24)