Purpose
To ensure continuing suitability, adequacy, effectiveness of management direction and support for information security in accordance with business, legal, statutory, regulatory and contractual requirements.

Other information
Topic-specific policies can vary across organizations. 

Purpose
To establish a defined, approved and understood structure for the implementation, operation and management of information security within the organization.

Other information 
Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of risks and mitigating controls. 
However, responsibility for resourcing and implementing the controls often remains with individual managers. One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection. 
Depending on the size and resourcing of an organization, information security can be covered by dedicated roles or duties carried out in addition to existing roles.

Purpose
To reduce the risk of fraud, error and bypassing of information security controls.

Other information 
No other information. 

Other information
No other information. 

Purpose
To ensure appropriate flow of information takes place with respect to information security between the organization and relevant legal, regulatory and supervisory authorities.

Other information
Organizations under attack can request authorities to take action against the attack source. Maintaining such contacts can be a requirement to support information security incident management (see 5.24 to 5.28) or the contingency planning and business continuity processes (see 5.29 and 5.30). Contacts with regulatory bodies are also useful to anticipate and prepare for upcoming changes in relevant laws or regulations that affect the organization. Contacts with other authorities include utilities, emergency services, electricity suppliers and health and safety [e.g. fire departments (in  connection with business continuity), telecommunication providers (in connection with line routing and availability) and water suppliers (in connection with cooling facilities for equipment)]. 

Purpose
To ensure appropriate flow of information takes place with respect to information security. 

Other information
No other information 

Purpose
To provide awareness of the organization’s threat environment so that the appropriate mitigation actions can be taken.

Threat intelligence can be divided into three layers, which should all be considered: 

Other information
Organizations can use threat intelligence to prevent, detect, or respond to threats. Organizations can produce threat intelligence, but more typically receive and make use of threat intelligence produced by other sources.

Purpose
To ensure information security risks related to projects and deliverables are effectively addressed in project management throughout the project life cycle.

Other information
The project development approach, such as waterfall life cycle or agile life cycle, should support information security in a structured way that can be adapted to suit the assessed severity of the information security risks, based on the character of the project. Early consideration of information security requirements for the product or service (e.g. at the planning and design stages), can lead to more effective and cost-efficient solutions for quality and information security. ISO 21500 and ISO 21502 provide guidance on concepts and processes of project management that are important for the performance of projects.
ISO/IEC 27005 provides guidance on the use of risk management processes to identify controls to meet information security requirements. 

Purpose
To identify the organization’s information and other associated assets in order to preserve their information security and assign appropriate ownership. 

Other information
Inventories of information and other associated assets are often necessary to ensure the effective protection of information and can be required for other purposes, such as health and safety, insurance or financial reasons. Inventories of information and other associated assets also support risk management, audit activities, vulnerability management, incident response and recovery planning. 
Tasks and responsibilities can be delegated (e.g. to a custodian looking after the assets on a daily basis), but the person or group who delegated them remains accountable. 
It can be useful to designate groups of information and other associated assets which act together to provide a particular service. In this case, the owner of this service is accountable for the delivery of the service, including the operation of its assets. 
See ISO/IEC 19770-1 for additional information on information technology (IT) asset management. See ISO 55001 for additional information on asset management. 

Purpose
To ensure information and other associated assets are appropriately protected, used and handled. 

Other information
It can be the case that the assets concerned do not directly belong to the organization, such as public cloud services. The use of such third-party assets and any assets of the organization associated with such external assets (e.g. information, software) should be identified as applicable and controlled, for example, through agreements with cloud service providers. Care should also be taken when a collaborative working environment is used. 

Purpose
To protect the organization’s assets as part of the process of changing or terminating employment, contract or agreement. 

Other information
It can be difficult to return information held on assets which are not owned by the organization. In such cases, it is necessary to restrict the use of information using other information security controls such as access rights management (5.18) or use of cryptography (8.24). 

Other information
Classification provides people who deal with information with a concise indication of how to handle and protect it. Creating groups of information with similar protection needs and specifying information security procedures that apply to all the information in each group facilitates this. This approach reduces the need for case-by-case risk assessment and custom design of controls. 
Information can cease to be sensitive or critical after a certain period of time. For example, when the information has been made public, it no longer has confidentiality requirements but can still require protection for its integrity and availability properties. These aspects should be taken into account, as over-classification can lead to the implementation of unnecessary controls resulting in additional expense or, on the contrary, under-classification can lead to insufficient controls to protect the information from compromise. 
As an example, an information confidentiality classification scheme can be based on four levels as follows: 

Purpose
To facilitate the communication of classification of information and support automation of information processing and management.

Other information
Labelling of classified information is a key requirement for information sharing. Other useful metadata that can be attached to the information is which organizational process created the information and at what time. Labelling of information and other associated assets can sometimes have negative effects. Classified assets can be easier to identify by malicious actors for potential misuse. Some systems do not label individual files or database records with their classification but protect all information at the highest level of classification of any of the information that it contains or is permitted to contain. It is usual in such systems to determine and then label information when it is exported. 

Purpose
To maintain the security of information transferred within an organization and with any external interested party 

Other information 
No other information. 

Purpose
To ensure authorized access and to prevent unauthorized access to information and other associated assets. 

Other information
There are often overarching principles used in the context of access control. Two of the most frequently used principles are: 

Care should be taken when specifying access control rules to consider: 

Access control rules should be supported by documented procedures (see 5.16, 5.17, 5.18, 8.2, 8.3, 8.4, 8.5, 8.18) and defined responsibilities (see 5.2, 5.17). 
There are several ways to implement access control, such as MAC (mandatory access control), DAC (discretionary access control), RBAC (role-based access control) and ABAC (attribute-based access control). 
Access control rules can also contain dynamic elements (e.g. a function that evaluates past accesses or specific environment values). Access control rules can be implemented in different granularity, ranging from covering whole networks or systems to specific data fields and can also consider properties such as user location or the type of network connection that is used for access. These principles and how granular access control is defined can have a significant cost impact. Stronger rules and more granularity typically lead to higher cost. Business requirements and risk considerations should be used to define which access control rules are applied and which granularity is required. 

Purpose 
To allow for the unique identification of individuals and systems accessing the organization’s information and other associated assets and to enable appropriate assignment of access rights. 

Other information
Providing or revoking access to information and other associated assets is usually a multi-step procedure: 

Purpose 
To ensure proper entity authentication and prevent failures of authentication processes. 

Other information
Passwords or passphrases are a commonly used type of authentication information and are a common means of verifying a user’s identity. Other types of authentication information are cryptographic keys, data stored on hardware tokens (e.g. smart cards) that produce authentication codes and biometric data such as iris scans or fingerprints. Additional information can be found in the ISO/IEC 24760 series. 
Requiring frequent change of passwords can be problematic because users can get annoyed by the frequent changes, forget new passwords, note them down in unsafe places, or choose unsafe passwords. Provision of single sign on (SSO) or other authentication management tools (e.g. password vaults) reduces the amount of authentication information that users are required to protect and can thereby increase the effectiveness of this control. However, these tools can also increase the impact of disclosure of authentication information. 
Some applications require user passwords to be assigned by an independent authority. In such cases, a), c) and d) of "Password management system" do not apply 

Other information
Consideration should be given to establishing user access roles based on business requirements that summarize a number of access rights into typical user access profiles. Access requests and reviews of access rights are easier managed at the level of such roles than at the level of particular rights. 
Consideration should be given to including clauses in personnel contracts and service contracts that specify sanctions if unauthorized access is attempted by personnel (see 5.20, 6.2, 6.4, 6.6). 
In cases of management-initiated termination, disgruntled personnel or external party users can deliberately corrupt information or sabotage information processing facilities. In cases of persons resigning or being dismissed, they can be tempted to collect information for future use. 
Cloning is an efficient way for organizations to assign access to users. However, it should be done with care based on distinct roles identified by the organization rather than just cloning an identity with all associated access rights. Cloning has an inherent risk of resulting in excessive access rights to information and other associated assets. 

Purpose 
To maintain an agreed level of information security in supplier relationships. 

Other information
In cases where it is not possible for an organization to place requirements on a supplier, the organization should: 

Information can be put at risk by suppliers with inadequate information security management. Controls should be determined and applied to manage the supplier's access to information and other associated assets. For example, if there is a special need for confidentiality of the information, non-disclosure agreements or cryptographic techniques can be used. Another example is personal data protection risks when the supplier agreement involves transfer of, or access to, information across borders. The organization needs to be aware that the legal or contractual responsibility for protecting information remains with the organization. 
Risks can also be caused by inadequate controls of ICT infrastructure components or services provided by suppliers. Malfunctioning or vulnerable components or services can cause information security breaches in the organization or to another entity (e.g. they can cause malware infection, attacks or other harm on entities other than the organization). 
See ISO/IEC 27036-2 for more detail. 

Purpose
To maintain an agreed level of information security in supplier relationships. 

Other information
The agreements can vary considerably for different organizations and among the different types of suppliers. Therefore, care should be taken to include all relevant requirements for addressing information security risks. For details on supplier agreements, see ISO/IEC 27036 series. For cloud service agreements, see ISO/IEC 19086 series. 
 

Purpose
To maintain an agreed level of information security in supplier relationships. 
 

Other information
The specific ICT supply chain risk management practices are built on top of general information security, quality, project management and system engineering practices but do not replace them.
Organizations are advised to work with suppliers to understand the ICT supply chain and any matters that have an important effect on the products and services being provided. The organization can influence ICT supply chain information security practices by making clear in agreements with their suppliers the matters that should be addressed by other suppliers in the ICT supply chain.
ICT should be acquired from reputable sources. The reliability of software and hardware is a matter of quality control. While it is generally not possible for an organization to inspect the quality control systems of its vendors, it can make reliable judgments based on the reputation of the vendor.
ICT supply chain as addressed here includes cloud services.
Examples of ICT supply chains are:

See ISO/IEC 27036-3 for more details including risk assessment guidance.
Software identification (SWID) tags can also help to achieve better information security in the supply chain, by providing information about software provenance. See ISO/IEC 19770-2 for more details.

Purpose
To maintain an agreed level of information security and service delivery in line with supplier agreements.

Other information
See ISO/IEC 27036-3 for more detail.

Purpose
To specify and manage information security for the use of cloud services.

Other information
This control considers cloud security from the perspective of the cloud service customer.
Additional information relating to cloud services can be found in ISO/IEC 17788, ISO/IEC 17789 and ISO/IEC 22123-1. Specifics related to cloud portability in support of exit strategies can be found in ISO/IEC 19941. Specifics related to information security and public cloud services are described in ISO/IEC 27017. Specifics related to PII protection in public clouds acting as PII processor are described in ISO/IEC 27018. Supplier relationships for cloud services are covered by ISO/IEC 27036-4 and cloud service agreements and their contents are dealt with in the ISO/IEC 19086 series, with security and privacy specifically covered by ISO/IEC 19086-4.

Purpose
To ensure quick, effective, consistent and orderly response to information security incidents, including communication on information security events.

Other information
Information security incidents can transcend organizational and national boundaries. To respond to such incidents, it is beneficial to coordinate response and share information about these incidents with external organizations as appropriate.
Detailed guidance on information security incident management is provided in the ISO/IEC 27035 series.

Purpose
To ensure effective categorization and prioritization of information security events.

Other information
The ISO/IEC 27035 series provides further guidance on incident management.

Purpose
To ensure efficient and effective response to information security incidents.

Purpose
To reduce the likelihood or consequences of future incidents. 

Purpose
To ensure a consistent and effective management of evidence related to information security incidents for the purposes of disciplinary and legal actions. 

Other information
When an information security event is first detected, it is not always obvious whether or not the event will result in court action. Therefore, the danger exists that necessary evidence is destroyed intentionally or accidentally before the seriousness of the incident is realized. It is advisable to involve legal advice or law enforcement early in any contemplated legal action and take advice on the evidence required. ISO/IEC 27037 provides definitions and guidelines for identification, collection, acquisition and preservation of digital evidence. The ISO/IEC 27050 series deals with electronic discovery, which involves the processing of electronically stored information as evidence. 

Purpose
To protect information and other associated assets during disruption.

Other information
In the context of business continuity and ICT continuity planning, it can be necessary to adapt the information security requirements depending on the type of disruption, compared to normal operational conditions. As part of the business impact analysis and risk assessment performed within business continuity management, the consequences of loss of confidentiality and integrity of information should be considered and prioritized in addition to the need for maintaining availability. 
Information on business continuity management systems can be found in ISO 22301 and ISO 22313. Further guidance on business impact analysis (BIA) can be found in ISO/TS 22317. 

Purpose
To ensure the availability of the organization’s information and other associated assets during disruption.

Other information
Managing ICT continuity forms a key part of business continuity requirements concerning availability to be able to: 

 Further guidance on ICT readiness for business continuity can be found in ISO/IEC 27031. 
Further guidance on business continuity management systems can be found in ISO 22301 and ISO 22313. 
Further guidance on BIA can be found in ISO/TS 22317. 

Purpose
To ensure compliance with legal, statutory, regulatory and contractual requirements related to information security.

Other information 
No other information.

Purpose
To ensure compliance with legal, statutory, regulatory and contractual requirements related to intellectual property rights and use of proprietary products. 

Other information 
Intellectual property rights include software or document copyright, design rights, trademarks, patents and source code licences. Proprietary software products are usually supplied under a licence agreement that specifies licence terms and conditions, for example, limiting the use of the products to specified machines or limiting copying to the creation of backup copies only. See the ISO/IEC 19770 series for details about IT asset management. Data can be acquired from outside sources. It is generally the case that such data is obtained under the terms of a data sharing agreement or similar legal instrument. Such data sharing agreements should make it clear what processing is permitted for the acquired data. It is also advisable that the provenance of the data is clearly stated. See ISO/IEC 23751:—1) for details about data sharing agreements. Legal, statutory, regulatory and contractual requirements can place restrictions on the copying of proprietary material. In particular, they can require that only material that is developed by the organization or that is licensed or provided by the developer to the organization, can be used. Copyright infringement can lead to legal action, which can involve fines and criminal proceedings. Aside from the organization needing to comply with its obligations towards third party intellectual property rights, the risks of personnel and third parties failing to uphold the organization’s own intellectual property rights should also be managed. 

Purpose
To ensure compliance with legal, statutory, regulatory and contractual requirements, as well as community or societal expectations related to the protection and availability of records. 

Other information
Records document individual events or transactions or can form aggregations that have been designed to document work processes, activities or functions. They are both evidence of business activity and information assets. Any set of information, regardless of its structure or form, can be managed as a  record. This includes information in the form of a document, a collection of data or other types of digital or analogue information which are created, captured and managed in the course of business. In the management of records, metadata is data describing the context, content and structure of records, as well as their management over time. Metadata is an essential component of any record. It can be necessary to retain some records securely to meet legal, statutory, regulatory or contractual requirements, as well as to support essential business activities. National law or regulation can set the time period and data content for information retention. Further information about records management can be found in ISO 15489.

Purpose
To ensure compliance with legal, statutory, regulatory and contractual requirements related to the information security aspects of the protection of PII. 

Other information
A number of countries have introduced legislation placing controls on the collection, processing, transmission and deletion of PII. Depending on the respective national legislation, such controls can impose duties on those collecting, processing and disseminating PII and can also restrict the authority to transfer PII to other countries. ISO/IEC 29100 provides a high-level framework for the protection of PII within ICT systems. Further information on privacy information management systems can be found in ISO/IEC 27701. Specific information regarding privacy information management for public clouds acting as PII processors can be found in ISO/IEC 27018. 
 ISO/IEC 29134 provides guidelines for privacy impact assessment (PIA) and gives an example of the structure and content of a PIA report. Compared with ISO/IEC 27005, this is focused on PII processing and relevant to those organizations that process PII. This can help identify privacy risks and possible mitigations to reduce these risks to acceptable levels. 

Other information
ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews. 

Purpose
To ensure that information security is implemented and operated in accordance with the organization’s information security policy, topic-specific policies, rules and standards. 

Other information 
Operational monitoring of system use is covered in 8.15, 8.16, 8.17. 

Purpose
To ensure the correct and secure operation of information processing facilities. 

Other information
No other information.