|
# |
ID |
Name |
Type |
Property |
Concept |
Domain |
|
1 |
5.1 |
Policies for information security |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_ and_Ecosystem #Resilience |
|
2 |
5.2 |
Information security roles and responsibilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_and_ Ecosystem #Protection #Resilience |
|
3 |
5.3 |
Segregation of duties |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_ and_Ecosystem |
|
4 |
5.4 |
Management responsibilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_ and_Ecosystem |
|
5 |
5.5 |
Contact with authorities |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Identify #Protect #Respond #Recover |
#Defence
#Resilience |
|
6 |
5.6 |
Contact with special interest groups |
#Preventive #Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Respond #Recover |
#Defence |
|
7 |
5.7 |
Threat intelligence |
#Preventive
#Detective #Corrective |
#Confidentiality
#Integrity #Availability |
#Identify
#Detect #Respond |
#Defence #Resilience |
|
8 |
5.8 |
Information security in project management |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify #Protect |
#Governance_ and_Ecosystem #Protection |
|
9 |
5.9 |
Inventory of information and other associated assets |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_ and_Ecosystem #Protection |
|
10 |
5.10 |
Acceptable use of information and other associated
assets |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_and_Ecosystem #Protection |
|
11 |
5.11 |
Return of assets |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
12 |
5.12 |
Classification of information |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Protection
#Defence |
|
13 |
5.13 |
Labelling of information |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Defence
#Protection |
|
14 |
5.14 |
Information transfer |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
15 |
5.15 |
Access control |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
16 |
5.16 |
Identity management |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
17 |
5.17 |
Authentication information |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection |
|
18 |
5.18 |
Access rights |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
19 |
5.19 |
Information security in supplier relationships |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_
and_Ecosystem #Protection |
|
20 |
5.20 |
Addressing information security within supplier
agreements |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_ and_Ecosystem #Protection |
|
21 |
5.21 |
Managing information security in the ICT supply chain |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_
and_Ecosystem #Protection |
|
22 |
5.22 |
Monitoring, review and change management of supplier
services |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_
and_Ecosystem #Protection #Defence |
|
23 |
5.23 |
Information security for use of cloud services |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_ and_Ecosystem #Protection |
|
24 |
5.24 |
Information security incident management planning and
preparation |
#Corrective |
#Confidentiality
#Integrity #Availability |
#Respond
#Recover |
#Defence |
|
25 |
5.25 |
Assessment and decision on information security events |
#Detective |
#Confidentiality
#Integrity #Availability |
#Detect
#Respond |
#Defence |
|
26 |
5.26 |
Response to information security incidents |
#Corrective |
#Confidentiality
#Integrity #Availability |
#Respond #Recover |
#Defence |
|
27 |
5.27 |
Learning from information security incidents |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify #Protect |
#Defence |
|
28 |
5.28 |
Collection of evidence |
#Corrective |
#Confidentiality
#Integrity #Availability |
#Detect
#Respond |
#Defence |
|
29 |
5.29 |
Information security during disruption |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Respond |
#Protection #Resilience |
|
30 |
5.30 |
ICT readiness for business continuity |
#Corrective |
#Availability |
#Respond |
#Resilience |
|
31 |
5.31 |
Legal, statutory, regulatory and contractual
requirements |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance_
and_Ecosystem #Protection |
|
32 |
5.32 |
Intellectual property rights |
#Preventive |
#Confidentiality #Integrity #Availability |
#Identify |
#Governance_ and_Ecosystem |
|
33 |
5.33 |
Protection of records |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Defence |
|
34 |
5.34 |
Privacy and protection of PII |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Protection |
|
35 |
5.35 |
Independent review of information security |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Governance_
and_Ecosystem |
|
36 |
5.36 |
Compliance with policies, rules and standards for
information security |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Governance_ and_Ecosystem |
|
37 |
5.37 |
Documented operating procedures |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Recover |
#Governance_
and_Ecosystem #Protection #Defence |
|
38 |
6.1 |
Screening |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_ and_Ecosystem |
|
39 |
6.2 |
Terms and conditions of employment |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_ and_Ecosystem |
|
40 |
6.3 |
Information security awareness, education and training |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_
and_Ecosystem |
|
41 |
6.4 |
Disciplinary process |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Respond |
#Governance_ and_Ecosystem |
|
42 |
6.5 |
Responsibilities after termination or change of
employment |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance_ and_Ecosystem |
|
43 |
6.6 |
Confidentiality or non-disclosure agreements |
#Preventive |
#Confidentiality |
#Protect |
#Governance_
and_Ecosystem |
|
44 |
6.7 |
Remote working |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
45 |
6.8 |
Information security event reporting |
#Detective |
#Confidentiality
#Integrity #Availability |
#Detect |
#Defence |
|
46 |
7.1 |
Physical security perimeters |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
47 |
7.2 |
Physical entry |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
48 |
7.3 |
Securing offices, rooms and facilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
49 |
7.4 |
Physical security monitoring |
#Preventive
#Detective |
#Confidentiality
#Integrity #Availability |
#Protect
#Detect |
#Protection
#Defence |
|
50 |
7.5 |
Protecting against physical and environmental threats |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection |
|
51 |
7.6 |
Working in secure areas |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
52 |
7.7 |
Clear desk and clear screen |
#Preventive |
#Confidentiality |
#Protect |
#Protection |
|
53 |
7.8 |
Equipment siting and protection |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection |
|
54 |
7.9 |
Security of assets off-premises |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
55 |
7.10 |
Storage media |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
56 |
7.11 |
Supporting utilities |
#Preventive #Detective |
#Integrity #Availability |
#Protect
#Detect |
#Protection |
|
57 |
7.12 |
Cabling security |
#Preventive |
#Confidentiality
#Availability |
#Protect |
#Protection |
|
58 |
7.13 |
Equipment maintenance |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection #Resilience |
|
59 |
7.14 |
Secure disposal or re-use of equipment |
#Preventive |
#Confidentiality |
#Protect |
#Protection |
|
60 |
8.1 |
User endpoint devices |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
61 |
8.2 |
Privileged access rights |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection |
|
62 |
8.3 |
Information access restriction |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
63 |
8.4 |
Access to source code |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection |
|
64 |
8.5 |
Secure authentication |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
65 |
8.6 |
Capacity management |
#Preventive #Detective |
#Integrity
#Availability |
#Identify #Protect #Detect |
#Governance_ and_Ecosystem #Protection |
|
66 |
8.7 |
Protection against malware |
#Preventive
#Detective #Corrective |
#Confidentiality #Integrity #Availability |
#Protect
#Detect |
#Protection #Defence |
|
67 |
8.8 |
Management of technical vulnerabilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify #Protect |
#Governance_
and_Ecosystem #Protection #Defence |
|
68 |
8.9 |
Configuration management |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
69 |
8.10 |
Information deletion |
#Preventive |
#Confidentiality |
#Protect |
#Protection |
|
70 |
8.11 |
Data masking |
#Preventive |
#Confidentiality |
#Protect |
#Protection |
|
71 |
8.12 |
Data leakage prevention |
#Preventive
#Detective |
#Confidentiality |
#Protect
#Detect |
#Protection #Defence |
|
72 |
8.13 |
Information backup |
#Corrective |
#Integrity #Availability |
#Recover |
#Protection |
|
73 |
8.14 |
Redundancy of information processing facilities |
#Preventive |
#Availability |
#Protect |
#Protection
#Resilience |
|
74 |
8.15 |
Logging |
#Detective |
#Confidentiality #Integrity #Availability |
#Detect |
#Protection #Defence |
|
75 |
8.16 |
Monitoring activities |
#Detective
#Corrective |
#Confidentiality
#Integrity #Availability |
#Detect #Respond |
#Defence |
|
76 |
8.17 |
Clock synchronization |
#Detective |
#Integrity |
#Protect
#Detect |
#Protection #Defence |
|
77 |
8.18 |
Use of privileged utility programs |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
78 |
8.19 |
Installation of software on operational systems |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
79 |
8.20 |
Networks security |
#Preventive #Detective |
#Confidentiality
#Integrity #Availability |
#Protect
#Detect |
#Protection |
|
80 |
8.21 |
Security of network services |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
81 |
8.22 |
Segregation of networks |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
82 |
8.23 |
Web filtering |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
83 |
8.24 |
Use of cryptography |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
84 |
8.25 |
Secure development life cycle |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
85 |
8.26 |
Application security requirements |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection #Defence |
|
86 |
8.27 |
Secure system architecture and engineering principles |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
87 |
8.28 |
Secure coding |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
88 |
8.29 |
Security testing in development and acceptance |
#Preventive |
#Confidentiality #Integrity #Availability |
#Identify |
#Protection |
|
89 |
8.30 |
Outsourced development |
#Preventive #Detective |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect #Detect |
#Governance_ and_Ecosystem #Protection |
|
90 |
8.31 |
Separation of development, test and production
environments |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Protection |
|
91 |
8.32 |
Change management |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Protection |
|
92 |
8.33 |
Test information |
#Preventive |
#Confidentiality
#Integrity |
#Protect |
#Protection |
|
93 |
8.34 |
Protection of information systems during audit testing |
#Preventive |
#Confidentiality #Integrity #Availability |
#Protect |
#Governance_
and_Ecosystem #Protection |
