Frameworks supported

Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and interested parties, and reviewed at planned intervals.

Information transfer rules, procedures, and agreements shall be in place for all types of transfer facilities within the organisation and between the organisation and other parties.

Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

The full life cycle of identities shall be managed.

Allocation and management of authentication information shall be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the topic-specific policy on access control.

Processes for acquisition, use, management, and exit from cloud services shall be established in accordance with the organisation's information security requirements.

ICT readiness shall be planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements.

Personnel of the organisation and relevant interested parties shall receive appropriate information security awareness, education, and training and regular updates of the organisation's information security policy.

Security measures shall be implemented when personnel work remotely to protect information accessed, processed, or stored outside the organisation's premises.

The allocation and use of privileged access rights shall be restricted and managed.

Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.

Protection against malware shall be implemented and supported by appropriate user awareness.

Information stored in information systems, devices, or in any other storage media shall be deleted when no longer required.

Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.

Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected, and analysed.

Networks, systems and applications shall be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

The clocks of information processing systems used by the organisation shall be synchronised to approved time sources.

Networks and network devices shall be secured, managed, and controlled to protect information in systems and applications.

Security mechanisms, service levels, and service requirements of network services shall be identified, implemented, and monitored.

Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.

Rules for the secure development of software and systems shall be established and applied.

Information security requirements shall be identified, specified, and approved when developing or acquiring applications.

Secure coding principles shall be applied to software development.

Changes to information processing facilities and information systems shall be subject to change management procedures.

The entity demonstrates a commitment to integrity and ethical values that supports the functioning of the system of internal control.

The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.

The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support its functioning.

The entity identifies risks to the achievement of its objectives across the entity and analyses risks as a basis for determining how the risks should be managed.

The entity identifies and assesses changes that could significantly impact the system of internal control.

The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

The entity selects and develops general control activities over technology to support the achievement of objectives.

The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.

Prior to issuing system credentials and granting system access, the entity registers and authorises new internal and external users whose access is administered by the entity.

The entity authorises, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties.

The entity implements logical access security measures to protect against threats from sources outside its system boundaries, including encryption of data in transit.

The entity restricts the transmission, movement, and removal of information to authorised internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives. Includes encryption of data at rest.

The entity implements controls to prevent or detect and act upon the introduction of unauthorised or malicious software to meet its objectives.

To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.

The entity responds to identified security incidents by executing a defined incident response programme to understand, contain, remediate, and communicate security incidents, as appropriate.

The entity identifies, develops, and implements activities to recover from identified security incidents.

The entity authorises, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.

The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

The entity assesses and manages risks associated with vendors and business partners.

The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.

The entity authorises, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.

The entity tests recovery plan procedures supporting system recovery to meet its objectives.

The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.

The entity disposes of confidential information to meet the entity's objectives related to confidentiality.

The entity provides notice to data subjects about its privacy practices to meet its objectives related to privacy.

The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to data subjects, and obtains consent as required.