Preventive

The list of ISO 27001 Preventive Controls.

Preventive is an ISO 27001 Control Type.

The Control Type is an attribute that allows us to view controls from the perspective of when and how the control modifies a risk in relation to the timing of the occurrence of an information security incident.

ISO 27001 Annex A 8.34 Protection of information systems during audit testing

ISO 27001:2022 Annex A 8.34 Protection of Information Systems During Audit Testing: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.34 is a security control that ensures audit testing activities do not disrupt operational business processes or compromise data integrity. It mandates that all technical assessments be planned, authorized, and monitored, requiring strict access controls like read-only privileges to prevent accidental system downtime or unauthorized data exposure during security evaluations. In […]

ISO 27001:2022 Annex A 8.34 Protection of Information Systems During Audit Testing: The Lead Auditor’s Guide. Read More »

ISO 27001 attributes

ISO 27001 Attributes Explained

ISO 27001 Attributes Introduced in the 2022 update to the standard, in this ultimate guide to ISO 27001 Attributes you will learn What are ISO 27001 Attributes? ISO 27001 Attributes are a way to categorise, view and report on the ISO 27001 Annex A Controls. Why are ISO 27001 Attributes important? Attributes can be used

ISO 27001 Attributes Explained Read More »

ISO 27001 Annex A 8.33 Test Information

ISO 27001:2022 Annex A 8.33 Test Information: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.33 Test Information is a security control that mandates the protection of data used in testing environments. To ensure compliance, organizations must prioritize the use of synthetic or anonymized data rather than live PII. This approach mitigates risk, ensuring confidentiality and regulatory adherence while maintaining effective software development lifecycles. ISO 27001

ISO 27001:2022 Annex A 8.33 Test Information: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.32 Change Management

ISO 27001:2022 Annex A 8.32 Change Management : The Lead Auditor’s Guide.

ISO 27001 Annex A 8.32 Change Management is a security control that mandates formal procedures for modifying information processing facilities and systems. It ensures that changes are controlled, risk-assessed, and authorized to prevent service disruptions. This requirement guarantees a documented audit trail and preserves the confidentiality, integrity, and availability of data during updates. In this

ISO 27001:2022 Annex A 8.32 Change Management : The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments

ISO 27001:2022 Annex A 8.31 Separation of development, test and production environments

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments is a security control that mandates the logical isolation of operational stages to prevent unauthorized changes. The Primary Implementation Requirement is restricting developer write-access to live systems, ensuring the Business Benefit of system stability, data integrity, and reduced risk of operational failure. In

ISO 27001:2022 Annex A 8.31 Separation of development, test and production environments Read More »

ISO 27001 Annex A 8.30 Outsourced Development

ISO 27001:2022 Annex A 8.30 Outsourced development: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.30 Outsourced Development is a security control that mandates strict supervision of third-party vendors to ensuring they meet organizational security standards. The Primary Implementation Requirement is enforcing contractual security clauses and conducting independent verification, providing the Business Benefit of mitigating supply chain risks and preventing “backdoor” vulnerabilities. In this guide, I

ISO 27001:2022 Annex A 8.30 Outsourced development: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance

ISO 27001:2022 Annex A 8.29 Security testing in development and acceptance: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.29 is a security control that mandates the definition and implementation of security testing processes within the development lifecycle. By enforcing validation milestones during development and acceptance testing, organizations prevent vulnerabilities from reaching production, ensuring compliance and maximizing system integrity before go-live. In this guide, I will show you exactly how

ISO 27001:2022 Annex A 8.29 Security testing in development and acceptance: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.28 Secure Coding

ISO 27001:2022 Annex A 8.28 Secure Coding: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.28 is a security control that mandates the application of Secure Coding Principles throughout the software development lifecycle. By enforcing secure architecture, input validation, and secure memory management, organizations prevent vulnerabilities, ensuring system resilience and minimizing the risk of exploitation in production environments. In this guide, I will show you exactly

ISO 27001:2022 Annex A 8.28 Secure Coding: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles

ISO 27001:2022 Annex A 8.27 Secure systems architecture and engineering principles: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles is a security control that mandates organisations apply security by design standards throughout the entire system lifecycle. By documenting and enforcing engineering rules like Zero Trust and Defense in Depth, businesses ensure systems are intrinsically resilient against threats, preventing costly vulnerabilities before code is

ISO 27001:2022 Annex A 8.27 Secure systems architecture and engineering principles: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.26 Application Security Requirements

ISO 27001:2022 Annex A 8.26 Application security requirements: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.26 Application Security Requirements is a security control that mandates organizations identify, specify, and approve information security requirements before developing or acquiring software. By enforcing security early in the lifecycle, businesses ensure secure software development and prevent costly vulnerabilities, ensuring robust data protection and compliance. In this guide, I will show

ISO 27001:2022 Annex A 8.26 Application security requirements: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.25 Secure Development Life Cycle

ISO 27001:2022 Annex A 8.25 Secure development life cycle: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.25 is a security control that mandates the establishment of rules for the secure development of software and systems. It requires organizations to integrate security checkpoints into every phase of the engineering process, moving from reactive patching to a preventive Secure Software Development Life Cycle (SSDLC), ensuring that vulnerabilities are identified

ISO 27001:2022 Annex A 8.25 Secure development life cycle: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.24 Use of Cryptography

ISO 27001:2022 Annex A 8.24 Use of Cryptography: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.24 is a security control that mandates the establishment of rules for the effective use of cryptography and key management. It requires organizations to define policies for encryption to protect the confidentiality, integrity, and authenticity of information, ensuring data is secured at rest and in transit against unauthorized access. In this

ISO 27001:2022 Annex A 8.24 Use of Cryptography: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.23 Web Filtering

ISO 27001:2022 Annex A 8.23 Web Filtering: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.23 is a security control that requires organizations to manage access to external websites to reduce exposure to malicious content. By implementing technical restrictions on high-risk categories like gambling or malware hosting, this control ensures malware prevention and protects systems from drive-by downloads and unauthorized data exfiltration. In this guide, I

ISO 27001:2022 Annex A 8.23 Web Filtering: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.22 Segregation of Networks

ISO 27001:2022 Annex A 8.22 Segregation of Networks: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.22 is a security control that mandates the segregation of networks to restrict data flow between different trust zones. It requires organizations to implement logical or physical network boundaries, ensuring that a compromise in one segment (e.g., Guest Wi-Fi) cannot laterally spread to critical systems, thereby limiting the blast radius of

ISO 27001:2022 Annex A 8.22 Segregation of Networks: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.21 Security of Network Services

ISO 27001:2022 Annex A 8.21 Security of Network Services: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.21 is a security control that requires organizations to manage the security of services provided by networks, both internal and external. It mandates the identification and monitoring of service levels and security requirements (e.g., encryption, availability) within agreements to ensure that network services, such as ISPs or cloud connectivity, meet business

ISO 27001:2022 Annex A 8.21 Security of Network Services: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.20 Network Security

ISO 27001:2022 Annex A 8.20 Networks Security: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.20 is a security control that mandates the implementation of network security measures to protect information systems. It requires organizations to secure, manage, and control networks and devices by establishing network boundaries, managing traffic, and ensuring only authorized access, thereby safeguarding data confidentiality and integrity against unauthorized access or interception. In

ISO 27001:2022 Annex A 8.20 Networks Security: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.19 Installation of Software on Operational Systems

ISO 27001:2022 Annex A 8.19 Installation of Software on Operational Systems: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.19 is a security control that requires organizations to strictly govern the installation of software on operational systems to prevent malware and maintain stability. By implementing an Approved Software List (ASL) and removing local admin rights, this control ensures only authorized, licensed software runs in your environment, mitigating risks from shadow

ISO 27001:2022 Annex A 8.19 Installation of Software on Operational Systems: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs

ISO 27001:2022 Annex A 8.18 Use of Privileged Utility Programs: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.18 is a security control that mandates stringent restrictions on privileged utility programs—software capable of overriding system security controls. By limiting access to these powerful tools (like disk editors or packet sniffers) to authorized personnel only, organizations can prevent unauthorized changes, data leakage, and system instability, thereby protecting the integrity of

ISO 27001:2022 Annex A 8.18 Use of Privileged Utility Programs: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.14 Redundancy of Information Processing Facilities

ISO 27001:2022 Annex A 8.14 Redundancy of Information Processing Facilities: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.14 is a security control that mandates the implementation of redundancy in information processing facilities to ensure sufficient availability. It requires organizations to identify critical systems and deploy failover mechanisms (such as duplicate servers, network links, or power supplies) to guarantee continuous operation during disruptions and meet defined recovery time objectives.

ISO 27001:2022 Annex A 8.14 Redundancy of Information Processing Facilities: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.12 Data Leakage Prevention

ISO 27001:2022 Annex A 8.12 Data Leakage Prevention: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.12 is a security control designed to prevent the unauthorized extraction or disclosure of sensitive information. It requires organizations to implement data leakage prevention (DLP) measures across systems, networks, and devices to detect and block active leaks—whether accidental or malicious—thereby protecting data at rest, in transit, and in use. In this

ISO 27001:2022 Annex A 8.12 Data Leakage Prevention: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.11 Data Masking

ISO 27001:2022 Annex A 8.11 Data Masking: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.11 is a security control that mandates the use of data masking to obscure sensitive information such as PII or financial data. By implementing techniques like pseudonymization, anonymization, and redaction, this control ensures that sensitive data is only visible to authorized users, thereby minimizing the risk of data leaks and complying

ISO 27001:2022 Annex A 8.11 Data Masking: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.10 Information Deletion

ISO 27001:2022 Annex A 8.10 Information Deletion: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.10 is a preventative security control that mandates the secure deletion of information when it is no longer required. It requires organizations to implement methods such as secure erasure, crypto-shredding, or physical destruction to render data unrecoverable, ensuring compliance with data protection laws like GDPR and reducing the risk of unauthorized

ISO 27001:2022 Annex A 8.10 Information Deletion: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.9 Configuration Management

ISO 27001:2022 Annex A 8.9 Configuration Management: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.9 is a security control that requires organizations to define and maintain secure configuration baselines for all hardware, software, services, and networks. By enforcing documented standards and monitoring for unauthorized changes (configuration drift), this control ensures systems are “hardened” by default, preventing vulnerabilities caused by default settings or unpatched services. In

ISO 27001:2022 Annex A 8.9 Configuration Management: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities

ISO 27001:2022 Annex A 8.8 Management of Technical Vulnerabilities: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.8 is a security control that mandates the effective management of technical vulnerabilities within an organization’s infrastructure. Its primary requirement is the systematic identification, prioritization, and timely remediation of security flaws through patching or compensating controls. By strictly adhering to this framework, organizations achieve the business benefit of drastically reducing the

ISO 27001:2022 Annex A 8.8 Management of Technical Vulnerabilities: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.7 Protection Against Malware

ISO 27001:2022 Annex A 8.7 Protection Against Malware: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.7 Protection Against Malware is a security control that mandates a multi-layered defence strategy to prevent, detect, and recover from malicious software. It requires the implementation of Endpoint Detection and Response (EDR), automated updates, and user awareness training to ensure business continuity and data integrity across the organization. In this guide,

ISO 27001:2022 Annex A 8.7 Protection Against Malware: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.6 Capacity Management

ISO 27001:2022 Annex A 8.6 Capacity Management: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.6 Capacity Management is a security control that ensures organizations monitor and adjust resource usage to prevent system failures. It requires the monitoring of information processing facilities to maintain availability. The primary benefit is transforming reactive “fire-fighting” into proactive planning for future capacity requirements, ensuring business continuity. In this guide, I

ISO 27001:2022 Annex A 8.6 Capacity Management: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.5 Secure Authentication

ISO 27001:2022 Annex A 8.5 Secure Authentication: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.5 is a security control that mandates organizations implement secure authentication procedures to verify the identity of a user or entity before granting access. By adopting a risk-based approach and enforcing Multi-Factor Authentication (MFA), businesses effectively prevent unauthorized entry, ensuring data integrity and compliance with modern security standards. In this guide,

ISO 27001:2022 Annex A 8.5 Secure Authentication: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.4 Access To Source Code

ISO 27001:2022 Annex A 8.4 Access to Source Code: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.4 Access to Source Code is a security control that mandates organizations to strictly manage access to development environments. Its Primary Implementation Requirement involves enforcing read and write restrictions, version control, and authorization procedures to ensure a Business Benefit of protecting intellectual property and preventing unauthorized code changes or malicious backdoors.

ISO 27001:2022 Annex A 8.4 Access to Source Code: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.3 Information Access Restriction

ISO 27001:2022 Annex A 8.3 Information Access Restriction: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.3 Information Access Restriction is a security control that limits access to assets based on established policies. It enforces the Primary Implementation Requirement of technical restrictions to ensure users only access data necessary for their roles. This approach secures the Business Benefit of confidentiality and prevents unauthorised exposure. In this guide,

ISO 27001:2022 Annex A 8.3 Information Access Restriction: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.2 Privileged Access Rights

ISO 27001:2022 Annex A 8.2 Privileged Access Rights: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.2 Privileged Access Rights is a security control that mandates the strict restriction and management of administrative accounts to prevent unauthorized system changes. Organizations must implement a formal authorization process, ensure accountability for privileged actions, and strictly enforce the Principle of Least Privilege to mitigate insider threats and data breaches. In

ISO 27001:2022 Annex A 8.2 Privileged Access Rights: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 8.1 User Endpoint Devices

ISO 27001:2022 Annex A 8.1 User Endpoint Devices: The Lead Auditor’s Guide.

ISO 27001 Annex A 8.1 is a security control that mandates the protection of information stored on, processed by, or accessible via laptops, smartphones, and tablets. Its Primary Implementation Requirement involves deploying technical measures like full-disk encryption and malware protection. This secures the perimeter, delivering the Business Benefit of preventing data breaches across unmanaged remote

ISO 27001:2022 Annex A 8.1 User Endpoint Devices: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 7.14 Secure Disposal or Re-Use of Equipment

ISO 27001:2022 Annex A 7.14 Secure Disposal or Re-use of Equipment: The Lead Auditor’s Guide.

ISO 27001 Annex A 7.14 Secure Disposal or Re-use of Equipment is a security control that mandates the verification of storage media to ensure sensitive data and licensed software are securely overwritten or destroyed before hardware retirement. This process guarantees prevention of data leakage and maintains compliance with licensing agreements during the asset lifecycle termination

ISO 27001:2022 Annex A 7.14 Secure Disposal or Re-use of Equipment: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 7.13 Equipment Maintenance

ISO 27001:2022 Annex A 7.13 Equipment Maintenance : The Lead Auditor’s Guide.

ISO 27001 Annex A 7.13 Equipment Maintenance is a security control that mandates organisations maintain hardware according to manufacturer specifications to prevent unauthorized access and data loss. Implementing this control ensures the availability and integrity of information assets by securing equipment during on-site servicing and off-site repairs. In this guide, I will show you exactly

ISO 27001:2022 Annex A 7.13 Equipment Maintenance : The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 7.12 Cabling Security

ISO 27001:2022 Annex A 7.12 Cabling Security: The Lead Auditor’s Guide.

ISO 27001 Annex A 7.12 Cabling Security is a security control that mandates the physical protection of power and telecommunications lines to prevent unauthorized interception, interference, or damage. Ideally, organizations must ensure physical segregation of power and data cables to prevent corruption. This implementation safeguards the confidentiality and availability of information traversing the physical network

ISO 27001:2022 Annex A 7.12 Cabling Security: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 7.11 Supporting Utilities

ISO 27001:2022 Annex A 7.11 Supporting Utilities: The Lead Auditor’s Guide.

ISO 27001 Annex A 7.11 Supporting Utilities is a security control that mandates the protection of information processing facilities from power failures and environmental disruptions. To comply, organizations must implement redundant power supplies (UPS) and diverse utility routing, ensuring continuous availability of critical systems and preventing data corruption during outages. In this guide, I will

ISO 27001:2022 Annex A 7.11 Supporting Utilities: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 7.10 Storage media

ISO 27001:2022 Annex A 7.10 Storage Media: The Lead Auditor’s Guide.

ISO 27001 Annex A 7.10 Storage Media is a security control that mandates the lifecycle management of physical and removable drives to prevent data leakage. It requires organizations to implement mandatory encryption and secure disposal procedures, ensuring sensitive data on USBs and hard drives remains protected against theft, delivering the Business Benefit of verifiable data

ISO 27001:2022 Annex A 7.10 Storage Media: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 7.9 Security of assets off-premises

ISO 27001:2022 Annex A 7.9 Security of Assets Off-Premises: The Lead Auditor’s Guide.

ISO 27001 Annex A 7.9 Security of Assets Off-Premises is a security control that mandates the protection of hardware and information outside the organization’s physical perimeter. It requires risk-based safeguards, such as full-disk encryption and physical supervision, to prevent theft, loss, or unauthorized access, ensuring business continuity during remote work operations. In this guide, I

ISO 27001:2022 Annex A 7.9 Security of Assets Off-Premises: The Lead Auditor’s Guide. Read More »

ISO 27001 Annex A 5.36 Compliance with policies and standards for information security

ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.36 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy. I am Stuart Barker, an ISO 27001 Lead

ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security Read More »

ISO 27001 Annex A 5.22 Monitoring, review and change management of supplier services

ISO 27001:2022 Annex A 5.22 Monitoring, review and change management of supplier services

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.22 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy. I am Stuart Barker, an ISO 27001 Lead

ISO 27001:2022 Annex A 5.22 Monitoring, review and change management of supplier services Read More »

ISO 27001 Annex A 5.20 Addressing information security within supplier agreements

ISO 27001:2022 Annex A 5.20 Addressing information security within supplier agreements

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.20 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy. I am Stuart Barker, an ISO 27001 Lead

ISO 27001:2022 Annex A 5.20 Addressing information security within supplier agreements Read More »

Shopping Basket
Scroll to Top