Please read through the assesment instructions before starting. Thanks !  

  
Framework Sections, Control Objectives, Controls & Tests  
Section  	5 Security Policy Management 	
   
  	Control Objective  	IS5.1 	5.1 Provide management direction and support 	 	
  	Objective: To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.
Management should define a set of policies to clarify their direction of, and support for, information security.
At the top level, there should be an overall "information security policy" as specified in ISO/IEC 27001 section 5.2.  	
  	
  	Control 	IS5.1.1 	Develop your information security policies 	
  	A set of policies for information security shall be defined, approved by management, published and communicated to employees and relevant external parties. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS5-T4 	Validate existence of a security policy 	Does your organization have an information security policy that has been approved by management? => A published policy that has been approved by upper management needs to be available. 	 	
  	IS5.1-T5 	Check communication of the security policy 	Has it been published and communicated to all relevant parties?  => Is it freely available on a website, handbook, or is it shared with employees when they are first hired? 	 	
  	
  	Control 	IS5.1.2 	Review your information security policies 	
  	The policies for information security shall be reviewed at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS5.1.2-T6 	Control information policy review practices 	Does your organization review the policy at defined intervals to encompass significant change and monitor for compliance? => Do you audit the policy as well as audit against it during a defined interval? 	 	
  	
Section  	6 Corporate Security Management 	
   
  	Control Objective  	IS6.1 	6.1 Establish an internal information security organization 	 	
  	Objective: To establish a management framework to initiate and control the implementation and operation of information security within the organization.
The organization should lay out the roles and responsibilities for information security, and allocate them to individuals. Where relevant, duties should be segregated across roles and individuals to avoid conflicts of interest and prevent inappropriate activities. There should be contacts with relevant external authorities (such as CERTs and special interest groups) on information security matters. Information security should be an integral part of the management of all types of project. 	

  	Control Objective  	IS6.2 	6.2 Protect the organization's mobile devices and telework 	 	
  	Objective: To ensure the security of teleworking and use of mobile devices.
There should be security policies and controls for mobile devices (such as laptops, tablet PCs, wearable ICT devices, smartphones, USB gadgets and other Boys' Toys) and teleworking (such as telecommuting, working-from home, road-warriors, and remote/virtual workplaces). 	
  	
Section  	7 Personnel Security Management 	
   
  	Control Objective  	IS7.1 	7.1 Emphasize security prior to employment 	 	
  	Objective: To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.
Information security responsibilities should be taken into account when recruiting permanent employees, contractors and temporary staff (e.g. through adequate job descriptions, pre-employment screening) and included in contracts (e.g. terms and conditions of employment and other signed agreements defining security roles and responsibilities, compliance obligations etc.). 	

  	Control Objective  	IS7.2 	7.2 Emphasize security during employment 	 	
  	Objective: To ensure that employees and contractors are aware of and fulfil their information security responsibilities.
Managers should ensure that employees and contractors are made aware of and motivated to comply with their information security obligations. A formal disciplinary process is necessary to handle information security incidents allegedly caused by workers. 	
  	
  	Control 	IS7.2.1 	Expect your managers to emphasize security 	
  	Management shall require all employees and contractors to apply information security in accordance with the established policies and procedures of the organization. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS7.2.1-T14 	Check if Management fosters security awareness 	Do all individuals interacting with business systems receive information security awareness training? => Online, in person, or a combination of events, newsletters, e-mails, etc., with security awareness training. Threshold is defined by organization and compliance requirements. 	 	
  	
  	Control 	IS7.2.2 	Deliver information security awareness programs 	
  	All employees of the organization and, where relevant, contractors shall receive appropriate awareness education and training and regular updates in organizational policies and procedures, as relevant for their job function.  => Online, in person, or a combination of events, newsletters, e-mails, etc., with security awareness
training. Threshold is defined by organization and compliance requirements. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS7.2.2-T15 	Check depth of security training 	Does your organization conduct specialized role-based training? => For example, PCI training for cashiers. 	 	
  	IS7.2.2-T16 	Check completeness of security awareness programs 	Do the information security programs clearly state responsibilities, liabilities, and consequences? => Are employee responsibilities, liabilities (impediments to successfully carrying out responsibilities), and penalties for noncompliance clearly outlined and communicated? 	 	
  	
  	Control 	IS7.2.3 	Set up a disciplinary process for security breaches 	
  	There shall be a formal and communicated disciplinary process in place to take action against employees who have committed an information security breach. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS7.2.3-T202 	Check effectiveness of disciplinary process 	Embedded in test IS7.2.2-T16. 	 	

  	Control Objective  	IS7.3 	7.3 Emphasize security at termination and change of employment 	 	
  	Objective: To protect the organization's interests as part of the process of changing or terminating employment.
Security aspects of a person's departure from the organization, or significant changes of roles within it, should be managed, such as returning corporate information and equipment in their possession, updating their access rights, and reminding them of their ongoing obligations under privacy and intellectual property laws, contractual terms etc. plus ethical expectations. 	
  	
Section  	8 Organizational Asset Management 	
   
  	Control Objective  	IS8.1 	8.1 Establish responsibility for corporate assets 	 	
  	Objective: To identify organizational assets and define appropriate protection responsibilities.
All information assets should be inventoried and owners should be identified to be held accountable for their security. 'Acceptable use' policies should be defined, and assets should be returned when people leave the organization. 	
  	
  	Control 	IS8.1.1 	Compile an inventory of assets associated with information 	
  	Assets associated with information and information processing facilities shall be identified and an inventory of these assets shall be drawn up and maintained. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS8.2.1-T20 	Information classification definition and use 	Does your organization classify information to indicate the appropriate levels of information security? => Agreed-upon classifications (for example, confidential, official-use only, and unrestricted) are defined and applied. 	 	
  	IS8.1.1-T19 	Information assets and business impact analysis 	Has your organization identified critical information assets and the functions that rely on them? => This question is looking at whether a formal or informal business impact analysis has occurred. Has anyone in the organization identified information assets that are considered essential to the business and the systems that support them, for continuity or otherwise. 	 	
  	
  	Control 	IS8.1.2 	Select owners for all assets associated with your information 	
  	Assets maintained in the inventory shall be owned. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS8.1.2-T203 	Verify information asset ownership 	Verify that the policy for asset classification and ownership supports the protection of information assets and facilitates effective security decision making. => Agreed-upon classifications (for example, confidential, official-use only, and unrestricted) are defined and applied 	 	
  	
  	Control 	IS8.1.3 	Prepare acceptable use rules for assets associated with information 	
  	Rules for the acceptable use of information and of assets associated with information and information processing facilities shall be identified, documented and implemented. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS8.1.3.T204 	Check existance and depth of an acceptable use policy 	Does your organization have a set of rules in place to protect personnel and the organization? => Inappropriate asset use may expose the organization to risks including virus attacks, data leakage, compromise of network systems and services, compliance and legal issues. 	 	
  	
  	Control 	IS8.1.4 	Return all assets associated with information upon termination 	
  	All employees and external party users shall return all of the organizational assets in their possession upon termination of their employment, contract or agreement. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	IS7.3.1-T17 	Validate the off-boarding process 	Does your organization have a process for revoking system and building access and returning assigned assets? => For example, an off-boarding process that requires sign-off and debrief. 	 	

  	Control Objective  	IS8.2 	8.2 Develop an information classification scheme 	 	
  	Objective: To ensure that information receives an appropriate level of protection in accordance with its importance to the organization.
Information should be classified and labelled by its owners according to the security protection needed, and handled appropriately. 	

  	Control Objective  	IS8.3 	8.3 Control how physical media are handled 	 	
  	Objective: To prevent unauthorized disclosure, modification, removal or destruction of information stored on media.
Information storage media should be managed, controlled, moved and disposed of in such a way that the information content is not compromised. 	
  	
Section  	9 Information Access Management 	
   
  	Control Objective  	IS9.1 	9.1 Respect business requirements 	 	
  	Objective: To limit access to information and information processing facilities.
The organization's requirements to control access to information assets should be clearly documented in an access control policy and procedures. Network access and connections should be restricted. 	

  	Control Objective  	IS9.2 	9.2 Manage all user access rights 	 	
  	Objective: To ensure authorized user access and to prevent unauthorized access to systems and services.
The allocation of access rights to users should be controlled from initial user registration through to removal of access rights when no longer required, including special restrictions for privileged access rights and the management of passwords (now called "secret authentication information") plus regular reviews and updates of access rights. 	

  	Control Objective  	IS9.3 	9.3 Protect user authentication 	 	
  	Objective: To make users accountable for safeguarding their authentication information.
Users should be made aware of their responsibilities towards maintaining effective access controls e.g. choosing strong passwords and keeping them confidential. 	

  	Control Objective  	IS9.4 	9.4 Control access to systems 	 	
  	Objective: To prevent unauthorized access to systems and applications.
Information access should be restricted in accordance with the access control policy e.g. through secure log-on, password management, control over privileged utilities and restricted access to program source code. 	
  	
Section  	10 Cryptography Policy Management 	
   
  	Control Objective  	IS10.1 	10.1 Control the use of cryptographic controls and keys 	 	
  	Objective: To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information.
There should be a policy on the use of encryption, plus cryptographic authentication and integrity controls such as digital signatures and message authentication codes, and cryptographic key management. 	
  	
Section  	11 Physical Security Management 	
   
  	Control Objective  	IS11.1 	11.1 Establish secure areas to protect assets 	 	
  	Objective: To prevent unauthorized physical access, damage and interference to the organization’s information and information processing facilities.
Defined physical perimeters and barriers, with physical entry controls and working procedures, should protect the premises, offices, rooms, delivery/loading areas etc. against unauthorized access. Specialist advice should be sought regarding protection against fires, floods, earthquakes, bombs etc. 	

  	Control Objective  	IS11.2 	11.2 Protect the organization's equipment 	 	
  	Objective: To prevent loss, damage, theft or compromise of assets and interruption to the organization's operations.
"Equipment" (meaning ICT equipment, mostly) plus supporting utilities (such as power and air conditioning) and cabling should be secured and maintained. Equipment and information should not be taken off-site unless authorized, and must be adequately protected both on and off-site. Information must be destroyed prior to storage media being disposed of or re-used. Unattended equipment must be secured and there should be a clear desk and clear screen policy. 	
  	
Section  	12 Operational Security Management 	
   
  	Control Objective  	IS12.1 	12.1 Establish operational procedures and responsibilities 	 	
  	Objective: To ensure correct and secure operations of information processing facilities.
IT operating responsibilities and procedures should be documented. Changes to IT facilities and systems should be controlled. Capacity and performance should be managed. Development, test and operational systems should be separated. 	

  	Control Objective  	IS12.2 	12.2 Protect the organization from malware 	 	
  	Objective: To ensure that information and information processing facilities are protected against malware.
Malware controls are required, including user awareness. 	

  	Control Objective  	IS12.3 	12.3 Make backup copies on a regular basis 	 	
  	Objective: To protect against loss of data.
Appropriate backups should be taken and retained in accordance with a backup policy. 	

  	Control Objective  	IS12.4 	12.4 Use logs to record security events 	 	
  	Objective: To record events and generate evidence.
System user and administrator/operator activities, exceptions, faults and information security events should be logged and protected. Clocks should be synchronized. 	

  	Control Objective  	IS12.5 	12.5 Control the organization's operational software 	 	
  	Objective: To ensure the integrity of operational systems.
Software installation on operational systems should be controlled. 	

  	Control Objective  	IS12.6 	12.6 Address technical vulnerabilities 	 	
  	Objective: To prevent exploitation of technical vulnerabilities.
Technical vulnerabilities should be patched, and there should be rules in place governing software installation by users. 	

  	Control Objective  	IS12.7 	12.7 Minimize the impact of audit activitities 	 	
  	Objective: To minimise the impact of audit activities on operational systems.
IT audits should be planned and controlled to minimize adverse effects on production systems, or inappropriate data access. 	
  	
Section  	13 Network Security Management 	
   
  	Control Objective  	IS13.1 	13.1 Protect networks and facilities 	 	
  	Objective: To ensure the protection of information in networks and its supporting information processing facilities.
Networks and network services should be secured, for example by segregation. 	

  	Control Objective  	IS13.2 	13.2 Protect information transfers 	 	
  	Objective: To maintain the security of information transferred within an organization and with any external entity.
There should be policies, procedures and agreements (e.g. non-disclosure agreements) concerning information transfer to/from third parties, including electronic messaging. 	
  	
Section  	14 System Security Management 	
   
  	Control Objective  	IS14.1 	14.1 Make security an inherent part of information systems 	 	
  	Objective: To ensure that information security is an integral part of information systems across the entire lifecycle. This also includes the requirements for information systems which provide services over public networks.
Security control requirements should be analyzed and specified, including web applications and transactions. 	

  	Control Objective  	IS14.2 	14.2 Protect and control system development activities 	 	
  	Objective: To ensure that information security is designed and implemented within the development lifecycle of information systems.
Rules governing secure software/systems development should be defined as policy. Changes to systems (both applications and operating systems) should be controlled. Software packages should ideally not be modified, and secure system engineering principles should be followed. The development environment should be secured, and outsourced development should be controlled. System security should be tested and acceptance criteria defined to include security aspects. 	

  	Control Objective  	IS14.3 	14.3 Safeguard data used for system testing purposes 	 	
  	Objective: To ensure the protection of data used for testing.
Test data should be carefully selected/generated and controlled. 	
  	
Section  	15 Supplier Relationship Management 	
   
  	Control Objective  	IS15.1 	15.1 Establish security requirements with suppliers 	 	
  	Objective: To ensure protection of the organization’s assets that is accessible by suppliers.
There should be policies, procedures, awareness etc. to protect the organization's information that is accessible to IT outsourcers and other external suppliers throughout the supply chain, agreed within the contracts or agreements. 	

  	Control Objective  	IS15.2 	15.2 Manage supplier security and service delivery 	 	
  	Objective: To maintain an agreed level of information security and service delivery in line with supplier agreements.
Service delivery by external suppliers should be monitored, and reviewed/audited against the contracts/agreements. Service changes should be controlled. [Exactly the same point applies to services delivered by internal suppliers, by the way!] 	
  	
Section  	16 Security Incident Management 	
   
  	Control Objective  	IS16.1 	16.1 Identify and respond to information security incidents 	 	
  	Objective: To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.
There should be responsibilities and procedures to manage (report, assess, respond to and learn from) information security events, incidents and weaknesses consistently and effectively, and to collect forensic evidence. 	
  	
Section  	17 Security Continuity Management 	
   
  	Control Objective  	IS17.1 	17.1 Establish information security continuity controls 	 	
  	Objective: Information security continuity shall be embedded in the organization’s business continuity management systems.
The continuity of information security should be planned, implemented and reviewed as an integral part of the organization's business continuity management systems. 	

  	Control Objective  	IS17.2 	17.2 Build redundancies into information processing facilities 	 	
  	Objective: To ensure availability of information processing facilities.
IT facilities should have sufficient redundancy to satisfy availability requirements. 	
  	
Section  	18 Security Compliance Management 	
   
  	Control Objective  	IS18.1 	18.1 Comply with legal security requirements 	 	
  	Objective: To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements.
The organization must identify and document its obligations to external authorities and other third parties in relation to information security, including intellectual property, [business] records, privacy/personally identifiable information and cryptography. 	

  	Control Objective  	IS18.2 	18.2 Carry out security compliance reviews 	 	
  	Objective: To ensure that information security is implemented and operated in accordance with the organizational policies and procedures.
The organization's information security arrangements should be independently reviewed (audited) and reported to management. Managers should also routinely review employees' and systems' compliance with security policies, procedures etc. and initiate corrective actions where necessary.