27001:2013 controls

Question 1

A.[5-9]

Answer 1

A.5 Information security policies
A.6 Organization of information security
A.7 Human resource security
A.8 Asset management
A.9 Access control

Question 2

A.[10-14]

Answer 2

A.10 Cryptography
A.11 Physical and environmental security
A.12 Operations security
A.13 Communications security
A.14 System acquisition, development and maintenance

Question 3

A.[15-8]

Answer 3

A.15 Supplier relationships
A.16 Information security incident management
A.17 Information security aspects of business continuity management
A.18 Compliance

Question 4

A.5

Answer 4

ISP Information security policies
A.5.1 Management direction for information security
To provide 
management direction and support 
for information security 
in accordance with
business requirements 
and relevant laws 
and regulations.

Question 5

A.6

Answer 5

OIS Organization of information security
A.6.1 Internal organization
To establish a 
management framework 
to initiate and control 
the implementation and operation of 
information security 
within the organization.
A.6.2 Mobile devices and teleworking
To ensure 
the security of 
teleworking and use of mobile devices.

Question 6

A.7

Answer 6

HRS Human resource security
A.7.1 Prior to employment
To ensure that 
employees and contractors 
understand their responsibilities 
and are suitable for 
the roles for which they are considered.
A.7.2 During employment
To ensure that 
employees and contractors are 
aware of and fulfil their 
information security
responsibilities.
A.7.3 Termination and change of employment
To protect the 
organization’s interests 
as part of the process of 
changing or terminating employment.

Question 7

A.8

Answer 7

AM Asset management
A.8.1 Responsibility for assets
To identify organizational assets 
and define appropriate protection responsibilities
A.8.2 Information classification
To ensure that 
information receives 
an appropriate level of protection 
in accordance with 
its importance to the organization
A.8.3 Media handling
To prevent 
unauthorized 
   disclosure, 
   modification, 
   removal or 
   destruction 
of information
stored on media.

Question 8

A.9

Answer 8

AC Access control
A.9.1 Business requirements of access control
To limit access to 
information and 
information processing facilities.
A.9.2 User access management
To ensure 
authorized user access and 
to prevent unauthorized access to 
systems and services.
A.9.3 User responsibilities
To make 
users accountable for 
safeguarding their authentication information.
A.9.4 System and application access control
To prevent unauthorized access 
to systems and applications.

Question 9

A.10

Answer 9

C Cryptography
A.10.1 Cryptographic controls
To ensure 
proper and effective 
use of cryptography to 
protect the 
    confidentiality, 
    authenticity and/or 
    integrity of 
information.

Question 10

A.11

Answer 10

PES Physical and environmental security
A.11.1 Secure areas
To prevent 
unauthorized physical 
	access, 
	damage and 
	interference to the 
organization’s information and 
information processing facilities
A.11.2 Equipment
To prevent 
   loss, 
   damage, 
   theft or 
   compromise of 
assets and 
interruption to the organization’s operations.

Question 11

A.12

Answer 11

OS Operations security
A.12.1 Operational procedures and responsibilities
To ensure
correct and secure operations of 
information processing facilities.
A.12.2 Protection from malware
To ensure that 
information and information processing facilities are 
protected against malware.
A.12.3 Backup
To protect 
against loss of data.
A.12.4 Logging and monitoring
To record events and 
generate evidence.
A.12.5 Control of operational software
To ensure the 
integrity of operational systems
A.12.6 Technical vulnerability management
To prevent 
exploitation of technical vulnerabilities.
A.12.7 Information systems audit considerations
To minimise the 
impact of audit activities on 
operational systems.

Question 12

A.13

Answer 12

CS Communications security
A.13.1 Network security management
To ensure the
protection of information in networks and
its supporting information processing facilities.
A.13.2 Information transfer
To maintain the
security of information transferred
within an organization and with any external entity.

Question 13

A.14

Answer 13

SADM System acquisition, development and maintenance
A.14.1 Security requirements of information systems
To ensure that 
information security is 
an integral part of information systems
across the entire lifecycle.
This also includes the requirements for 
information systems 
which provide services
over public networks.
A.14.2 Security in development and support processes
To ensure that 
information security is 
designed and implemented 
within the development lifecycle of information systems.
A.14.3 Test data
To ensure the 
protection of data used for testing.

Question 14

A.15

Answer 14

SR Supplier relationships
A.15.1 Information security in supplier relationships
To ensure
protection of the organization’s assets that
is accessible by suppliers.
A.15.2 Supplier service delivery management
To maintain an
agreed level of
information security and service delivery
in line with supplier agreements.

Question 15

A.16

Answer 15

ISIM Information security incident management
A.16.1 Management of information security incidents and improvements
To ensure a
consistent and effective approach to the
management of information security incidents,
including communication on
security events and weaknesses.

Question 16

A.17

Answer 16

ISaBCM Information security aspects of business continuity management
A.17.1 Information security continuity
Information security continuity 
shall be embedded in 
the organization’s business continuity management systems.
A.17.2 Redundancies
To ensure 
availability of 
information processing facilities.

Question 17

A.18

Answer 17

Cmp Compliance
A.18.1 Compliance with legal and contractual requirements
To avoid 
breaches of 
	legal, 
	statutory, 
	regulatory or 
	contractual obligations 
related to 
information security and of 
any security requirements
A.18.2 Information security reviews
To ensure that 
information security is 
implemented and operated in 
accordance with the
organizational policies and 
procedures.