This section describes 37 controls that are mainly about information security governance:
-
- Control 5.1 – Policies for information security
- Control 5.2 – Information security roles and responsibilities
- Control 5.3 – Segregation of duties
- Control 5.4 – Management responsibilities
- Control 5.5 – Contact with authorities
- Control 5.6 – Contact with special interest groups
- Control 5.7 – Threat intelligence
- Control 5.8 – Information security in project management
- Control 5.9 – Inventory of information and other associated assets
- Control 5.10 – Acceptable use of information and other associated assets
- Control 5.11 – Return of assets
- Control 5.12 – Classification of information
- Control 5.13 – Labelling of information
- Control 5.14 – Information transfer
- Control 5.15 – Access control
- Control 5.16 – Identity management
- Control 5.17 – Authentication information
- Control 5.18 – Access rights
- Control 5.19 – Information security in supplier relationships
- Control 5.20 – Addressing information security within supplier agreements
- Control 5.21 – Managing information security in the ICT supply chain
- Control 5.22 – Monitoring, review and change management of supplier service
- Control 5.23 – Information security for use of cloud services
- Control 5.24 – Information security incident management planning and preparation
- Control 5.25 – Assessment and decision on information security events
- Control 5.26 – Response to information security incidents
- Control 5.27 – Learning from information security incidents
- Control 5.28 – Collection of evidence
- Control 5.29 – Information security during disruption
- Control 5.30 – ICT readiness for business continuity
- Control 5.31 – Legal, statutory, regulatory and contractual requirements
- Control 5.32 – Intellectual property rights
- Control 5.33 – Protection of records
- Control 5.34 – Privacy and protection of PII
- Control 5.35 – Independent review of information security
- Control 5.36 – Compliance with policies, rules and standards for information security
- Control 5.37 – Documented operating procedures
