New content
Consultant portal
Registration
Site identity
Stakeholders
CSR Strategy
- results
Please complete the questionnaire to refine the potential results
Type of content
Nature of content
Consequences

iso27001

Information Security Policies
A set of information security policies must be defined, approved by management, disseminated and communicated to employees and third parties concerned. ...
Information Security Policy Review
Policies must be reviewed at scheduled intervals or in the event of major changes to ensure their relevance, adequacy and effectiveness over time. ...
Information Security in Project Management
Information security must be considered in project management, regardless of the type of project involved. ...
Information Security Functions and Responsibilities
All information security responsibilities must be defined and assigned....
Segregation of duties
Incompatible tasks and areas of responsibility must be segregated to limit the possibility of unauthorized or unintentional modification or misuse of the organization’s assets....
Relations with the authorities
Appropriate relations with the competent authorities must be maintained....
Relationships with specialized working groups
Appropriate relationships with interest groups, safety forums and professional associations must be maintained. ...
Mobile Device Policy
A complementary security policy and measures shall be adopted to manage the risks arising from the use of mobile devices. ...
Telework Policy
A complementary security policy and measures shall be implemented to protect information accessed, processed or stored on telework sites. ...
Selection of candidates
Checks must be carried out on all candidates for employment in accordance with laws, regulations and ethics and be proportionate to the job requirements, the classification of accessible information and the risks identified. ...
Terms and conditions of employment
Contractual agreements between employees and subcontractors must specify their responsibilities and those of the organization with respect to information security. ...
Responsibilities of the management
Management must instruct all employees and subcontractors to apply the security rules in accordance with the policies and procedures in effect in the organization. ...
Information Security Awareness, Learning and Training
All employees of the organisation and, where relevant, Subcontractors must receive appropriate awareness and training and receive regular updates to the organization’s policies and procedures that apply to their duties. ...
Disciplinary process
There must be a formal disciplinary process known to all to take action against employees who have violated information security rules. ...
Completion or modification of responsibilities associated with the contract of employment
The responsibilities and tasks related to the security of information which remain valid after the termination, term or modification of the employment contract, must be defined, communicated to the employee or to the sub-processing, and applied. ...
Inventory of assets
The assets associated with the information and the means of processing the information must be identified and an inventory of these assets must be drawn up and kept up to date....
Ownership of assets
The inventory assets must be assigned to an owner....
Correct use of assets
The rules for the correct use of information, the assets associated with the information and the means of processing the information must be identified, documented and implemented....
Return of assets
All employees, contractors and third party users must return all assets of the organization in their possession at the end of the period of employment, contract or agreement....
Classification of information
Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification....
Marking of information
An appropriate set of procedures for marking information must be developed and implemented in accordance with the classification plan adopted by the organization....
Handling of assets
An appropriate set of procedures for marking information must be developed and implemented in accordance with the classification plan adopted by the organization....
Management of removable media
An appropriate set of procedures for marking information must be developed and implemented in accordance with the classification plan adopted by the organization....
Secure disposal or recycling of materials
All hardware components containing storage media must be checked to ensure that any sensitive data has been removed and that any licensed software has been securely uninstalled or overwritten, prior to disposal or reuse....
Physical transfer of media
Media containing information must be protected against unauthorized access, misuse and tampering during transport....
Access Control Policy
An access control policy shall be established, documented and reviewed based on business and information security requirements....
Access to networks and network services
Users must have access only to the network and services for which they have been specifically authorised....
User Registration and Unsubscribe
A formal user registration and de-registration process must be implemented to allow access rights to be granted....
Distribution of user access
A formal process for distributing user access must be implemented to allow access rights to all types of users across services and systems....
Management of privileges access rights
The assignment and use of privileges must be restricted and controlled....
Management of secret user authentication information
The assignment of secret authentication information must be carried out as part of a formal management process....
Review of user access rights
The assignment of secret authentication information must be carried out as part of a formal management process....
Removal or adaptation of access rights
The rights of access to information and the means of processing information of all employees and third-party users must be abolished at the end of their period of employment, or adapted in the event of a change in the contract or agreement....
Use of secret authentication information
Users must follow the organization’s practices for the use of secret authentication information....
Restriction of access to information
Access to information and system application functions must be restricted in accordance with the access control policy....
Secure the connection procedures
Where required by access control policy, access to systems and applications must be controlled by a secure login procedure....
Password Management System
.Systems that manage passwords must be interactive and must ensure the quality of passwords....
Using privileged utility programs
The use of utility programs to circumvent the measures of a system or application should be limited and closely monitored....
Using privileged utility programs
Access to the program source code must be restricted....
Policy on the Use of Cryptographic Measures
A policy for the use of cryptographic measures to protect information must be developed and implemented....
Key Management
A policy on the use, protection and life of cryptographic keys must be developed and implemented throughout their lifecycle....
Physical security perimeter
Security perimeters shall be defined and used to protect areas containing sensitive or critical information and means of information processing....
Physical access control
Secure areas must be protected by adequate controls at the entrance to ensure that only authorized personnel are admitted....
Securing offices, rooms and equipment
Physical security measures at offices, rooms and equipment must be designed and applied....
Protection against external and environmental threats
Physical protection measures against natural disasters, malicious attacks or accidents must be designed and implemented....
Working in secure areas
Procedures for working in secure areas should be designed and applied....
Delivery and loading areas
Access points such as delivery and unloading areas and other points through which unauthorized persons may enter the premises shall be controlled and, if possible, isolated from the means of processing the information, so as to avoid unauthorized access....
Location and protection of equipment
The equipment must be located and protected in a manner that minimizes the risks of environmental threats and hazards and opportunities for unauthorized access....
General services
Equipment must be protected from power outages and other disturbances due to a failure of the general services....
Security of the wiring
Electrical or telecommunications cables carrying data or supporting information services must be protected against interception or damage....
Maintenance of equipment
Equipment must be maintained properly to ensure its continued availability and integrity....
Disposal of assets
Equipment, information or software from the premises of the organisation must not be removed without prior authorisation....
Security of equipment and assets outside premises
Security measures must be applied to equipment used outside the premises of the organisation, taking into account the different risks associated with off-site work....
User equipment left unattended
Users must ensure that unattended equipment is properly protected....
Clean Desktop and Locked Screen Policy
A clean office policy for paper documents and removable storage media, and a locked screen policy for information processing means must be adopted....
Documented Operating Procedures
Operating procedures shall be documented and made available to all affected users....
Change Management
Changes to the organization, business processes, systems and means of processing information that affect the security of information must be controlled....
Sizing
Resource utilization shall be monitored and adjusted and projections of future design sizes shall be made to ensure the required system performance....
Separation of development, test and operating equipment
The development, testing and operating environments must be segregated to reduce the risk of unauthorized access or change in the operating environment....
Measures against malicious software
Detection, prevention and recovery measures, together with appropriate user awareness, must be implemented to protect against malware....
Backup of the information
Backup copies of information, software and system images must be made and tested regularly in accordance with an agreed backup policy....
Logging of events
Event logs recording user activities, exceptions, failures and security-related events must be created, maintained and verified regularly....
Protection of logged information
The means of logging and logged information must be protected against the risk of unauthorized falsification or access....
Administrator and Operator Logs
System Administrator and System Operator activities must be logged, protected and verified regularly....
Synchronization of clocks
The clocks of all relevant information processing systems of an organisation or security domain shall be synchronized using a single time reference source....
Installing software on operating systems
Procedures must be in place to control the installation of software on operating systems....
Management of technical vulnerabilities
Information on technical vulnerabilities of operating information systems must be obtained in a timely manner, the organization’s exposure to these vulnerabilities must be assessed and appropriate actions taken to address the associated risk....
Restrictions related to software installation
Rules governing the installation of software by users must be established and implemented....
Measures relating to the audit of information systems
Audit requirements and activities involving audits on operating systems must be carefully planned and validated to minimize disruptions to business processes....
Control of networks
Networks must be managed and controlled to protect information contained in systems and applications....
Security of network services
For all network services, security mechanisms, service levels and management requirements, must be identified and incorporated into network service agreements, whether these services are provided in-house or outsourced....
Partitioning of networks
The groups of information services, users and information systems must be separated on the networks....
Information Transfer Policies and Procedures
Formal policies, procedures and transfer measures must be in place to protect information transfers through all types of telecommunications equipment....
Information Transfer Agreements
Agreements must address the secure transfer of activity-related information between the organization and third parties....
Electronic Messaging
Information passing through electronic messaging must be appropriately protected....
Confidentiality or non-disclosure agreements
Confidentiality or non-disclosure commitment requirements must be identified, verified regularly and documented in accordance with the needs of the organization....
Analysis and specification of information security requirements
Information security requirements must be incorporated into the requirements of new information systems or enhancements to existing information systems....
Securing application services on public networks
Information related to enforcement services transmitted on public networks must be protected against fraudulent activities, contractual disputes, and unauthorized disclosure and modification....
Protection of Enforcement Services Transactions
The information involved in transactions related to application services must be protected to prevent incomplete transmission, routing errors, unauthorized modification, unauthorized disclosure, unauthorized duplication of the message or its re-issue....
Secure Development Policy
Software and system development rules must be established and applied to organizational developments....
System Change Control Procedures
System changes within the development cycle should be controlled through formal procedures....
Technical review of applications after operating platform change
When changes are made to the operating platforms, business critical applications must be verified and tested to ensure that there are no adverse effects on the activity or security....
Restrictions on changes to software packages
Modifications to software packages should not be encouraged, limited to necessary changes and any changes should be strictly controlled....
Systems Safety Engineering Principles
System security engineering principles shall be established, documented, maintained and applied to all information system implementation work....
Secure development environment
Organisations should establish secure development environments for system development and integration tasks that encompass the entire development life cycle of the system, and ensure appropriate protection...
Outsourced development
The organization must supervise and control the development activity of the outsourced system....
System Safety Test
Security functionality tests must be performed during development...
System Compliance Test
Compliance testing programs and associated criteria should be determined for new information systems, updates and releases....
Protection of test data
Test data must be carefully selected, protected and controlled....
Information Security Policy in Supplier Relations
Information security requirements to mitigate risks resulting from suppliers accessing the organization’s assets must be accepted by the supplier and documented....
Security in agreements with suppliers
The applicable information security requirements must be established and agreed with each available provider, Process, store, communicate or provide components of the IT infrastructure for the information of the organization....
IT products and services supply chain
Supplier agreements must include requirements for the handling of information security risks associated with the supply chain of IT products and services....
Supplier Service Monitoring and Review
Organizations must monitor, audit and regularly audit the provision of services by providers....
Managing changes in supplier services
Changes in supplier service provision, including the maintenance and improvement of existing information security policies, procedures and measures, must be managed taking into account the critical nature of the relevant information, systems and processes and the recurrence of risks....
Responsibilities and Procedures
Responsibilities and procedures to ensure a timely, effective and relevant response must be established in the event of an information security incident....
Reporting information security events
Information security events must be reported, as soon as possible, through the appropriate reporting channels....
Reporting information security vulnerabilities
Information security events must be reported, as soon as possible, through the appropriate reporting channels....
Assessment of information security events and decision-making
Information security events must be assessed and decided if they are to be classified as information security incidents....
Response to Information Security Incidents
Information security incidents must be handled in accordance with documented procedures....
Learning from Information Security Incidents
The knowledge gathered through the analysis and resolution of incidents should be used to reduce the likelihood or impact of subsequent incidents....
Collection of evidence
The organization must define and implement procedures for identifying, collecting, acquiring and protecting information that can be used as evidence....
Organization of Information Security Continuity
The organization must determine its information security and information security management continuity requirements in adverse situations, such as during a crisis or disaster....
Implementation of Information Security Continuity
The organization shall establish, document, implement and maintain processes, procedures and measures to provide the required level of information security continuity during an adverse situation....
Verify, review and assess information security continuity
The organization should verify information security continuity measures implemented at regular intervals to ensure that they are valid and effective in adverse situations....
Availability of information processing facilities
Means of processing information must be implemented with sufficient redundancy to meet availability requirements....
Verification of technical compliance
Information systems should be reviewed on a regular basis for compliance with the organization’s information security policies and standards....
Identification of applicable legislation and contractual requirements
All applicable legal, statutory, regulatory and contractual requirements, as well as the approach taken by the organization to meet those requirements, must be explicitly defined, documented and updated for each information system and for the organization itself....
Intellectual property rights
Appropriate procedures shall be implemented to ensure compliance with legal, regulatory and contractual requirements relating to intellectual property and the use of proprietary software licenses....
Protection of records
Records must be protected from loss, destruction, tampering, unauthorized access and unauthorized releases, in accordance with legal, regulatory, contractual and business requirements....
Protection of privacy and personal data
The protection of privacy and the protection of personal data must be guaranteed as required by applicable legislation or regulations, and contractual clauses where appropriate...
Cryptographic Measurement Regulations
Cryptographic measures must be taken in accordance with applicable agreements, laws and regulations....
Independent review of information security
Regular and independent reviews of the organization’s approach to managing and implementing information security (i.e., monitoring of security objectives, information security measures, policies, procedures and processes) must be carried out at defined intervals or when significant changes have oc...
Compliance with security policies and standards
Officials must regularly check the compliance of the processing of information and the procedures for which they are responsible with the relevant policies, security standards and other security requirements....
Disposal of Media
Media that are no longer needed must be disposed of securely, following formal procedures....
Calculation in progress...