ISO/IEC DIS 27002

Information security, cybersecurity and privacy protection -- Information security controls

Titre manque

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
ISO/IEC DIS 27002
ISO/IEC JTC 1/SC 27 Secretariat: DIN
Voting begins on: Voting terminates on:
2021-01-28 2021-04-22
Information security, cybersecurity and privacy
protection — Information security controls
ICS: 35.030
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/IEC DIS 27002:2021(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. ISO/IEC 2021
---------------------- Page: 1 ----------------------
ISO/IEC DIS 27002:2021(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2021

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2021 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC DIS 27002:2021(E)
Contents Page

Foreword ........................................................................................................................................................................................................................................vi

0 Introduction ......................................................................................................................................................................................................................vii

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms, definitions and abbreviated terms ................................................................................................................................ 1

3.1 Terms and definitions ....................................................................................................................................................................... 1

3.2 Abbreviated terms ............................................................................................................................................................................... 6

4 Structure of this document ........................................................................................................................................................................ 7

4.1 Clauses ........................................................................................................................................................................................................... 7

4.2 Themes and attributes ..................................................................................................................................................................... 7

4.3 Control layout ........................................................................................................................................................................................... 8

5 Organizational controls ................................................................................................................................................................................. 9

5.1 Policies for information security ............................................................................................................................................. 9

5.2 Information security roles and responsibilities ......................................................................................................11

5.3 Segregation of duties ......................................................................................................................................................................12

5.4 Management responsibilities ..................................................................................................................................................13

5.5 Contact with authorities ..............................................................................................................................................................13

5.6 Contact with special interest groups ................................................................................................................................14

5.7 Threat intelligence ............................................................................................................................................................................15

5.8 Information security in project management ...........................................................................................................16

5.9 Inventory of information and other associated assets ......................................................................................18

5.10 Acceptable use of information and other associated assets .........................................................................20

5.11 Return of assets ...................................................................................................................................................................................21

5.12 Classification of information ....................................................................................................................................................21

5.13 Labelling of information ..............................................................................................................................................................23

5.14 Information transfer .......................................................................................................................................................................24

5.15 Access control .......................................................................................................................................................................................26

5.16 Identity management .....................................................................................................................................................................28

5.17 Authentication information ......................................................................................................................................................29

5.18 Access rights...........................................................................................................................................................................................31

5.19 Information security in supplier relationships ........................................................................................................32

5.20 Addressing information security within supplier agreements ..................................................................34

5.21 Managing information security in the ICT supply chain ..................................................................................36

5.22 Monitoring, review and change management of supplier services ........................................................38

5.23 Information security for use of cloud services .........................................................................................................39

5.24 Information security incident management planning and preparation ...........................................42

5.25 Assessment and decision on information security events .............................................................................44

5.26 Response to information security incidents ...............................................................................................................44

5.27 Learning from information security incidents .........................................................................................................45

5.28 Collection of evidence ....................................................................................................................................................................46

5.29 Information security during disruption .........................................................................................................................47

5.30 ICT readiness for business continuity..............................................................................................................................48

5.31 Identification of legal, statutory, regulatory and contractual requirements ..................................49

5.32 Intellectual property rights .......................................................................................................................................................51

5.33 Protection of records ......................................................................................................................................................................52

5.34 Privacy and protection of PII ...................................................................................................................................................53

5.35 Independent review of information security .............................................................................................................54

5.36 Compliance with policies and standards for information security.........................................................55

5.37 Documented operating procedures ...................................................................................................................................55

6 People controls ....................................................................................................................................................................................................56

6.1 Screening ...................................................................................................................................................................................................56

6.2 Terms and conditions of employment .............................................................................................................................58

© ISO/IEC 2021 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC DIS 27002:2021(E)

6.3 Information security awareness, education and training ...............................................................................59

6.4 Disciplinary process ........................................................................................................................................................................60

6.5 Responsibilities after termination or change of employment ....................................................................61

6.6 Confidentiality or non-disclosure agreements .........................................................................................................62

6.7 Remote working ..................................................................................................................................................................................63

6.8 Information security event reporting ..............................................................................................................................64

7 Physical controls ................................................................................................................................................................................................65

7.1 Physical security perimeter ......................................................................................................................................................65

7.2 Physical entry controls ..................................................................................................................................................................66

7.3 Securing offices, rooms and facilities ...............................................................................................................................68

7.4 Physical security monitoring ...................................................................................................................................................68

7.5 Protecting against physical and environmental threats ...................................................................................69

7.6 Working in secure areas ...............................................................................................................................................................70

7.7 Clear desk and clear screen.......................................................................................................................................................71

7.8 Equipment siting and protection .........................................................................................................................................72

7.9 Security of assets off-premises ..............................................................................................................................................73

7.10 Storage media .......................................................................................................................................................................................74

7.11 Supporting utilities ......... ..................................................................................................................................................................75

7.12 Cabling security ...................................................................................................................................................................................76

7.13 Equipment maintenance .............................................................................................................................................................77

7.14 Secure disposal or re-use of equipment .........................................................................................................................78

8 Technological controls ................................................................................................................................................................................79

8.1 User endpoint devices ...................................................................................................................................................................79

8.2 Privileged access rights ................................................................................................................................................................81

8.3 Information access restriction ...............................................................................................................................................82

8.4 Access to source code .....................................................................................................................................................................84

8.5 Secure authentication ....................................................................................................................................................................85

8.6 Capacity management ...................................................................................................................................................................86

8.7 Protection against malware ......................................................................................................................................................88

8.8 Management of technical vulnerabilities ......................................................................................................................89

8.9 Configuration management ......................................................................................................................................................92

8.10 Information deletion .......................................................................................................................................................................94

8.11 Data masking .........................................................................................................................................................................................95

8.12 Data leakage prevention ..............................................................................................................................................................97

8.13 Information backup .........................................................................................................................................................................98

8.14 Redundancy of information processing facilities ...................................................................................................99

8.15 Logging.....................................................................................................................................................................................................100

8.16 Monitoring activities ....................................................................................................................................................................103

8.17 Clock synchronization ................................................................................................................................................................105

8.18 Use of privileged utility programs ....................................................................................................................................105

8.19 Installation of software on operational systems ..................................................................................................106

8.20 Network controls ............................................................................................................................................................................108

8.21 Security of network services .................................................................................................................................................109

8.22 Web filtering ........................................................................................................................................................................................110

8.23 Segregation in networks ...........................................................................................................................................................111

8.24 Use of cryptography......................................................................................................................................................................112

8.25 Secure development lifecycle ...............................................................................................................................................114

8.26 Application security requirements ..................................................................................................................................115

8.27 Secure system architecture and engineering principles ...............................................................................117

8.28 Secure coding .....................................................................................................................................................................................119

8.29 Security testing in development and acceptance ................................................................................................121

8.30 Outsourced development .........................................................................................................................................................122

8.31 Separation of development, test and production environments ...........................................................123

8.32 Change management ...................................................................................................................................................................125

8.33 Test information ..............................................................................................................................................................................126

8.34 Protection of information systems during audit and testing ....................................................................127

Annex A (informative) Using attributes .....................................................................................................................................................128

iv © ISO/IEC 2021 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC DIS 27002:2021(E)

Annex B (informative) Correspondence with ISO/IEC 27002:2013 ..............................................................................138

Bibliography .........................................................................................................................................................................................................................145

© ISO/IEC 2021 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/IEC DIS 27002:2021(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical

activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work. In the field of information technology, ISO and IEC have established a joint technical committee,

ISO/IEC JTC 1.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for

the different types of document should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject

of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent

rights. Details of any patent rights identified during the development of the document will be in the

Introduction and/or on the ISO list of patent declarations received (see www .iso .org/ patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/

iso/ foreword .html.

This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology,

Subcommittee SC 27, Information security, cybersecurity and privacy protection.

This third edition cancels and replaces the second edition (ISO/IEC 27002:2013 +Corr 1:2014 +Corr2:

2015), which has been technically revised.
The main changes compared to the previous edition are as follows:

— The phrase “Code of Practice” has been dropped from the title of this document to better reflect its

purpose of being a reference set of information security controls. This is not a change of purpose. The

intention of ISO/IEC 27002 has always been to help organizations ensure that no necessary control

has been overlooked. This purpose is the same irrespective of the intended usage of this document

(see Clause 1). Notwithstanding this declaration, the guidance given for individual controls is based

on internationally recognized best practice.

— This purpose of being a reference set is achieved by ensuring comprehensive coverage of the varied

ways in which information security controls can be described. By design, this results in the overlaps

and duplications referred to in 0.3. For this reason, the structure of the document has been changed,

presenting the controls using a simple taxonomy and associated attributes.

— Some controls have been merged, some deleted and several new controls have been introduced. The

complete correspondence can be found in Annex B.

Any feedback or questions on this document should be directed to the user’s national standards body. A

complete listing of these bodies can be found at www .iso .org/ members .html.
vi © ISO/IEC 2021 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC DIS 27002:2021(E)
0 Introduction
0.1 Background and context

This document is designed for organizations of all types and sizes to be used as a reference for

determining and implementing controls for information security risk treatment in an Information

Security Management System (ISMS) based on ISO/IEC 27001. It can also be used as a guidance

document for organizations determining and implementing commonly accepted information security

controls. This document is also intended for use in developing industry and organization-specific

information security management guidelines, taking into consideration their specific information

security risk environment(s). Organizational or environment specific controls other than those included

in this document can be determined through risk assessment as necessary to modify risk.

Organizations of all types and sizes (including public and private sector, commercial and non-profit)

create, collect, process, store, transmit and dispose information in many forms including electronic,

physical and verbal (e.g. conversations and presentations).

The value of information goes beyond the written words, numbers and images: knowledge, concepts,

ideas and brands are examples of intangible forms of information. In an interconnected world,

information and other associated assets, like other important business interests, deserve or require

protection against various risk sources, whether natural, accidental or deliberate.

Information security is achieved by implementing a suitable set of controls, including policies, rules,

processes, procedures, organizational structures and software and hardware functions. To meet its

specific security and business objectives, the organization should define, implement, monitor, review

and improve these controls where necessary. An ISMS such as that specified in ISO/IEC 27001 takes a

holistic, coordinated view of the organization’s information security risks in order to determine and

implement a comprehensive suite of information security controls within the overall framework of a

coherent management system.

Many information systems, including their management and operations, have not been designed to be

secure in terms of an ISMS as specified in ISO/IEC 27001 and this document. The level of security that

can be achieved only through technological measures is limited and should be supported by appropriate

management activities and processes. Identifying which controls should be in place requires careful

planning and attention to detail while carrying out risk treatment.

A successful ISMS requires support from all personnel in the organization. It can also require

participation from other interested parties, such as shareholders or suppliers. Advice from subject

matter experts can also be needed.

A suitable, adequate and effective information security management system provides assurance to the

organization's management and other interested parties that their information and other associated

assets are maintained reasonably secure and protected against threats and harm, thereby enabling the

organization to achieve the stated business objectives.
0.2 Information security requirements

It is essential that an organization determines its security requirements. There are three main sources

of security requirements:

a) the assessment of risks to the organization, taking into account the organization’s overall business

strategy and objectives. This can be facilitated or supported through an information security

specific risk assessment. This should result in the determination of the controls necessary to

ensure that the residual risk to the organization meets its risk acceptance criteria;

b) the legal, statutory, regulatory and contractual requirements that an or
...