ISO27001 with ISMS

A.5.1, A.5.2, A.5.4, A.5.8 — Guidelines, roles, responsibilities and security in projects.

A.5.15, A.5.16, A.5.17, A.5.18 — Access control, identity management and access rights.

A.5.9, A.5.10, A.5.11, A.5.12, A.5.13 — Inventory, acceptable use, classification and labeling.

A.5.23 — Security in the use of cloud services.

A.5.19, A.5.20, A.5.21, A.5.22 — Relationships, agreements and the ICT supply chain.

A.5.24, A.5.25, A.5.26, A.5.27, A.5.28 — Preparation, assessment, response and evidence.

A.5.29, A.5.30 — Operational continuity and ICT readiness for disruptions.

A.5.3, A.5.5, A.5.6, A.5.31, A.5.32, A.5.35, A.5.36 — Legal and regulatory requirements and independent review.

A.5.34 — Protection of personal data and personally identifiable information.

A.5.14, A.5.33, A.5.37 — Information transfer, records and operating procedures.

A.6.1, A.6.2, A.6.4, A.6.5, A.6.6, A.6.7 — Screening, employment, discipline, termination and remote work.

A.6.3 — Information security training and awareness.

A.6.8 — Reporting of security events by staff.

A.7.1–A.7.14 — Perimeters, physical access, monitoring, equipment, media and secure disposal.

A.8.2, A.8.3, A.8.5, A.8.18 — Privileged access, restrictions and secure authentication.

A.8.1, A.8.7, A.8.8, A.8.19 — User devices, malware, vulnerabilities and software installation.

A.8.9, A.8.32 — Configuration management and change control.

A.8.10, A.8.11, A.8.12 — Information deletion, masking and data leakage prevention.

A.8.13 — Backup of critical business information.

A.8.6, A.8.14 — Capacity management and system redundancy.

A.8.15, A.8.16, A.8.17 — Logs, activity monitoring and clock synchronization.

A.8.20, A.8.21, A.8.22, A.8.23, A.8.24 — Networks, segmentation, web filtering and cryptography.

A.8.4, A.8.25, A.8.26, A.8.27, A.8.28, A.8.29, A.8.30, A.8.31, A.8.33 — Secure lifecycle and testing.