Skip to content

Latest commit

 

History

History
230 lines (161 loc) · 13.7 KB

7.md

File metadata and controls

230 lines (161 loc) · 13.7 KB
Raw

ISO 27001 - 7 - Support

7.1

Resources

The organization shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the information security management system.

Mapped SCF controls

7.2.a

Competence, part a)

The organization shall: determine the necessary competence of person(s) doing work under its control that affects its information security performance.

Mapped SCF controls

7.2.b

Competence, part b)

The organization shall: ensure that these persons are competent on the basis of appropriate education, training, or experience.

Mapped SCF controls

7.2.c

Competence, part c)

The organization shall: where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken. NOTE: Applicable actions can include, for example: the provision of training to, the mentoring of, or the reassignment of current employees; or the hiring or contracting of competent persons.

Mapped SCF controls

7.2.d

Competence, part d)

The organization shall: retain appropriate documented information as evidence of competence.

Mapped SCF controls

7.3.a

Awareness, part a)

Persons doing work under the organization’s control shall be aware of: the information security policy.

Mapped SCF controls

7.3.b

Awareness, part b)

Persons doing work under the organization’s control shall be aware of: their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance.

Mapped SCF controls

7.3.c

Awareness, part c)

Persons doing work under the organization’s control shall be aware of: the implications of not conforming with the information security management system requirements.

Mapped SCF controls

7.4.a

Communication, part a)

The organization shall determine the need for internal and external communications relevant to the information security management system including: on what to communicate.

Mapped SCF controls

7.4.b

Communication, part b)

The organization shall determine the need for internal and external communications relevant to the information security management system including: when to communicate.

Mapped SCF controls

7.4.c

Communication, part c)

The organization shall determine the need for internal and external communications relevant to the information security management system including: with whom to communicate.

Mapped SCF controls

7.4.d

Communication, part d)

The organization shall determine the need for internal and external communications relevant to the information security management system including: how to communicate.

Mapped SCF controls

7.5.1.a

Documented information - General, part a)

The organization’s information security management system shall include: documented information required by this document. NOTE The extent of documented information for an information security management system can differ from one organization to another due to: 1) the size of organization and its type of activities, processes, products and services; 2) the complexity of processes and their interactions; and 3) the competence of persons.

Mapped SCF controls

7.5.1.b

Documented information - General, part b)

The organization’s information security management system shall include: documented information determined by the organization as being necessary for the effectiveness of the information security management system. NOTE The extent of documented information for an information security management system can differ from one organization to another due to: 1) the size of organization and its type of activities, processes, products and services; 2) the complexity of processes and their interactions; and 3) the competence of persons.

Mapped SCF controls

7.5.2.a

Documented information - Creating and updating, part a)

When creating and updating documented information the organization shall ensure appropriate: identification and description (e.g. a title, date, author, or reference number).

Mapped SCF controls

7.5.2.b

Documented information - Creating and updating, part b)

When creating and updating documented information the organization shall ensure appropriate:format (e.g. language, software version, graphics) and media (e.g. paper, electronic).

Mapped SCF controls

7.5.2.c

Documented information - Creating and updating, part c)

When creating and updating documented information the organization shall ensure appropriate:review and approval for suitability and adequacy.

Mapped SCF controls

7.5.3.a

Documented information - Control, part a)

Documented information required by the information security management system and by this International Standard shall be controlled to ensure: it is available and suitable for use, where and when it is needed.

Mapped SCF controls

7.5.3.b

Documented information - Control, part b)

Documented information required by the information security management system and by this International Standard shall be controlled to ensure: it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

Mapped SCF controls

7.5.3.c

Documented information - Control, part c)

For the control of documented information, the organization shall address the following activities, as applicable: distribution, access, retrieval and use. NOTE Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information, etc.

Mapped SCF controls

7.5.3.d

Documented information - Control, part d)

For the control of documented information, the organization shall address the following activities, as applicable: storage and preservation, including the preservation of legibility.

Mapped SCF controls

7.5.3.e

Documented information - Control, part e)

For the control of documented information, the organization shall address the following activities, as applicable: control of changes (e.g. version control).

Mapped SCF controls

7.5.3.f

Documented information - Control, part f)

For the control of documented information, the organization shall address the following activities, as applicable: retention and disposition. Documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled.

Mapped SCF controls