ISO 27001 Controls Cheat Sheet

93 controls across 4 domains — extracted from your reference image

💡 Interview Tip: When asked about ISO 27001, map controls to the CIA Triad (Confidentiality, Integrity, Availability), cite specific control numbers (A.5–A.18), and describe how you would automate evidence collection for continuous monitoring.
93
Total Controls
23
Control Objectives
4
Control Themes
14
Clauses

🏢 Organizational Controls (11)

Focus: Governance & Management

📜 Information Security Policies (A.5)
  • A.5.1 — Management direction for information security
  • A.5.2 — Information security policies
  • Policies aligned with business objectives, reviewed annually, communicated to all staff
Policy-as-Code Version Control
🏛️ Organization of Information Security (A.6)
  • A.6.1 — Internal organization
  • A.6.2 — Mobile devices and teleworking
  • Roles defined (CISO, security officers), segregation of duties
RACI SoD
👤 Human Resource Security (A.7)
  • A.7.1 — Prior to employment (screening, terms)
  • A.7.2 — During employment (awareness, training, disciplinary)
  • A.7.3 — Termination / change of employment
  • NDAs, background checks, access revocation on exit
💼 Asset Management (A.8)
  • A.8.1 — Responsibility for assets
  • A.8.2 — Information classification
  • A.8.3 — Media handling
  • Asset inventory, data classification (Public/Internal/Confidential/Restricted)
🔐 Access Control (A.9)
  • A.9.1 — Business requirements of access control
  • A.9.2 — User access management
  • A.9.3 — User responsibilities
  • A.9.4 — System and application access control
  • Least privilege, MFA, RBAC, quarterly access reviews
🤝 Supplier Relationships (A.15)
  • A.15.1 — Information security in supplier relationships
  • A.15.2 — Supplier service delivery management
  • Due diligence, contracts with security clauses, monitoring
☁️ Cloud & Service Security (A.15 incl.)
  • Security requirements in service agreements
  • Monitoring, auditing, and reviewing supplier services
  • Change management controls for cloud services
🔄 Business Continuity (A.17)
  • A.17.1 — Information security aspects of business continuity
  • A.17.2 — Redundancies
  • RTO/RPO, disaster recovery plans, backup testing
🚨 Information Security Incident Management (A.16)
  • A.16.1 — Management of incidents
  • Detection, reporting, assessment, response, lessons learned
  • Escalation paths, evidence preservation
✅ Compliance (A.18)
  • A.18.1 — Legal, statutory, regulatory, and contractual requirements
  • A.18.2 — Information security reviews
  • GRC platform evidence, audit trails, policy reviews
🛡️ Privacy Protection (A.7–A.18 overlap)
  • Privacy by design, data minimization, consent management
  • DSAR handling, cross-border transfer mechanisms, DPO oversight

👤 People Controls (7)

Focus: People & Awareness

🔍 Screening

Background checks, reference verification, identity validation prior to granting access.

📄 Terms & Conditions

Security obligations in employment contracts, acceptable use policies.

🎓 Awareness & Training

Regular security awareness, role-specific training, phishing simulations.

⚠️ Disciplinary Process

Formal process for security violations, documented sanctions.

🚪 Post-Employment

Return of assets, access revocation, NDA enforcement on exit.

📝 NDAs

Confidentiality agreements, IP protection clauses, legal enforceability.

🏠 Remote Working

Secure home networks, device encryption, VPN enforcement, clear desk.

🏢 Physical Controls (14)

Focus: Physical Protection

🚧 PerimetersFences, gates, barriers, CCTV
🚪 Entry ControlsBadge access, biometrics, visitor logs
🏠 Secure OfficesLocks, secure areas, key management
🌪️ Environmental ThreatsFire, flood, HVAC monitoring
🔒 Secure AreasServer rooms, restricted zones
💻 Equipment SecurityAsset tagging, lockdown, inventory
🧹 Clear Desk/ScreenPolicy enforcement, privacy screens
♻️ Secure DisposalDegaussing, shredding, certified destruction
💾 Media HandlingUSB encryption, media storage, transfer controls
⚡ UtilitiesUPS, backup power, generator testing
🔌 Cabling SecurityConduits, labeling, tamper detection
🔧 MaintenanceVendor vetting, escorted access, logs
📦 Asset RemovalTransfer authorization, exit checks
📹 MonitoringCameras, guards, intrusion detection

💻 Technological Controls (34)

Focus: Technology & Systems

🌐 Network Security (A.13)
  • Network segmentation
  • Firewalls & IDS/IPS
  • VPN enforcement
  • Secure wireless (WPA3, certificates)
⚙️ Secure Configuration
  • Hardening baselines
  • CIS benchmarks
  • Unauthorized change detection
  • Configuration lockdown
🆔 Identity & Access Management
  • RBAC, ABAC
  • MFA enforcement
  • Privileged access management
  • JIT access
🛡️ Threat Protection
  • Antivirus/EDR
  • Email filtering
  • Web filtering
  • Zero-trust architecture
💾 Information Backup
  • 3-2-1 backup strategy
  • Encryption at rest
  • Recovery testing
  • Immutable backups
📊 Logging & Monitoring
  • Centralized SIEM
  • Retention policies
  • Alerting rules
  • Log integrity (WORM)
🔍 Vulnerability Management
  • Continuous scanning
  • Patch management SLAs
  • Penetration testing
  • Red team exercises
🔒 Data Security
  • DLP policies
  • Data classification
  • Masking/anonymization
  • Retention & disposal
🔑 Cryptography
  • AES-256 at rest
  • TLS 1.2+ in transit
  • Key rotation
  • HSM management
👨‍💻 Secure Development
  • SDL/SSDLC
  • Code review gates
  • SAST/DAST/SCA in CI/CD
  • Dependency scanning
🔄 Change Management
  • CAB approval
  • Test/UAT requirements
  • Rollback procedures
  • Change logs
📐 Capacity & Operations
  • Performance monitoring
  • Resource forecasting
  • Capacity thresholds
  • Operational runbooks
🏗️ System Acquisition
  • Security requirements
  • Vendor assessment
  • Acceptance testing
  • Transition controls
☁️ Cloud Security
  • CSPM (Cloud Security Posture)
  • IAM misconfig detection
  • Data residency
  • Shared responsibility clarity
📱 Endpoint Security
  • MDM enforcement
  • Disk encryption
  • Remote wipe
  • Device compliance

🎯 Benefits & Automation Opportunities

Business Benefits
  • Reduce information security risks
  • Protect data CIA (Confidentiality, Integrity, Availability)
  • Ensure legal and regulatory compliance
  • Increase customer and stakeholder trust
  • Enable business resilience and growth
Automatable Evidence Sources
  • A.9 / A.12: IAM APIs → quarterly access reviews
  • A.12: Vulnerability scans → patching SLA tracking
  • A.12.4: SIEM logs → log integrity (SHA-256 + WORM)
  • A.14: CI/CD pipeline → SAST/DAST/SCA evidence
  • A.18.1: Cloud config APIs → Policy-as-Code drift detection
🎤 Interview Takeaway

ISO 27001 is not a checkbox — it's a risk-based, continual improvement cycle (Plan-Do-Check-Act).