Sudory

Policies for information security

Review of the policies for information security

Information security roles and responsibilities

Segregation of duties

Contact with authorities

Contact with special interest groups

Information security in project management

Mobile device policy

Teleworking

Screening

Terms and conditions of employment

Management responsibilities

Information security awareness, education and training

Disciplinary process

Termination or change of employment responsibilities

Inventory of assets

Ownership of assets

Acceptable use of assets

Return of assets

Classification of information

Labelling of information

Handling of assets

Management of removable media

Disposal of media

Physical media transfer

Access control policy

Access to networks and network services

User registration and de-registration

User access provisioning

Management of privileged access rights

Management of secret authentication information of users

Review of user access rights

Removal or adjustment of access rights

Use of secret authentication information

Information access restriction

Secure log-on procedures

Password management system

Use of privileged utility programs

Access control to program source code

Policy on the use of cryptographic controls

Key management

Physical security perimeter

Physical entry controls

Securing offices, rooms and facilities

Protecting against external and environmental threats

Working in secure areas

Delivery and loading areas

Equipment siting and protection

Supporting utilities

Cabling security

Equipment maintenance

Removal of assets

Security of equipment and assets off-premises

Secure disposal or reuse of equipment

Unattended user equipment

Clear desk and clear screen policy

Documented operating procedures

Change management

Capacity management

Separation of development, testing and operational environments

Controls against malware

Information backup

Event logging

Protection of log information

Administrator and operator logs

Clock synchronization

Installation of software on operational systems

Management of technical vulnerabilities

Restrictions on software installation

Information systems audit controls

Network controls

Security of network services

Segregation in networks

Information transfer policies and procedures

Agreements on information transfer

Electronic messaging

Confidentiality or nondisclosure agreements

Information security requirements analysis and specification

Securing application services on public networks

Protecting application services transactions

Secure development policy

System change control procedures

Technical review of applications after operating platform changes

Restrictions on changes to software packages

Secure system engineering principles

Secure development environment

Outsourced development

System security testing

System acceptance testing

Protection of test data

Information security policy for supplier relationships

Addressing security within supplier agreements

Information and communication technology supply chain

Monitoring and review of supplier services

Managing changes to supplier services

Responsibilities and procedures

Reporting information security events

Reporting information security weaknesses

Assessment of and decision on information security events

Response to information security incidents

Learning from information security incidents

Collection of evidence

Planning information security continuity

Implementing information security continuity

Verify, review and evaluate information security continuity

Availability of information processing facilities

Identification of applicable legislation and contractual requirements

Intellectual property rights

Protection of records

Privacy and protection of personally identifiable information

Regulation of cryptographic controls

Independent review of information security

Compliance with security policies and standards

Technical compliance review