Compliance FrameworksInternational
ISO/IEC 27001
Information security management: inventory, vulnerability management, supplier security controls.
Information security management: inventory, vulnerability management, supplier security controls.
| Short name | ISO 27001 |
| Region | International |
| Country or scope | International |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 27001
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 22 controls from Safeguard's control catalog for ISO 27001.
- Automated tests: 850 map to its controls, and 360 connectors provide automated evidence for them. See ISO/IEC 27001 and connectors.
- Policy templates: 27: 6 written for ISO 27001 and 21 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO27001-A5.9 Inventory of Assets | An inventory of information and other associated assets, including software, must be developed and maintained (ISO/IEC 27001:2022 Annex A 5.9) | Scan |
ISO27001-A8.8 Management of Technical Vulnerabilities | Information about technical vulnerabilities of systems in use must be obtained and evaluated, which requires components to be identifiable against vulnerability databases (ISO/IEC 27001:2022 Annex A 8.8) | Scan |
ISO27001-A5.21 ICT Supply Chain Security | Information security risks in the ICT products and services supply chain must be managed, which presupposes knowing the supplier of each software component (ISO/IEC 27001:2022 Annex A 5.21) | Scan |
ISO27001-A8.9 Configuration Management | Configurations of software must be established, documented and monitored, requiring version information for the software in use (ISO/IEC 27001:2022 Annex A 8.9) | Scan |
ISO27001-A8.19 Control of Operational Software | Installation of software on operational systems must be securely managed, supported by the ability to verify component integrity via hashes (ISO/IEC 27001:2022 Annex A 8.19) | Scan |
ISO27001-A5.32 Intellectual Property Rights | Procedures must ensure compliance with intellectual property rights and use of proprietary software, requiring license information for components (ISO/IEC 27001:2022 Annex A 5.32) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
A.5.1 | Policies for Information Security |
A.5.7 | Threat Intelligence |
A.5.9 | Inventory of Information and Other Associated Assets |
A.5.10 | Acceptable Use of Information and Other Associated Assets |
A.5.15 | Access Control |
A.5.19 | Information Security in Supplier Relationships |
A.5.23 | Information Security for Use of Cloud Services |
A.5.30 | ICT Readiness for Business Continuity |
A.5.34 | Privacy and Protection of Personal Identifiable Information |
A.6.1 | Screening |
A.6.3 | Information Security Awareness, Education and Training |
A.7.10 | Storage Media |
A.8.1 | User Endpoint Devices |
A.8.2 | Privileged Access Rights |
A.8.5 | Secure Authentication |
A.8.7 | Protection Against Malware |
A.8.8 | Management of Technical Vulnerabilities |
A.8.9 | Configuration Management |
A.8.16 | Monitoring Activities |
A.8.23 | Web Filtering |
A.8.28 | Secure Coding |
A.8.32 | Change Management |
Policy templates
Written for ISO 27001:
- Statement of Applicability (SoA)
- Information Security Management System (ISMS) Policy
- Technical Vulnerability Management Policy
- Supplier Information Security Policy
- Access Control Policy
- Secure Development Lifecycle Policy
And 21 from the standard set, adapted to ISO 27001.