ISO 27001 Technological Controls Explored

Control List (8.1 – 8.34)

Below is a complete list of the Technological controls, each linking to its own detailed explanation and examples.

I’ve grouped them into themes to help organise them, but these are not ISO 27001 formal groupings.

8.1 User end point devices – Protection for laptops, desktops, tablets, and phones used to access organisational information, covering configuration, encryption, and user responsibilities.

8.2 Privileged access rights – Strict management of administrator and other elevated accounts, ensuring they are allocated sparingly, used appropriately, and reviewed regularly.

8.3 Information access restriction – Limiting access to information and application functions based on the access control policy and individual business needs.

8.4 Access to source code – Controls to protect source code, development tools, and software libraries from unauthorised access or modification.

8.5 Secure authentication – Authentication mechanisms appropriate to the sensitivity of the information being accessed, including multi-factor authentication where justified by risk.

8.6 Capacity management – Monitoring and tuning of resources to ensure systems have the capacity needed to meet current and projected demands.

8.7 Protection against malware – A combination of detection tools, prevention measures, and user awareness to defend systems against malicious software.

8.8 Management of technical vulnerabilities – A systematic approach to identifying, evaluating, and remediating technical vulnerabilities across the organisation’s systems.

8.9 Configuration management – Establishing, documenting, and maintaining secure configurations for hardware, software, services, and networks.

8.10 Information deletion – Secure deletion of information from systems, devices, and storage media when no longer required, in line with retention obligations.

8.11 Data masking – Techniques such as anonymisation and pseudonymisation to protect sensitive data, particularly in non-production environments.

8.12 Data leakage prevention – Measures to detect and prevent the unauthorised disclosure or extraction of sensitive information from systems and networks.

8.13 Information backup – Regular, tested backups of information, software, and systems, stored and protected so they can be restored when needed.

8.14 Redundancy of information processing facilities – Building enough redundancy into critical systems to meet availability requirements, including failover and resilience measures.

8.15 Logging – Producing, storing, and protecting logs of activities, exceptions, faults, and security events for review and investigation.

8.16 Monitoring activities – Active monitoring of networks, systems, and applications for anomalous behaviour and potential security incidents.

8.17 Clock synchronisation – Synchronising the clocks of all relevant systems to a single reference time source to support accurate logging and investigations.

8.18 Use of privileged utility programs – Tightly controlled use of utility programs that could override system or application controls, restricted to authorised personnel only.

8.19 Installation of software on operational systems – Procedures and controls governing how software is installed and updated on production systems to maintain integrity and security.

8.20 Networks security – Securing networks and the information they carry through controls such as segregation, access management, and threat protection.

8.21 Security of network services – Identifying and including security mechanisms, service levels, and management requirements for all network services, whether in-house or outsourced.

8.22 Segregation of networks – Dividing networks into separate domains based on trust, function, or sensitivity to limit the impact of any single compromise.

8.23 Web filtering – Managing access to external websites to reduce exposure to malicious content and inappropriate use of organisational resources.

8.24 Use of cryptography – A defined approach to using cryptography effectively, including key management, to protect the confidentiality, integrity, and authenticity of information.

8.25 Secure development life cycle – Embedding security into every stage of software and system development, from requirements through to deployment.

8.26 Application security requirements – Identifying, specifying, and approving security requirements when developing or acquiring applications.

8.27 Secure system architecture and engineering principles – Establishing, documenting, and applying engineering principles to ensure systems are designed and built securely.

8.28 Secure coding – Applying secure coding principles and practices to reduce vulnerabilities introduced during software development.

8.29 Security testing in development and acceptance – Defining and carrying out security testing throughout the development life cycle and before systems are accepted into production.

8.30 Outsourced development – Directing, monitoring, and reviewing the activities of any third parties involved in developing systems on the organisation’s behalf.

8.31 Separation of development, test and production environments – Keeping development, testing, and live environments separate to reduce the risk of unauthorised changes or accidental impact on production.

8.32 Change management – A controlled process for making changes to information processing facilities and systems, including assessment, approval, and review.

8.33 Test information – Selecting, protecting, and managing test data appropriately, particularly when it is derived from production information.

8.34 Protection of information systems during audit testing – Planning and agreeing audit tests on operational systems carefully so they do not disrupt business processes or compromise data.

Next Steps and Related Topics

Check out some of the other control families here;

FAQ: Physical Controls