Vault restructure

Corpus/Standards/ISO27x/archive/About ISO27DIY Policy Cards.md

@@ -0,0 +1,32 @@
+# About ISO27DIY Policy Cards
+
+Policies are part of the collection of [Advised Documents for ISO 27001](../../../../../iso27DIY-gis/reference/Advised%20Documents%20for%20ISO%2027001.md).
+
+These could have the shape of 'Policy Cards', produced at the end of each session of the [📼 ISO27DIY Video Series](iso27DIY%20mk%20I/📼%20ISO27DIY%20Video%20Series.md).
+
+Because the policies produced at the end of a session need to be expanded and adapted to the organization, there will be a corresponding action in the ISMS planning.
+
+At first they will only mention Goal, Method and Responsibilities (and version info of course).
+The cards will reference ISMS clauses in the Strategy/Context/Planning phase.
+
+Later, Metrics (to establish effectiveness) and Evaluation (typically referring to review meetings) will be added.
+
+After the Risk and Assets phase – more specifically, after the asset categories have been identifies – Policy Cards will (also) reference Annex A Controls.
+
+Policy Cards are generated from risks identified and controls defined. They are not editable. They *can* be exported to an (editable) document. 
+
+A Policy Card has a fixed format, see [ISO27DIY Policy Card template](iso27DIY%20mk%20I/📒%20Templates/ISO27DIY%20Policy%20Card%20template.md). 
+
+ISO 27002:2013 offers the following guidance for A 5.1.1 Policies for information security: “These policies should be communicated to employees and relevant external parties in a form that is relevant, accessible and understandable to the intended reader, e.g. in the context of an ‘information security awareness, education and training programme’ ”.
+
+Related ISO clauses and controls:
+- [ISO 27001 A 5.1.1 Policies for information security](ISO%2027001%202013/ISO%2027001%20A%205.1.1%20Policies%20for%20information%20security.md)
+- [ISO_27001_OT C 5.2 Policy](ISO%2027001%202013/ISO_27001_OT%20C%205.2%20Policy.md)
+
+
+Related ideas:
+- [ISO27DIY Recipe for Policy Cards](iso27DIY%20mk%20I/ISO27DIY%20Recipe%20for%20Policy%20Cards.md)
+- [BC5701_Training_Tab_03_MS](../../BC%205701/BC5701_Training_Tab_03_MS.md#Beleid)
+- [Modules, Screens and Content](../../../💡Drafts%20and%20Ideas/Modules,%20Screens%20and%20Content.md)
+- [🧰 Resource portal](iso27DIY%20mk%20I/🧰%20Resource%20portal.md)
+- [Topical InfoSec Kanban’s](../../../📚️%20Literature%20notes/Topical%20InfoSec%20Kanban’s.md)

Corpus/Standards/ISO27x/archive/AuditGlue Business model.md

@@ -0,0 +1 @@
+[Concurrenten](../../../../../💡Permanent%20ideas/Concurrenten.md)

Corpus/Standards/ISO27x/archive/AuditGlue ERD.md

@@ -0,0 +1,9 @@
+A structure needs to be defined for the [💾 AuditGlue software](iso27DIY%20mk%20I/💾%20AuditGlue%20software.md) database.
+
+Entities: 
+- Norm
+- a Norm has multiple Chapters 
+- a Chapter has multiple Articles
+- Norms, Chapters and Articles can have multiple language versions
+- Articles can have different Expressions (e.g. original text, simplified, etc.)
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 2013 C 9 Performance evaluation 2.md

@@ -0,0 +1,8 @@
+#iso27001/2013
+# Chapter 9: Performance evaluation
+
+[ISO 27001 2013 C 9.1 Monitoring, measurement, analysis and evaluation](ISO%2027001%202013%20C%209.1%20Monitoring,%20measurement,%20analysis%20and%20evaluation.md)
+[ISO 27001 2013 C 9.2 Internal audit](ISO%2027001%202013%20C%209.2%20Internal%20audit.md)
+[ISO 27001 2013 C 9.3 Management review](ISO%2027001%202013%20C%209.3%20Management%20review.md)
+
+#iso27001/2013

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 2013 C 9.1 Monitoring, measurement, analysis and evaluation.md

@@ -0,0 +1,67 @@
+#iso27001/2013
+## 9.1 Monitoring, measurement, analysis and evaluation
+
+The organization shall evaluate the information security performance and the effectiveness of the information security management system.
+
+The organization shall determine:
+
+a) what needs to be monitored and measured, including information security processes and controls;
+
+b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;
+
+  NOTE The methods selected should produce comparable and reproducible results to be considered valid.
+
+c) when the monitoring and measuring shall be performed;
+
+d) who shall monitor and measure;
+
+e) when the results from monitoring and measurement shall be analysed and evaluated; and
+
+f) who shall analyse and evaluate these results.
+
+The organization shall retain appropriate documented information as evidence of the monitoring and measurement results.
+
+## 9.1 Monitoring, measurement, analysis and evaluation
+
+  
+
+The organization shall evaluate the information security performance and the effectiveness of the information security management system.
+
+  
+
+The organization shall determine:
+
+  
+
+a) what needs to be monitored and measured, including information security processes and controls;
+
+  
+
+b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;
+
+  
+
+NOTE The methods selected should produce comparable and reproducible results to be considered valid.
+
+  
+
+c) when the monitoring and measuring shall be performed;
+
+  
+
+d) who shall monitor and measure;
+
+  
+
+e) when the results from monitoring and measurement shall be analysed and evaluated; and
+
+  
+
+f) who shall analyse and evaluate these results.
+
+  
+
+The organization shall retain appropriate documented information as evidence of the monitoring and measurement results.
+
+  
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 2013 C 9.2 Internal audit.md

@@ -0,0 +1,71 @@
+#iso27001/2013
+## 9.2 Internal audit
+
+The organization shall conduct internal audits at planned intervals to provide information on whether the information security management system:
+
+a) conforms to
+
+  1) the organization’s own requirements for its information security management system; and
+  2) the requirements of this International Standard;
+
+b) is effectively implemented and maintained.
+
+The organization shall:
+
+c) plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting. The audit programme(s) shall take into consideration the importance of the processes concerned and the results of previous audits;
+
+d) define the audit criteria and scope for each audit;
+
+e) select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
+
+f) ensure that the results of the audits are reported to relevant management; and
+
+g) retain documented information as evidence of the audit programme(s) and the audit results.
+
+
+## 9.2 Internal audit
+
+  
+
+The organization shall conduct internal audits at planned intervals to provide information on whether the information security management system:
+
+  
+
+a) conforms to
+
+  
+
+1) the organization’s own requirements for its information security management system; and
+
+2) the requirements of this International Standard;
+
+  
+
+b) is effectively implemented and maintained.
+
+  
+
+The organization shall:
+
+  
+
+c) plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting. The audit programme(s) shall take into consideration the importance of the processes concerned and the results of previous audits;
+
+  
+
+d) define the audit criteria and scope for each audit;
+
+  
+
+e) select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
+
+  
+
+f) ensure that the results of the audits are reported to relevant management; and
+
+  
+
+g) retain documented information as evidence of the audit programme(s) and the audit results.
+
+  
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 2013 C 9.3 Management review.md

@@ -0,0 +1,79 @@
+#iso27001/2013
+## 9.3 Management review
+
+Top management shall review the organization’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.
+
+The management review shall include consideration of:
+
+a) the status of actions from previous management reviews;
+
+b) changes in external and internal issues that are relevant to the information security management system;
+
+c) feedback on the information security performance, including trends in:
+
+1) nonconformities and corrective actions;
+2) monitoring and measurement results;
+3) audit results; and
+4) fulfilment of information security objectives;
+
+d) feedback from interested parties;
+
+e) results of risk assessment and status of risk treatment plan; and
+
+f) opportunities for continual improvement.
+
+The outputs of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.
+
+The organization shall retain documented information as evidence of the results of management reviews.
+
+## 9.3 Management review
+
+  
+
+Top management shall review the organization’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.
+
+  
+
+The management review shall include consideration of:
+
+  
+
+a) the status of actions from previous management reviews;
+
+  
+
+b) changes in external and internal issues that are relevant to the information security management system;
+
+  
+
+c) feedback on the information security performance, including trends in:
+
+  
+
+1) nonconformities and corrective actions;
+
+2) monitoring and measurement results;
+
+3) audit results; and
+
+4) fulfilment of information security objectives;
+
+  
+
+d) feedback from interested parties;
+
+  
+
+e) results of risk assessment and status of risk treatment plan; and
+
+  
+
+f) opportunities for continual improvement.
+
+  
+
+The outputs of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.
+
+  
+
+The organization shall retain documented information as evidence of the results of management reviews.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 10 Cryptography.md

@@ -0,0 +1,7 @@
+#iso27001/2013
+# ISO 27001 A 10 Cryptography
+A.10.1 | Cryptographic controls ||
+--- | :----------------------- | :--- |
+Objective: To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information. |||
+A.10.1.1 | Policy on the use of cryptographic controls | A policy on the use of cryptographic controls for protection of information shall be developed and implemented. |
+A.10.1.2 | Key management | A policy on the use, protection and lifetime of cryptographic keys shall be developed and implemented through their whole lifecycle. |

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 11 Physical and environmental security.md

@@ -0,0 +1,24 @@
+#iso27001/2013
+# ISO 27001 A 11 Physical and environmental security
+A.11.1 | Secure areas ||
+--- | :----------------------- | :--- |
+Objective: To prevent unauthorized physical access, damage and interference to the organization’s information and information processing facilities. |||
+A.11.1.1 | Physical security perimeter | Security perimeters shall be defined and used to protect areas that contain either sensitive or critical information and information processing facilities. |
+A.11.1.2 | Physical entry controls | Secure areas shall be protected by appropriate entry controls to ensure that only authorized personnel are allowed access. |
+A.11.1.3 | Securing offices, rooms and facilities | Physical security for offices, rooms and facilities shall be designed and applied. |
+A.11.1.4 | Protecting against external and environmental threats | Physical protection against natural disasters, malicious attack or accidents shall be designed and applied. |
+A.11.1.5 | Working in secure areas | Procedures for working in secure areas shall be designed and applied. |
+A.11.1.6 | Delivery and loading areas | Access points such as delivery and loading areas and other points where unauthorized persons could enter the premises shall be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access. |
+
+A.11.2 | Equipment ||
+--- | :----------------------- | :--- |
+Objective: To prevent loss, damage, theft or compromise of assets and interruption to the organization’s operations. |||
+A.11.2.1 | Equipment siting and protection | Equipment shall be sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access. |
+A.11.2.2 | Supporting utilities | Equipment shall be protected from power failures and other disruptions caused by failures in supporting utilities. |
+A.11.2.3 | Cabling security | Power and telecommunications cabling carrying data or supporting information services shall be protected from interception, interference or damage. |
+A.11.2.4 | Equipment maintenance | Equipment shall be correctly maintained to ensure its continued availability and integrity. |
+A.11.2.5 | Removal of assets | Equipment, information or software shall not be taken off-site without prior authorization. |
+A.11.2.6 | Security of equipment and assets off-premises | Security shall be applied to off-site assets taking into account the different risks of working outside the organization’s premises. |
+A.11.2.7 | Secure disposal or re-use of equipment | All items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use. |
+A.11.2.8 | Unattended user equipment | Users shall ensure that unattended equipment has appropriate protection. |
+A.11.2.9 | Clear desk and clear screen policy | A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities shall be adopted. |

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12 Operations security.md

@@ -0,0 +1,16 @@
+#iso27001/2013
+# ISO 27001 A 12 Operations security
+
+[ISO 27001 A 12.1 Operational procedures and responsibilities](ISO%2027001%20A%2012.1%20Operational%20procedures%20and%20responsibilities.md)
+
+[ISO 27001 A 12.2 Protection from malware](ISO%2027001%20A%2012.2%20Protection%20from%20malware.md)
+
+[ISO 27001 A 12.3 Backup](ISO%2027001%20A%2012.3%20Backup.md)
+
+[ISO 27001 A 12.4 Logging and monitoring](ISO%2027001%20A%2012.4%20Logging%20and%20monitoring.md)
+
+[ISO 27001 A 12.5 Control of operational software](ISO%2027001%20A%2012.5%20Control%20of%20operational%20software.md)
+
+[ISO 27001 A 12.6 Technical vulnerability management](ISO%2027001%20A%2012.6%20Technical%20vulnerability%20management.md)
+
+[ISO 27001 A 12.7 Information systems audit considerations](ISO%2027001%20A%2012.7%20Information%20systems%20audit%20considerations.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.1 Operational procedures and responsibilities.md

@@ -0,0 +1,8 @@
+#iso27001/2013
+## ISO 27001 A 12.1 Operational procedures and responsibilities
+Objective: To ensure correct and secure operations of information processing facilities.
+
+[ISO 27001 A 12.1.1 Documented operating procedures](ISO%2027001%20A%2012.1.1%20Documented%20operating%20procedures.md)
+[ISO 27001 A 12.1.2 Change management](ISO%2027001%20A%2012.1.2%20Change%20management.md)
+[ISO 27001 A 12.1.3 Capacity management](ISO%2027001%20A%2012.1.3%20Capacity%20management.md)
+[ISO 27001 A 12.1.4 Separation of development, testing and operational environments](ISO%2027001%20A%2012.1.4%20Separation%20of%20development,%20testing%20and%20operational%20environments.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.1.1 Documented operating procedures.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.1.1 Documented operating procedures
+Operating procedures shall be documented and made available to all users who need them.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.1.2 Change management.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.1.2 Change management
+Changes to the organization, business processes, information processing facilities and systems that affect information security shall be controlled.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.1.3 Capacity management.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.1.3 Capacity management
+The use of resources shall be monitored, tuned and projections made of future capacity requirements to ensure the required system performance.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.1.4 Separation of development, testing and operational environments.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.1.4 Separation of development, testing and operational environments
+Development, testing, and operational environments shall be separated to reduce the risks of unauthorized access or changes to the operational environment.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.2 Protection from malware.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+## ISO 27001 A 12.2 Protection from malware
+
+Objective: To ensure that information and information processing facilities are protected against malware.
+
+[ISO 27001 A 12.2.1 Controls against malware](ISO%2027001%20A%2012.2.1%20Controls%20against%20malware.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.2.1 Controls against malware.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.2.1 Controls against malware
+Detection, prevention and recovery controls to protect against malware shall be implemented, combined with appropriate user awareness.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.3 Backup.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+## ISO 27001 A 12.3 Backup
+
+Objective: To protect against loss of data.
+
+[ISO 27001 A 12.3.1 Information backup](ISO%2027001%20A%2012.3.1%20Information%20backup.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.3.1 Information backup.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.3.1 Information backup
+Backup copies of information, software and system images shall be taken and tested regularly in accordance with an agreed backup policy.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.4 Logging and monitoring.md

@@ -0,0 +1,12 @@
+#iso27001/2013
+## ISO 27001 A 12.4 Logging and monitoring
+
+Objective: To record events and generate evidence.
+
+[ISO 27001 A 12.4.1 Event logging](ISO%2027001%20A%2012.4.1%20Event%20logging.md)
+
+[ISO 27001 A 12.4.2 Protection of log information](ISO%2027001%20A%2012.4.2%20Protection%20of%20log%20information.md)
+
+[ISO 27001 A 12.4.3 Administrator and operator logs](ISO%2027001%20A%2012.4.3%20Administrator%20and%20operator%20logs.md)
+
+[ISO 27001 A 12.4.4 Clock synchronisation](ISO%2027001%20A%2012.4.4%20Clock%20synchronisation.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.4.1 Event logging.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.4.1 Event logging
+Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.4.2 Protection of log information.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.4.2 Protection of log information
+Logging facilities and log information shall be protected against tampering and unauthorized access.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.4.3 Administrator and operator logs.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.4.3 Administrator and operator logs
+System administrator and system operator activities shall be logged and the logs protected and regularly reviewed.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.4.4 Clock synchronisation.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.4.4 Clock synchronisation
+The clocks of all relevant information processing systems within an organization or security domain shall be synchronised to a single reference time source.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.5 Control of operational software.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+## ISO 27001 A 12.5 Control of operational software
+
+Objective: To ensure the integrity of operational systems.
+
+[ISO 27001 A 12.5.1 Installation of software on operational systems](ISO%2027001%20A%2012.5.1%20Installation%20of%20software%20on%20operational%20systems.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.5.1 Installation of software on operational systems.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.5.1 Installation of software on operational systems
+Procedures shall be implemented to control the installation of software on operational systems.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.6 Technical vulnerability management.md

@@ -0,0 +1,8 @@
+#iso27001/2013
+## ISO 27001 A 12.6 Technical vulnerability management
+
+Objective: To prevent exploitation of technical vulnerabilities.
+
+[ISO 27001 A 12.6.1 Management of technical vulnerabilities](ISO%2027001%20A%2012.6.1%20Management%20of%20technical%20vulnerabilities.md)
+
+[ISO 27001 A 12.6.2 Restrictions on software installation](ISO%2027001%20A%2012.6.2%20Restrictions%20on%20software%20installation.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.6.1 Management of technical vulnerabilities.md

@@ -0,0 +1,7 @@
+#iso27001/2013
+### ISO 27001 A 12.6.1 Management of technical vulnerabilities
+Information about technical vulnerabilities of information systems being used shall be obtained in a timely fashion, the organization’s exposure to such vulnerabilities evaluated and appropriate measures taken to address the associated risk.
+
+Related:
+- [ISO 27001 A 6.1.4 Contact with special interest groups](ISO%2027001%20A%206.1.4%20Contact%20with%20special%20interest%20groups.md) may be required to be alerted to vulnerabilities in a timely fashion
+- [ISO 27001 A 16.1.1 Responsibilities and procedures](ISO%2027001%20A%2016.1.1%20Responsibilities%20and%20procedures.md) for incident management need to be implemented, to enable a quick and effective response to security incidents.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.6.2 Restrictions on software installation.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.6.2 Restrictions on software installation
+Rules governing the installation of software by users shall be established and implemented.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.7 Information systems audit considerations.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+## ISO 27001 A 12.7 Information systems audit considerations
+
+Objective: To minimise the impact of audit activities on operational systems.
+
+[ISO 27001 A 12.7.1 Information systems audit controls](ISO%2027001%20A%2012.7.1%20Information%20systems%20audit%20controls.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 12.7.1 Information systems audit controls.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 12.7.1 Information systems audit controls
+Audit requirements and activities involving verification of operational systems shall be carefully planned and agreed to minimise disruptions to business processes.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 13 Communications security.md

@@ -0,0 +1,4 @@
+#iso27001/2013
+# ISO 27001 A 13 Communications security
+[ISO 27001 A.13.1 Network security management](ISO%2027001%20A.13.1%20Network%20security%20management.md)
+[ISO 27001 A.13.2 Information transfer](ISO%2027001%20A.13.2%20Information%20transfer.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 14 System acquisition, development and maintenance.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+# ISO 27001 A 14 System acquisition, development and maintenance
+
+[ISO 27001 A.14.1 Security requirements of information systems](ISO%2027001%20A.14.1%20Security%20requirements%20of%20information%20systems.md)
+[ISO 27001 A.14.2 Security in development and support processes](ISO%2027001%20A.14.2%20Security%20in%20development%20and%20support%20processes.md)
+[ISO 27001 A.14.3 Test data](ISO%2027001%20A.14.3%20Test%20data.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 15 Supplier relationships.md

@@ -0,0 +1,15 @@
+#iso27001/2013
+# ISO 27001 A 15 Supplier relationships
+A.15.1 | Information security in supplier relationships ||
+--- | :----------------------- | :--- |
+Objective: To ensure protection of the organization’s assets that is accessible by suppliers. |||
+A.15.1.1 | Information security policy for supplier relationships | Information security requirements for mitigating the risks associated with supplier’s access to the organization’s assets shall be agreed with the supplier and documented. |
+A.15.1.2 | Addressing security within supplier agreements | All relevant information security requirements shall be established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure components for, the organization’s information. |
+A.15.1.3 | Information and communication technology supply chain | Agreements with suppliers shall include requirements to address the information security risks associated with information and communications technology services and product supply chain. |
+
+A.15.2 | Supplier service delivery management ||
+--- | :----------------------- | :--- |
+Objective: To maintain an agreed level of information security and service delivery in line with supplier agreements. |||
+A.15.2.1 | Monitoring and review of supplier services | Organizations shall regularly monitor, review and audit supplier service delivery. |
+A.15.2.2 | Managing changes to supplier services | Changes to the provision of services by suppliers, including maintaining and improving existing information security policies, procedures and controls, shall be managed, taking account of the criticality of business information, systems and processes involved and re-assessment of risks. |
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16 Information security incident management.md

@@ -0,0 +1,4 @@
+#iso27001/2013
+# ISO 27001 A 16 Information security incident management
+
+[ISO 27001 A 16.1 Management of information security incidents and improvements](ISO%2027001%20A%2016.1%20Management%20of%20information%20security%20incidents%20and%20improvements.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1 Management of information security incidents and improvements.md

@@ -0,0 +1,12 @@
+#iso27001/2013
+## ISO 27001 A 16.1 Management of information security incidents and improvements
+
+Objective: To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.
+
+[ISO 27001 A 16.1.1 Responsibilities and procedures](ISO%2027001%20A%2016.1.1%20Responsibilities%20and%20procedures.md)
+[ISO 27001 A 16.1.2 Reporting information security events](ISO%2027001%20A%2016.1.2%20Reporting%20information%20security%20events.md)
+[ISO 27001 A 16.1.3 Reporting information security weaknesses](ISO%2027001%20A%2016.1.3%20Reporting%20information%20security%20weaknesses.md)
+[ISO 27001 A 16.1.4 Assessment of and decision on information security events](ISO%2027001%20A%2016.1.4%20Assessment%20of%20and%20decision%20on%20information%20security%20events.md)
+[ISO 27001 A 16.1.5 Response to information security incidents](ISO%2027001%20A%2016.1.5%20Response%20to%20information%20security%20incidents.md)
+[ISO 27001 A 16.1.6 Learning from information security incidents](ISO%2027001%20A%2016.1.6%20Learning%20from%20information%20security%20incidents.md)
+[ISO 27001 A 16.1.7 Collection of evidence](ISO%2027001%20A%2016.1.7%20Collection%20of%20evidence.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.1 Responsibilities and procedures.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 16.1.1 Responsibilities and procedures
+Management responsibilities and procedures shall be established to ensure a quick, effective and orderly response to information security incidents.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.2 Reporting information security events.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 16.1.2 Reporting information security events
+Information security events shall be reported through appropriate management channels as quickly as possible.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.3 Reporting information security weaknesses.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 16.1.3 Reporting information security weaknesses
+Employees and contractors using the organization’s information systems and services shall be required to note and report any observed or suspected information security weaknesses in systems or services.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.4 Assessment of and decision on information security events.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 16.1.4 Assessment of and decision on information security events
+Information security events shall be assessed and it shall be decided if they are to be classified as information security incidents.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.5 Response to information security incidents.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+### ISO 27001 A 16.1.5 Response to information security incidents
+Information security incidents shall be responded to in accordance with the documented procedures.
+
+Opinion:
+Doesn't add much to [ISO 27001 A 16.1.1 Responsibilities and procedures](ISO%2027001%20A%2016.1.1%20Responsibilities%20and%20procedures.md) in itself, effectively stating that the procedures for incident management need to be followed. The ISO 27002 implementation guidance lists what aspects the response should include.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.6 Learning from information security incidents.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 16.1.6 Learning from information security incidents
+Knowledge gained from analysing and resolving information security incidents shall be used to reduce the likelihood or impact of future incidents.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 16.1.7 Collection of evidence.md

@@ -0,0 +1,5 @@
+#iso27001/2013
+### ISO 27001 A 16.1.7 Collection of evidence
+The organization shall define and apply procedures for the identification, collection, acquisition and preservation of information, which can serve as evidence.
+
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 17 Information security aspects of business continuity management.md

@@ -0,0 +1,22 @@
+#iso27001/2013
+# ISO 27001 A 17 Information security aspects of business continuity management
+
+## A 17.1 Information security continuity
+Objective: Information security continuity shall be embedded in the organization’s business continuity management systems.
+
+### A 17.1.1 Planning information security continuity
+The organization shall determine its requirements for information security and the continuity of information security management in adverse situations, e.g. during a crisis or disaster.
+
+### A 17.1.2 Implementing information security continuity
+The organization shall establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during an adverse situation.
+
+### A 17.1.3 Verify, review and evaluate information security continuity
+The organization shall verify the established and implemented information security continuity controls at regular intervals in order to ensure that they are valid and effective during adverse situations.
+
+
+## A 17.2 Redundancies
+Objective: To ensure availability of information processing facilities.
+
+### A 17.2.1 Availability of information processing facilities
+Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 18 Compliance.md

@@ -0,0 +1,4 @@
+#iso27001/2013
+# ISO 27001 A 18 Compliance
+[ISO 27001 A.18.1 Compliance with legal and contractual requirements](ISO%2027001%20A.18.1%20Compliance%20with%20legal%20and%20contractual%20requirements.md)
+[ISO 27001 A.18.2 Information security reviews](ISO%2027001%20A.18.2%20Information%20security%20reviews.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 5 Information security policies.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+
+[ISO 27001 A 5.1 Management direction for information security](ISO%2027001%20A%205.1%20Management%20direction%20for%20information%20security.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 5.1 Management direction for information security.md

@@ -0,0 +1,5 @@
+#iso27001/2013
+Objective: To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.
+
+[ISO 27001 A 5.1.1 Policies for information security](ISO%2027001%20A%205.1.1%20Policies%20for%20information%20security.md)
+[ISO 27001 A 5.1.2 Review of the policies for information security](ISO%2027001%20A%205.1.2%20Review%20of%20the%20policies%20for%20information%20security.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 5.1.1 Policies for information security.md

@@ -0,0 +1,2 @@
+#iso27001/2013
+A set of policies for information security shall be defined, approved by management, published and communicated to employees and relevant external parties.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 5.1.2 Review of the policies for information security.md

@@ -0,0 +1,2 @@
+#iso27001/2013
+The policies for information security shall be reviewed at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6 Organization of information security.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+[ISO 27001 A 6.1 Internal organization](ISO%2027001%20A%206.1%20Internal%20organization.md)
+[ISO 27001 A 6.2 Mobile devices and teleworking](ISO%2027001%20A%206.2%20Mobile%20devices%20and%20teleworking.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.1 Internal organization.md

@@ -0,0 +1,10 @@
+#iso27001/2013
+## ISO 27001 A 6.1 Internal organization
+
+Objective: To establish a management framework to initiate and control the implementation and operation of information security within the organization. |||
+
+[ISO 27001 A 6.1.1 Information security roles and responsibilities](ISO%2027001%20A%206.1.1%20Information%20security%20roles%20and%20responsibilities.md)
+[ISO 27001 A 6.1.2 Segregation of duties](ISO%2027001%20A%206.1.2%20Segregation%20of%20duties.md)
+[ISO 27001 A 6.1.3 Contact with authorities](ISO%2027001%20A%206.1.3%20Contact%20with%20authorities.md)
+[ISO 27001 A 6.1.4 Contact with special interest groups](ISO%2027001%20A%206.1.4%20Contact%20with%20special%20interest%20groups.md)
+[ISO 27001 A 6.1.5 Information security in project management](ISO%2027001%20A%206.1.5%20Information%20security%20in%20project%20management.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.1.1 Information security roles and responsibilities.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.1.1 Information security roles and responsibilities
+All information security responsibilities shall be defined and allocated.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.1.2 Segregation of duties.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.1.2 Segregation of duties
+Conflicting duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.1.3 Contact with authorities.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.1.3 Contact with authorities
+Appropriate contacts with relevant authorities shall be maintained.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.1.4 Contact with special interest groups.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.1.4 Contact with special interest groups
+Appropriate contacts with special interest groups or other specialist security forums and professional associations shall be maintained.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.1.5 Information security in project management.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.1.5 Information security in project management
+Information security shall be addressed in project management, regardless of the type of the project.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.2 Mobile devices and teleworking.md

@@ -0,0 +1,7 @@
+#iso27001/2013
+## ISO 27001 A 6.2 Mobile devices and teleworking
+
+Objective: To ensure the security of teleworking and use of mobile devices. 
+
+[ISO 27001 A 6.2.1 Mobile device policy](ISO%2027001%20A%206.2.1%20Mobile%20device%20policy.md)
+[ISO 27001 A 6.2.2 Teleworking](ISO%2027001%20A%206.2.2%20Teleworking.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.2.1 Mobile device policy.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.2.1 Mobile device policy
+A policy and supporting security measures shall be adopted to manage the risks introduced by using mobile devices.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 6.2.2 Teleworking.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 6.2.2 Teleworking
+A policy and supporting security measures shall be implemented to protect information accessed, processed or stored at teleworking sites.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 7 Human resource security.md

@@ -0,0 +1,19 @@
+#iso27001/2013
+# ISO 27001 A 7 Human resource security
+A.7.1 | Prior to employment ||
+--- | :----------------------- | :--- |
+Objective: To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered. |||
+A.7.1.1 | Screening | Background verification checks on all candidates for employment shall be carried out in accordance with relevant laws, regulations and ethics and shall be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.
+A.7.1.2 | Terms and conditions of employment | The contractual agreements with employees and contractors shall state their and the organization’s responsibilities for information security.
+
+A.7.2 | During employment ||
+--- | :----------------------- | :--- |
+Objective: To ensure that employees and contractors are aware of and fulfil their information security responsibilities. |||
+A.7.2.1 | Management responsibilities | Management shall require all employees and contractors to apply information security in accordance with the established policies and procedures of the organization.
+A.7.2.2 | Information security awareness, education and training | All employees of the organization and, where relevant, contractors shall receive appropriate awareness education and training and regular updates in organizational policies and procedures, as relevant for their job function.
+A.7.2.3 | Disciplinary process | There shall be a formal and communicated disciplinary process in place to take action against employees who have committed an information security breach.
+
+A.7.3 | Termination and change of employment ||
+--- | :----------------------- | :--- |
+Objective: To protect the organization’s interests as part of the process of changing or terminating employment. |||
+A.7.3.1 | Termination or change of employment responsibilities | Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, communicated to the employee or contractor and enforced. |

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8 Asset management.md

@@ -0,0 +1,18 @@
+#iso27001/2013
+# ISO 27001 A 8 Asset management
+
+[ISO 27001 A 8.1 Responsibility for assets](ISO%2027001%20A%208.1%20Responsibility%20for%20assets.md)
+
+[ISO 27001 A 8.2 Information classification](ISO%2027001%20A%208.2%20Information%20classification.md)
+
+## ISO 27001 A 8.3 Media handling
+Objective: To prevent unauthorized disclosure, modification, removal or destruction of information stored on media.
+
+### ISO 27001 A 8.3.1 Management of removable media
+Procedures shall be implemented for the management of removable media in accordance with the classification scheme adopted by the organization.
+
+### ISO 27001 A 8.3.2 Disposal of media
+Media shall be disposed of securely when no longer required, using formal procedures.
+
+### ISO 27001 A 8.3.3 Physical media transfer
+Media containing information shall be protected against unauthorized access, misuse or corruption during transportation. |

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.1 Responsibility for assets.md

@@ -0,0 +1,12 @@
+#iso27001/2013
+## ISO 27001 A 8.1 Responsibility for assets
+Objective: To identify organizational assets and define appropriate protection responsibilities.
+
+[ISO 27001 A 8.1.1 Inventory of assets](ISO%2027001%20A%208.1.1%20Inventory%20of%20assets.md)
+
+[ISO 27001 A 8.1.2 Ownership of assets](ISO%2027001%20A%208.1.2%20Ownership%20of%20assets.md)
+
+[ISO 27001 A 8.1.3 Acceptable use of assets](ISO%2027001%20A%208.1.3%20Acceptable%20use%20of%20assets.md)
+
+[ISO 27001 A 8.1.4 Return of assets](ISO%2027001%20A%208.1.4%20Return%20of%20assets.md)
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.1.1 Inventory of assets.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 8.1.1 Inventory of assets
+Information, other assets associated with information and information processing facilities shall be identified and an inventory of these assets shall be drawn up and maintained. 

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.1.2 Ownership of assets.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 8.1.2 Ownership of assets
+Assets maintained in the inventory shall be owned.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.1.3 Acceptable use of assets.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 8.1.3 Acceptable use of assets
+Rules for the acceptable use of information and of assets associated with information and information processing facilities shall be identified, documented and implemented.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.1.4 Return of assets.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 8.1.4 Return of assets
+All employees and external party users shall return all of the organizational assets in their possession upon termination of their employment, contract or agreement.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.2 Information classification.md

@@ -0,0 +1,10 @@
+#iso27001/2013
+## ISO 27001 A 8.2 Information classification
+
+Objective: To ensure that information receives an appropriate level of protection in accordance with its importance to the organization.
+
+[ISO 27001 A 8.2.1 Classification of information](ISO%2027001%20A%208.2.1%20Classification%20of%20information.md)
+
+[ISO 27001 A 8.2.2 Labelling of information](ISO%2027001%20A%208.2.2%20Labelling%20of%20information.md)
+
+[ISO 27001 A 8.2.3 Handling of assets](ISO%2027001%20A%208.2.3%20Handling%20of%20assets.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.2.1 Classification of information.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 8.2.1 Classification of information
+Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.2.2 Labelling of information.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+### ISO 27001 A 8.2.2 Labelling of information
+An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.
+
+Related:
+- [Labeling of information in the digital domain](../../../../💡Drafts%20and%20Ideas/Labeling%20of%20information%20in%20the%20digital%20domain.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 8.2.3 Handling of assets.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### ISO 27001 A 8.2.3 Handling of assets
+Procedures for handling assets shall be developed and implemented in accordance with the information classification scheme adopted by the organization.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9 Access control.md

@@ -0,0 +1,9 @@
+#iso27001/2013
+# ISO 27001 A 9 Access control
+[ISO 27001 A 9.1 Business requirements of access control](ISO%2027001%20A%209.1%20Business%20requirements%20of%20access%20control.md)
+
+[ISO 27001 A 9.2 User access management](ISO%2027001%20A%209.2%20User%20access%20management.md)
+
+[ISO 27001 A 9.3 User responsibilities](ISO%2027001%20A%209.3%20User%20responsibilities.md)
+
+[ISO 27001 A 9.4 System and application access control](ISO%2027001%20A%209.4%20System%20and%20application%20access%20control.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.1 Business requirements of access control.md

@@ -0,0 +1,7 @@
+#iso27001/2013
+## A.9.1 Business requirements of access control
+
+Objective: To limit access to information and information processing facilities.
+
+[ISO 27001 A 9.1.1 Access control policy](ISO%2027001%20A%209.1.1%20Access%20control%20policy.md)
+[ISO 27001 A 9.1.2 Access to networks and network services](ISO%2027001%20A%209.1.2%20Access%20to%20networks%20and%20network%20services.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.1.1 Access control policy.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.1.1 Access control policy
+An access control policy shall be established, documented and reviewed based on business and information security requirements.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.1.2 Access to networks and network services.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.1.2 Access to networks and network services
+Users shall only be provided with access to the network and network services that they have been specifically authorized to use.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2 User access management.md

@@ -0,0 +1,11 @@
+#iso27001/2013
+## A.9.2 User access management
+
+Objective: To ensure authorized user access and to prevent unauthorized access to systems and services.
+
+[ISO 27001 A 9.2.1 User registration and de-registration](ISO%2027001%20A%209.2.1%20User%20registration%20and%20de-registration.md)
+[ISO 27001 A 9.2.2 User access provisioning](ISO%2027001%20A%209.2.2%20User%20access%20provisioning.md)
+[ISO 27001 A 9.2.3 Management of privileged access rights](ISO%2027001%20A%209.2.3%20Management%20of%20privileged%20access%20rights.md)
+[ISO 27001 A 9.2.4 Management of secret authentication information of users](ISO%2027001%20A%209.2.4%20Management%20of%20secret%20authentication%20information%20of%20users.md)
+[ISO 27001 A 9.2.5 Review of user access rights](ISO%2027001%20A%209.2.5%20Review%20of%20user%20access%20rights.md)
+[ISO 27001 A 9.2.6 Removal or adjustment of access rights](ISO%2027001%20A%209.2.6%20Removal%20or%20adjustment%20of%20access%20rights.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2.1 User registration and de-registration.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.2.1 User registration and de-registration
+A formal user registration and de-registration process shall be implemented to enable assignment of access rights.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2.2 User access provisioning.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.2.2 User access provisioning
+A formal user access provisioning process shall be implemented to assign or revoke access rights for all user types to all systems and services.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2.3 Management of privileged access rights.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.2.3 Management of privileged access rights
+The allocation and use of privileged access rights shall be restricted and controlled.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2.4 Management of secret authentication information of users.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.2.4 Management of secret authentication information of users
+The allocation of secret authentication information shall be controlled through a formal management process.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2.5 Review of user access rights.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.2.5 Review of user access rights
+Asset owners shall review users’ access rights at regular intervals.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.2.6 Removal or adjustment of access rights.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.2.6 Removal or adjustment of access rights
+The access rights of all employees and external party users to information and information processing facilities shall be removed upon termination of their employment, contract or agreement, or adjusted upon change.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.3 User responsibilities.md

@@ -0,0 +1,6 @@
+#iso27001/2013
+## A.9.3 User responsibilities
+
+Objective: To make users accountable for safeguarding their authentication information. 
+
+[ISO 27001 A 9.3.1 Use of secret authentication information](ISO%2027001%20A%209.3.1%20Use%20of%20secret%20authentication%20information.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.3.1 Use of secret authentication information.md

@@ -0,0 +1,4 @@
+#iso27001/2013
+## A.9.3.1 Use of secret authentication information
+Users shall be required to follow the organization’s practices in the use of secret authentication information.
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.4 System and application access control.md

@@ -0,0 +1,10 @@
+#iso27001/2013
+## A.9.4 System and application access control
+
+Objective: To prevent unauthorized access to systems and applications.
+
+[ISO 27001 A 9.4.1 Information access restriction](ISO%2027001%20A%209.4.1%20Information%20access%20restriction.md)
+[ISO 27001 A 9.4.2 Secure log-on procedures](ISO%2027001%20A%209.4.2%20Secure%20log-on%20procedures.md)
+[ISO 27001 A 9.4.3 Password management system](ISO%2027001%20A%209.4.3%20Password%20management%20system.md)
+[ISO 27001 A 9.4.4 Use of privileged utility programs](ISO%2027001%20A%209.4.4%20Use%20of%20privileged%20utility%20programs.md)
+[ISO 27001 A 9.4.5 Access control to program source code](ISO%2027001%20A%209.4.5%20Access%20control%20to%20program%20source%20code.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.4.1 Information access restriction.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.4.1 Information access restriction
+Access to information and application system functions shall be restricted in accordance with the access control policy.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.4.2 Secure log-on procedures.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.4.2 Secure log-on procedures
+Where required by the access control policy, access to systems and applications shall be controlled by a secure log-on procedure.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.4.3 Password management system.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.4.3 Password management system
+Password management systems shall be interactive and shall ensure quality passwords.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.4.4 Use of privileged utility programs.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.4.4 Use of privileged utility programs
+The use of utility programs that might be capable of overriding system and application controls shall be restricted and tightly controlled.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A 9.4.5 Access control to program source code.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.9.4.5 Access control to program source code
+Access to program source code shall be restricted.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.13.1 Network security management.md

@@ -0,0 +1,12 @@
+#iso27001/2013
+## A.13.1 Network security management
+Objective: To ensure the protection of information in networks and its supporting information processing facilities.
+
+### A.13.1.1 Network controls
+Networks shall be managed and controlled to protect information in systems and applications.
+
+### A.13.1.2 Security of network services
+Security mechanisms, service levels and management requirements of all network services shall be identified and included in network services agreements, whether these services are provided in-house or outsourced.
+
+### A.13.1.3 Segregation in networks
+Groups of information services, users and information systems shall be segregated on networks.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.13.2 Information transfer.md

@@ -0,0 +1,8 @@
+#iso27001/2013
+## A.13.2 Information transfer
+Objective: To maintain the security of information transferred within an organization and with any external entity.
+
+[ISO 27001 A.13.2.1 Information transfer policies and procedures](ISO%2027001%20A.13.2.1%20Information%20transfer%20policies%20and%20procedures.md)
+[ISO 27001 A.13.2.2 Agreements on information transfer](ISO%2027001%20A.13.2.2%20Agreements%20on%20information%20transfer.md)
+[ISO 27001 A.13.2.3 Electronic messaging](ISO%2027001%20A.13.2.3%20Electronic%20messaging.md)
+[ISO 27001 A.13.2.4 Confidentiality or non-disclosure agreements](ISO%2027001%20A.13.2.4%20Confidentiality%20or%20non-disclosure%20agreements.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.13.2.1 Information transfer policies and procedures.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.13.2.1 Information transfer policies and procedures
+Formal transfer policies, procedures and controls shall be in place to protect the transfer of information through the use of all types of communication facilities.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.13.2.2 Agreements on information transfer.md

@@ -0,0 +1,5 @@
+#iso27001/2013
+### A.13.2.2 Agreements on information transfer
+Agreements shall address the secure transfer of business information between the organization and external parties.
+
+[ISO 27001 A.13.2.3 Electronic messaging](ISO%2027001%20A.13.2.3%20Electronic%20messaging.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.13.2.3 Electronic messaging.md

@@ -0,0 +1,5 @@
+#iso27001/2013
+### A.13.2.3 Electronic messaging
+Information involved in electronic messaging shall be appropriately protected.
+
+[ISO 27001 A.13.2.4 Confidentiality or non-disclosure agreements](ISO%2027001%20A.13.2.4%20Confidentiality%20or%20non-disclosure%20agreements.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.13.2.4 Confidentiality or non-disclosure agreements.md

@@ -0,0 +1,4 @@
+#iso27001/2013
+### A.13.2.4 Confidentiality or non-disclosure agreements
+Requirements for confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information shall be identified, regularly reviewed and documented.
+

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.14.1 Security requirements of information systems.md

@@ -0,0 +1,7 @@
+#iso27001/2013
+## A.14.1 Security requirements of information systems
+Objective: To ensure that information security is an integral part of information systems across the entire lifecycle. This also includes the requirements for information systems which provide services over public networks.
+
+[ISO 27001 A.14.1.1 Information security requirements analysis and specification](ISO%2027001%20A.14.1.1%20Information%20security%20requirements%20analysis%20and%20specification.md)
+[ISO 27001 A.14.1.2 Securing application services on public networks](ISO%2027001%20A.14.1.2%20Securing%20application%20services%20on%20public%20networks.md)
+[ISO 27001 A.14.1.3 Protecting application services transactions](ISO%2027001%20A.14.1.3%20Protecting%20application%20services%20transactions.md)

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.14.1.1 Information security requirements analysis and specification.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.14.1.1 Information security requirements analysis and specification
+The information security related requirements shall be included in the requirements for new information systems or enhancements to existing information systems.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.14.1.2 Securing application services on public networks.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.14.1.2 Securing application services on public networks
+Information involved in application services passing over public networks shall be protected from fraudulent activity, contract dispute and unauthorized disclosure and modification.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.14.1.3 Protecting application services transactions.md

@@ -0,0 +1,3 @@
+#iso27001/2013
+### A.14.1.3 Protecting application services transactions
+Information involved in application service transactions shall be protected to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay.

Corpus/Standards/ISO27x/archive/ISO 27001 2013/ISO 27001 A.14.2 Security in development and support processes.md

@@ -0,0 +1,12 @@
+#iso27001/2013
+## A.14.2 Security in development and support processes
+Objective: To ensure that information security is designed and implemented within the development lifecycle of information systems.
+[ISO 27001 A.14.2.1 Secure development policy](ISO%2027001%20A.14.2.1%20Secure%20development%20policy.md)
+[ISO 27001 A.14.2.2 System change control procedures](ISO%2027001%20A.14.2.2%20System%20change%20control%20procedures.md)
+[ISO 27001 A.14.2.3 Technical review of applications after operating platform changes](ISO%2027001%20A.14.2.3%20Technical%20review%20of%20applications%20after%20operating%20platform%20changes.md)
+[ISO 27001 A.14.2.4 Restrictions on changes to software packages](ISO%2027001%20A.14.2.4%20Restrictions%20on%20changes%20to%20software%20packages.md)
+[ISO 27001 A.14.2.5 Secure system engineering principles](ISO%2027001%20A.14.2.5%20Secure%20system%20engineering%20principles.md)
+[ISO 27001 A.14.2.6 Secure development environment](ISO%2027001%20A.14.2.6%20Secure%20development%20environment.md)
+[ISO 27001 A.14.2.7 Outsourced development](ISO%2027001%20A.14.2.7%20Outsourced%20development.md)
+[ISO 27001 A.14.2.8 System security testing](ISO%2027001%20A.14.2.8%20System%20security%20testing.md)
+[ISO 27001 A.14.2.9 System acceptance testing](ISO%2027001%20A.14.2.9%20System%20acceptance%20testing.md)