Acceptance Page 2 Revision History 3 Introduction 14 Control Categories 15 Scope 15 General Requirements 15 Control Category: 0.0 Information Security Management Program 17 Objective Name: 0.01 Information Security Management Program 17 Control Reference: 0.a Information Security Management Program 17 Control Category: 01.0 Access Control 18 Objective Name: 01.01 Business Requirement for Access Control 18 Control Reference: 01.a Access Control Policy 18 Objective Name: 1.02 Authorized Access to Information Systems 19 Control Reference: 01.b User Registration 19 Control Reference: 01.c Privilege Management 20 Control Reference: 01.d User Password Management 20 Control Reference: 01.e Review of User Access Rights 21 Objective Name: 01.03 User Responsibilities 22 Control Reference: 01.f Password Use 22 Control Reference: 01.g Unattended User Equipment 23 Control Reference: 01.h Clear Desk and Clear Screen Policy 23 Objective Name: 01.04 Network Access Control 24 Control Reference: 01.i Policy on the Use of Network Services 24 Control Reference 01.j User Authentication for External Connections 24 Control Reference 01.k Equipment Identification in Networks 25
Control Reference 01.l Remote Diagnostic and Configuration Port Protection 25 Control Reference: 01.m Segregation in Networks 25 Control Reference: 01.n Network Connection Control 26 Control Reference: 01.o Network Routing Control 26 Objective Name: 01.05 Operating System Access Control 26 Control Reference: 01.p Secure Log on Procedures 26 Control Reference 01.q User Identification and Authentication 26 Control Reference 01.r Password Management System 27 Control Reference 01.s Use of System Utilities 27 Control Reference: 01.t Session Time out 28 Objective Name: 01.06 Application and Information Access Control 28 Control Reference: 01.u Limitation of Connection time 28 Control Reference: 01.v Information Access Restriction 28 Control Reference: 01.w Sensitive System Isolation 28 Objective Name: 01.07 Mobile Computing and Teleworking 29 Control Reference: 01.x Mobile Computing and Communications 29 Control Reference: 01.y Teleworking 30 Control Category: 02.0 Human Resources Security 32 Objective Name: 02.01 Prior to Employment 32 Control Reference: 02.a Roles and Responsibilities 32 Objective Name: 02.02 During On Boarding 32 Control Reference: 02.b Screening 32 Control Reference: 02.c Terms and Conditions of Employment 33 Objective Name: 02.03 During Employment 34 Control Reference: 02.d Management Responsibilities 34
Control Reference: 02.e Information Security Awareness, Education and Training 34 Control Reference: 02.f Disciplinary Process 35 Objective Name: 02.04 Termination or Change of Employment 35 Control Reference: 02.g Termination or Change Responsibilities 35 Control Reference: 02.h Return of Assets 35 Control Reference: 02.i Removal of Access Rights 35 Control Category: 03.0 Risk Management 37 Objective Name: 03.01 Risk Management Program 37 Control Reference: 03.a Risk Management Program Development 37 Control Reference: 03.b Performing Risk Assessments 37 Control Reference: 03.c Risk Mitigation 38 Control Reference: 03.d Risk Evaluation 38 Control Category: 04.0 Security Policy 39 Objective Name: 04.01 Information Security Policy 39 Control Reference: 04.a Information Security Policy Document 39 Control Reference 04.b Review of the Information Security Policy 39 Control Category: 05.0 Organization of Information Security 41 Objective Name: 05.01 Internal Organization 41 Control Reference: 05.a Management Commitment to Information Security 41 Control Reference: 05.b Information Security Coordination 41 Control Reference 05.c Allocation of Information Security Responsibilities 42 Control Reference 05.d Authorization Process for Information Assets and Facilities 42 Control Reference: 05.e Confidentiality Agreements 43 Control Reference: 05.f Contact with Authorities 44 Control Reference: 05.g Contact with Special Interest Groups 44
Control Reference: 05.h Independent Review of Information Security 44 Objective Name: 05.02 External Parties 45 Control Reference: 05.i Identification of Risks Related to External Parties 45 Control Reference: 05.j Addressing Security When Dealing with Customers 46 Control Reference: 05.k Addressing Security in Third Party Agreements 47 Control Category: 06.0 Compliance 49 Objective Name: 06.01 Compliance with Legal Requirements 49 Control Reference: 06.a Identification of Applicable Legislation 49 Control Reference: 06.b Intellectual Property Rights 49 Control Reference: 06.c Protection of Organizational Records 50 Control Reference: 06.d Data Protection and Privacy of Covered Information 50 Control Reference: 06.e Prevention of Misuse of Information Assets 50 Control Reference: 06.f Regulation of Cryptographic Controls 51 Objective Name: 06.02 Compliance with Security Policies and Standards and Technical Compliance 51 Control Reference: 06.g Compliance with Security Policies and Standards 51 Control Reference: 06.h Technical Compliance Checking 52 Objective Name: 06.03 Information System Audit Considerations 52 Control Reference: 06.i Information Systems Audit Controls 52 Control Reference: 06.j Protection of Information Systems Audit Tools 52 Control Category: 07.0 Asset Management 53 Objective Name: 07.01 Responsibility for Assets 53 Control Reference: 07.a Inventory of Assets 53 Control Reference: 07.b Ownership of Assets 53 Control Reference: 07.c Acceptable Use of Assets 54 Control Reference: 07.d Classification Guidelines 54
Control Reference: 07.e Information Labeling and Handling 55 Control Category: 08.0 Physical and Environmental Security 56 Objective Name: 08.01 Secure Areas 56 Control Reference: 08.a Physical Security Perimeter 56 Control Reference: 08.b Physical Entry Controls 56 Control Reference: 08.c Securing Offices, Rooms, and Facilities 56 Control Reference: 08.d Protecting Against External and Environmental Threats 56 Control Reference: 08.e Working in Secure Areas 57 Objective Name: 08.02 Equipment Security 57 Control Reference: 08.f Equipment Security 57 Control Reference: 08.g Equipment Siting and Protection 58 Control Reference: 08.h Supporting Utilities 58 Control Reference: 08.i Cabling Security 59 Control Reference: 08.j Equipment Maintenance 59 Control Reference: 08.k Security of Equipment Off Premises 60 Control Reference: 08.l Secure Disposal or Re Use of Equipment 60 Control Reference: 08.m Removal of Property 60 Control Category: 09.0 Communications and Operations Management 62 Objective Name: 09.01 Documented Operating Procedures 62 Control Reference: 09.a Documented Operations Procedures 62 Control Reference: 09.b Change Management 62 Control Reference 09.c Segregation of Duties 62 Control Reference 09.d Separation of Development, Test, and Operational Environments 63 Control Reference: 09.e Service Delivery 63 Control Reference: 09.f Monitoring and Review of Third Party Services 63
Control Reference: 09.g Managing Changes to Third Party Services 63 Objective Name: 09.03 System Planning and Acceptance 64 Control Reference: 09.h Capacity Management 64 Control Reference: 09.i System Acceptance 64 Objective Name: 09.04 Protection Against Malicious and Mobile Code 64 Control Reference: 09.j Controls Against Malicious Code 64 Control Reference: 09.k Controls Against Mobile Code 65 Objective Name: 09.05 Information Back Up 65 Control Reference: 09.l Back up 65 Objective Name: 09.06 Network Security Management 66 Control Reference: 09.m Network Controls 66 Control Reference: 09.n Security of Network Services 67 Objective Name: 09.07 Media Handling 67 Control Reference: 09.o Management of Removable Media 67 Control Reference: 09.p Disposal of Media 67 Control Reference: 09.q Information Handling Procedures 68 Control Reference: 09.r Security of System Documentation 68 Objective Name: 09.08 Exchange of Information 68 Control Reference: 09.s Information Exchange Policies and Procedures 68 Control Reference: 09.t Exchange Agreements 69 Control Reference: 09.u Physical Media in Transit 70 Control Reference: 09.v Electronic Messaging 71 Control Reference: 09.w Interconnected Business Information Systems 71 Objective Name: 09.09 Electronic Commerce Services 72 Control Reference: 09.x Electronic Commerce Services 72
Control Reference: 09.y On Line Transactions 72 Control Reference: 09.z Publicly Available Information 73 Objective Name: 09.10 Monitoring 73 Control Reference: 09.aa Audit Logging 73 Control Reference: 09.ab Monitoring System Use 74 Control Reference: 09.ac Protection of Log Information 74 Control Reference: 09.ad Administrator and Operator Logs 74 Control Reference: 09.ae Fault Logging 74 Control Reference: 09.af Clock Synchronization 75 Control Category: 10.0 Information Systems Acquisition, Development, and Maintenance 76 Objective Name: 10.01 Security Requirements of Information Systems 76 Control Reference: 10.a Security Requirements Analysis and Specification 76 Objective Name: 10.02 Correct Processing in Applications 76 Control Reference: 10.b Input Data Validation 76 Control Reference: 10.c Control of Internal Processing 77 Control Reference: 10.d Message Integrity 78 Control Reference: 10.e Output Data Validation 78 Objective Name: 10.03 Cryptographic Controls 79 Control Reference: 10.f Policy on the Use of Cryptographic Controls 79 Control Reference: 10.g Key Management 79 Objective Name: 10.04 Security of System Files 79 Control Reference: 10.h Control of Operational Software 79 Control Reference: 10.i Protection of System Test Data 80 Control Reference: 10.j Access Control to Program Source Code 80 Objective Name: 10.05 Security In Development and Support Processes 80
Control Reference: 10.k Change Control Procedures 80 Control Reference: 10.l Outsourced Software Development 81 Objective Name: 10.06 Technical Vulnerability Management 81 Control Reference: 10.m Control of Technical Vulnerabilities 81 Control Category: 11.0 Information Security Incident Management 82 Objective Name: 11.01 Reporting Information Security Incidents and Weaknesses 82 Control Reference: 11.a Reporting Information Security Events 82 Control Reference: 11.b Reporting Security Weakness 82 Objective Name: 11.02 Management of Information Security Incidents and Improvements 83 Control Reference: 11.c Responsibilities and Procedures 83 Control Reference: 11.d Learning from Information Security Incidents 83 Control Reference: 11.e Collection of Evidence 83 Control Category: 12.0 Business Continuity Management 84 Objective Name: 12.01 Information Security Aspects of Business Continuity Management 84 Control Reference: 12.a Including Information Security in the Business Continuity Management Process 84 Control Reference: 12.b Business Continuity and Risk Assessment 84 Control Reference: 12.c Developing and Implementing Continuity Plans Including Information Security 84 Control Reference: 12.d Business Continuity Planning Framework 86 Control Reference: 12.e Testing, Maintaining and Re Assessing Business Continuity Plans 87 Appendix A Information Security Management Plan (ISMP) 88 Appendix B Security Requirements for Business Applications 88 Appendix C Access Control Rules 90 Appendix D Task Matrix 91 Appendix E User Access Review Form 94
Appendix F Relevant legislation or contractual obligations 95 Appendix G User Access Control Procedure 96 Appendix H User Access Control Form 97 Appendix I System Configuration Procedure 98 Appendix J Security Awareness and Acceptable Use Policy 101 Appendix K Responsibilities Matrix 107 Appendix L Exemption to Policy and Procedures Form 108 Appendix M Approved Services and Ports 109 Appendix N Application User Permission Matrix 110 Appendix O Password Requirements Matrix 111 Appendix P Password Reset Procedure 112 Appendix Q Active Directory Requirements Matrix 113 Appendix R Wireless Network Requirements Matrix 114 Appendix S Clear Desk and Screen Policy 115 Appendix T Information Classification Matrix 116 Appendix U Network Services Policy 124 Appendix V Business Access Control Policy 127 Appendix W Network Access Procedure 129 Appendix X Shared User ID List and Justification 130 Appendix Y Mobile Computing and Teleworking Policy 131 Appendix Z Security Roles and Responsibilities 134 Appendix AA Job Descriptions 135 Appendix AB List of Systems and Authentication Methods 143 Appendix AC Incident Response Plan 144 Appendix AD Business Continuity/Disaster Recovery Plan 160
Appendix AE Contact with Authorities List 161 Appendix AF Employee Nondisclosure Agreement 162 Appendix AG Risk Management Program 165 Appendix AH Contact with Special Interest Groups 166 Appendix AI Document Retention Schedule and Policy 167 Appendix AJ Management Commitment to Annual Independent Security Assessment 170 Appendix AK Third Party Contract Example 171 Appendix AL Security Awareness Training Program Overview 172 Appendix AM Security Awareness Training Content 173 Appendix AN Business Continuity/Disaster Recovery Annual Test Plan 174 Appendix AO BYOD Policy 175 Appendix AP Operating Policy and Procedures 176 Appendix AQ Change Management Policy 178 Appendix AR System Development Lifecycle (SDLC) 179 Appendix AS Network Diagram (Network Segmentation) 180 Appendix AT Information Assets and Owners List 181 Appendix AU Labeling and Handling Policy and Procedure 182 Appendix AV Internal Audit Program 183 Appendix AW Regulation of Cryptographic Controls 184 Appendix AX Protection of Organizational Records 185 Appendix AY Authorization Process for New Information Assets 186 Appendix AZ Conditions of Employment 187 Appendix BA New Hire Process 188 Appendix BB Incident Reporting Form 189 Appendix BC Forensic Program 190
Appendix BD Vulnerability Management Program 191 Appendix BE Monitoring Program 192 Appendix BF Job Skills Inventory 193 Appendix BG ISMP Corrective Action Procedure (CAP) 194 Appendix BH Intellectual Property Rights (IPR) Policy and Procedure 195 Appendix BI Data Protection and Privacy of Covered Information 196 Appendix BJ Protection of Information Systems Audit Tools 197 Appendix BK Asset Disposal Policy and Procedure 198 Appendix BL Physical Security and Environmental Controls Description 199 Appendix BM Equipment Maintenance Policy and Procedures 200 Appendix BN Security of Off Premises Equipment 201 Appendix BO Removal of Equipment 202 Appendix BP Segregation of Duties Policy 203 Appendix BQ Capacity Management and Monitoring 204 Appendix BR New System Acceptance Procedure 205 Appendix BS Controls Against Malicious Code 206 Appendix BT Controls Against Mobile Code 207 Appendix BU Backup Policy and Procedure 208 Appendix BV Management of Removable Media 209 Appendix BW Physical Media in Transit 210 Appendix BX Electronic Messaging 211 Appendix BY Security of System Documentation 212 Appendix BZ Information Exchange Policy and Procedure 213 Appendix CA Exchange Agreements 215 Appendix CB Interconnected Business Information Systems 216
Appendix CC Electronic Commerce 217 Appendix CD Online Transactions 218 Appendix CE Publically Available Information 219 Appendix CF Audit Logging 220 Appendix CG Clock Synchronization 222 Appendix CH Security Requirements Analysis and Specification 223 Appendix CI Input Data Validation 224 Appendix CJ Control of Internal Processing 225 Appendix CK Message Integrity 226 Appendix CL Output Validation 227 Appendix CM Encryption Key Management 228 Appendix CN Control of Operational Software 229 Appendix CO Protection of System Test Data 230 Appendix CP Access Controls to Program Source Code 231 Appendix CQ Outsourced Software Development 232 Appendix CR Control of Technical Vulnerabilities 233 Appendix CS Reporting Information Security Events 234 Appendix CT Reporting Security Weakness 235