WHAT ARE THE ISO 114 CONTROLS?

 ISO AND ITS 114 CONTROLS

"ISO and its 114 controls" refers to the International Organization for Standardization (ISO) standard known as ISO 27001, which outlines 114 specific security controls listed in Annex A, covering various aspects of information security management within an organization; these controls are divided into 14 different domains like policy, access control, physical security, and human resources security. 

A key part of this standard is Annex A, which lists 114 security controls that organizations can implement to manage their information security risks.   

These 114 controls are grouped into 14 categories:

INFORMATION SECURITY POLICIES:

This category focuses on establishing and maintaining policies that guide an organization's approach to information security.

ORGANISATION AND INFORMATION SECURITY:

This category defines the structure and processes for managing information security, including roles, responsibilities, and coordination between departments.

HUMAN RESOURCE SECURITY:

This category focuses on securing information through effective human resource management, including background checks, security training, and procedures for handling employee terminations.

ASSET MANAGEMENTS: 

This category involves identifying, classifying, and protecting an organization's assets, including data, hardware, software, and intellectual property.

ACCESS CONTROL:

This category manages user access to information and resources based on the principle of least privilege, including user authentication, authorization, and access provisioning.

CRYPTOGRAPHY: 

This category uses encryption and cryptographic controls to protect sensitive data and communications.

PHYSICAL AND ENVIRONMENTAL SECURITY:

This category protects physical assets, facilities, and resources from unauthorized access, damage, or interference.

OPERATIONAL SECURITY:

This category covers the secure management of day-to-day operations related to data processing, system maintenance, change management, and backup procedures.

COMMUNICATION SECURITY:

This category addresses the security of communication networks, systems, and data, both within the organization and with external parties.

SYSTEM ACQUISITION, DEVELOPMENT AND MAINTENANCE:

This category focuses on ensuring the security of systems throughout their life cycle, from acquisition and development to maintenance and disposal.

SUPPLIER RELATIONSHIP:

This category manages the security risks associated with third-party vendors and suppliers.

INFORMATION SECURITY INCIDENT MANAGEMENT:

This category establishes procedures for handling security incidents and breaches, including detection, response, and recovery

INFORMATION  SECURITY ASPECTS OF BUSINESS CONTINUITY MANAGEMENT:

This category ensures the security of information during business disruptions and disasters.

COMPLIANCE:

 This category ensures compliance with relevant laws, regulations, and standards related to information security.

It is important to note that the ISO 27001 standard was recently updated in 2022. The new version of the standard has made some changes to the controls in Annex A, including reducing the number of controls from 114 to 93. Organizations that are certified to the previous version of the standard will need to update their ISMS to comply with the new version.