ISO 27001 Statement of Applicability (SoA) Generator

A top-level security policy and topic policies that management approves, people can read, and you review on a set cycle or after big changes.

Named owners for the ISMS, for risks and assets, and security duties written into roles, so nobody has to guess who decides.

Conflicting tasks sit with different people, for example whoever requests access does not approve it, and whoever writes code does not ship it alone.

Managers make sure their staff and contractors actually follow the security rules that apply to their jobs.

You know which regulators, data protection authorities and police units to call, and when you must report to them.

Security forums, industry groups and national CERT alerts keep the team informed and connected.

Advisories and threat information relevant to your technology are collected, judged and used to adjust patching and detection.

Every project, not only IT projects, checks its security needs and risks from start to finish.

A current list of information, systems, devices, services and accounts, each with an owner.

Clear rules for how people may use and handle information, devices and systems.

Laptops, phones, badges, keys and information come back when someone leaves or a contract ends.

Information is sorted into levels such as Public, Internal, Confidential and Restricted by how much harm its loss would do.

Documents, files and systems show their classification so people and tools can handle them correctly.

Rules and agreements for moving information by e-mail, file sharing, removable media, APIs or in person.

Access to information, systems and premises follows business need and least privilege, written down as rules.

Every person and system has a unique identity that is created, changed and removed through a controlled process.

Passwords, tokens and keys are issued, stored and reset securely, and users know how to protect them.

Access is approved before it is granted, reviewed regularly, adjusted when roles change and removed when no longer needed.

The security risks of using each supplier’s products and services are identified and managed.

Contracts set out the security each supplier must provide and how you can check it.

Risks in the chain behind your technology (hardware, software, cloud and their sub-suppliers) are managed.

Suppliers’ security and service levels are monitored and reviewed, and changes to their services are assessed.

How cloud services are chosen, configured, run and left, with the shared responsibilities written down.

An incident process with roles, contacts, playbooks and communication is ready before it is needed.

Each security event is assessed to decide whether it is an incident and how serious it is.

Incidents are handled by the documented procedure: contain, eradicate, recover and communicate.

What incidents teach is used to strengthen controls so the same thing is less likely to happen again.

Evidence about security events is collected and preserved so it can be relied on, also in disciplinary or legal action.

Security stays at the planned level during a crisis or outage, not only after recovery.

Systems can be recovered within agreed recovery time and recovery point objectives, and this is tested.

The laws, regulations and contracts that affect your security (including rules on encryption) are listed and kept current.

Software licences and other intellectual property are respected and tracked.

Records are kept for the required time and protected from loss, tampering and unauthorised access or release.

The privacy and data protection duties that apply to personal data are identified and met.

Someone independent of the work, such as an internal auditor, reviews the security approach at planned intervals.

Managers and system owners check regularly that policies and standards are followed, and fix what is not.

The procedures for running systems (backups, start-up, restores, handling failures) are written down and available.

Background checks on candidates, proportionate to the role and to what local law allows.

Contracts state the security responsibilities of staff and of the organisation.

Security awareness for everyone and training for specialist roles, repeated and kept up to date.

A known, fair disciplinary process for people who break the security rules.

Duties that continue after someone leaves or changes role, such as confidentiality, are defined and communicated.

Confidentiality agreements fit what must be protected, are signed and are reviewed.

Security measures for people who work from home, while travelling or anywhere off-site.

An easy, known channel for anyone to report a suspected security event quickly.

The boundaries around areas that hold information or equipment are defined and protected.

Entry to secure areas is controlled with badges, keys, reception and visitor logs.

Offices, rooms and server rooms are designed and fitted with physical security that matches what they hold.

Premises are watched for unauthorised entry, for example with alarms, guards or CCTV.

Protection against fire, flood, earthquake, heat and similar threats to premises and equipment.

Rules for working in secure areas, such as supervised visitors and no unapproved cameras or phones.

Papers and media are put away and screens are locked when people step away.

Equipment is placed and protected to reduce environmental risks and unauthorised access.

Laptops, phones and papers taken outside the premises are protected.

USB drives, disks, tapes and paper are handled by their classification from purchase to disposal.

Power, cooling and other utilities have protection against failure, such as a UPS or generator.

Power and network cables are protected from damage, interception and interference.

Equipment is maintained properly, by authorised people, so it stays available and intact.

Data and licensed software are securely erased or destroyed before equipment is re-used or thrown away.

Laptops, phones and tablets that hold or reach your information are configured and managed securely.

Administrator rights are limited to the people who need them, separately approved and monitored.

Systems enforce the access rules, so users see only the data and functions their role needs.

Read and write access to code, build tools and software libraries is controlled.

Log-in methods match the sensitivity of what they protect, with multi-factor authentication where it matters.

Use of computing, storage and network capacity is monitored and planned so services keep running.

Anti-malware protection on systems, backed by users who know how to spot and report threats.

Vulnerabilities are found by scanning and advisories, judged for exposure, and fixed within set timelines.

Secure settings for systems, services and networks are defined, applied, monitored and reviewed.

Information is deleted when it is no longer needed, on systems, devices and at suppliers.

Masking, pseudonymisation or anonymisation hides sensitive data where people or systems do not need to see it.

Measures that detect and stop sensitive data leaving through e-mail, uploads, devices or other channels.

Backups of data, software and systems are made, protected and test-restored as the backup policy says.

Enough redundancy (another zone, region, site or device) to meet the availability you promise.

Logs of user activity, errors and security events are recorded, protected from change and kept for a set time.

Networks, systems and applications are watched for unusual behaviour, and alerts are acted on.

Systems use the same trusted time source, so logs from different places line up.

Tools that can bypass system controls are restricted to a few people and their use is controlled.

Only approved software is installed on production systems and work devices, in a controlled way.

Networks and network devices are secured, managed and controlled.

The security features and service levels of network services, in-house or bought, are defined and monitored.

Networks are split into zones (for example production, office and guest) with controlled traffic between them.

Access to malicious or unwanted websites is filtered to reduce exposure to harmful content.

Rules for encryption and keys: which algorithms, where encryption is required, and how keys are managed.

Security is built into every stage of how software and systems are developed.

Security requirements are specified and approved when applications are built or bought.

Written principles for designing secure systems (defence in depth, least privilege, secure defaults) are applied.

Developers follow secure coding practices and tools check the code.

Security tests are defined and run before software goes live.

Development done by suppliers is directed, monitored and reviewed against your security requirements.

Development, test and production are kept apart, with production protected from untested changes.

Changes to systems and services are requested, assessed, approved, tested and recorded.

Test data is chosen and protected carefully, and real personal data is masked or avoided in tests.

Audits and security tests on live systems are planned and agreed so they do not disrupt the business.