Each domain maps to Annex A controls. Our platform tracks tasks, templates, and evidence for every domain.
Clause A.5
Information Security Policies
Establish the governing policy framework, review cycles, and management direction.
2 controls
Clause A.6
Organisation of Information Security
Define roles, responsibilities, segregation of duties, and remote working policy.
7 controls
Clause A.7
Human Resource Security
Background checks, security awareness training, disciplinary process, and exit procedures.
6 controls
Clause A.8
Asset Management
Inventory of assets, ownership, classification scheme, and media handling procedures.
10 controls
Clause A.9
Access Control
Business requirements for access, user provisioning, system and application access controls.
14 controls
Clause A.10
Cryptography
Cryptographic policy, key management, and encryption standards for data at rest and in transit.
2 controls
Clause A.11
Physical and Environmental Security
Secure areas, equipment protection, clear desk/screen, and physical access controls.
15 controls
Clause A.12
Operations Security
Operational procedures, change management, capacity planning, malware protection, and logging.
14 controls
Clause A.13
Communications Security
Network security, segregation, information transfer, and messaging policies.
7 controls
Clause A.14
System Acquisition & Development
Security requirements in development, secure coding, and protection of test data.
13 controls
Clause A.15
Supplier Relationships
Supplier security policy, supplier agreements, and monitoring of supplier service delivery.
5 controls
Clause A.16
Information Security Incident Management
Incident response procedures, reporting obligations, evidence collection, and lessons learned.
7 controls
Clause A.17
Business Continuity
ICT continuity, redundancy, BCP, and BIA aligned with information security requirements.
4 controls
Clause A.18
Compliance
Legal, regulatory, and contractual requirements. Independent information security review.
8 controls
