ISO 27001 Compliance Skill
Purpose
Ensures systems and processes comply with ISO 27001:2022 Information Security Management System (ISMS) requirements.
Rules
Key Controls for Web Applications
A.8.24 Use of Cryptography:
- TLS 1.2+ for all communications
- AES-256 for data at rest
- Secure key management
A.8.25 Secure Development Life Cycle:
- Security requirements in design
- Code review processes
- Security testing (SAST/DAST)
A.8.26 Application Security Requirements:
- Input validation
- Output encoding
- Authentication and authorization
- Session management
A.8.16 Monitoring Activities:
- Security event logging
- Log retention (90 days minimum)
- Monitoring for anomalies
A.5.7 Threat Intelligence:
- Vulnerability scanning
- Threat intelligence feeds
- Incident tracking
Documentation Requirements
MUST MAINTAIN:
- Information Security Policy
- Risk Assessment and Treatment Plan
- Statement of Applicability (SoA)
- Access Control Policy
- Cryptographic Controls Policy
- Incident Response Plan
- Business Continuity Plan
- Acceptable Use Policy
- Data Classification Policy
Audit Preparation
MUST PROVIDE:
- Evidence of control implementation
- Logs and monitoring records
- Incident records
- Change management records
- Risk assessments
- Management review minutes
Related Policies
All ISMS policies at: https://github.com/Hack23/ISMS-PUBLIC