ISO 27001 Technological Controls

To ensure security of information accessed through user endpoint devices.

To prevent unauthorized access and compromise of systems through misuse of privileged access rights.

To ensure authorized access and prevent unauthorized access to information.

To prevent unauthorized access to source code and maintain integrity of code.

To ensure the authenticity of users and protect against unauthorized access.

To ensure systems perform adequately and ensure required system availability.

To ensure that information and information processing facilities are protected against malware.

To prevent exploitation of technical vulnerabilities.

To establish and maintain secure configurations of systems.

To prevent unnecessary retention of information and reduce exposure to unauthorized disclosure.

To limit exposure of sensitive data while maintaining usability for testing and development.

To detect and prevent unauthorized transmission of sensitive information.

To protect against loss of data and ensure business continuity.

To ensure availability of critical systems through redundancy.

To record events and generate evidence for investigation and monitoring.

To detect anomalous behavior and potential security incidents.

To ensure accuracy of logs and support forensic investigation and audit.

To prevent misuse of privileged utilities that could bypass security controls.

To prevent unauthorized software installation and maintain system integrity.

To ensure the protection of information in networks and supporting information processing facilities.

To ensure the security of network services and the information they carry.

To separate networks into security zones based on risk and trust levels.

To manage access to external websites and reduce security risks.

To ensure proper and effective use of cryptography to protect confidentiality, authenticity and integrity of information.

To ensure that information security is designed and implemented within the development lifecycle of systems.

To ensure security is built into applications from requirements through implementation.

To ensure systems are designed with security in mind using established security principles.

To prevent security vulnerabilities in application code.

To identify and address security vulnerabilities before production deployment.

To ensure outsourced development meets security requirements and follows secure practices.

To reduce the risks of unauthorized access or changes to the production environment.

To ensure changes are made in a controlled manner with minimal disruption and risk.

To ensure test data does not contain production data that could be exposed.

To minimize disruption to business processes from audit activities.