@neobiotechlabs/neobiotech-dev-agent 0.1.7

package/vendor/dev-docs-templates/templates/mdr_docs/global/information_security/information-security-controls.md

@@ -0,0 +1,966 @@
+# Information Security Controls
+
+| ISO 27001:2023 Section                                      | Document Section |
+|-------------------------------------------------------------|------------------|
+| 6.1.3                                                       | (All)            |
+| Annex A (normative) Information security controls reference | (All)            |
+
+## Summary
+
+This document lists the information security controls as specified in Annex A of ISO/IEC 27001:2023. These
+controls are intended to support the implementation of the Information Security Management System (ISMS)
+within *\<your company name\>* and to address information security risks tailored to the needs of the
+organization.
+
+## Overview Over Information Security Controls
+
+The following table summarizes the controls from Annex A that are applicable to the ISMS. These controls are
+grouped by categories as defined in the standard. For more details on each security control, see the
+implementation section below this overview table.
+
+> Note that you don't have to comply with all controls listed below. Here's what you do instead: For each
+> control, mark it as applicable (yes or no). If you selected "yes", then add some notes on how you
+> implemented it in the sections below this table (scroll down). If you selected "no", add a comment in the
+> "Comment" column on why it's not applicable, and in the "In Compliance?" column, select "n/a".
+
+| Section | Control Category | Control Title                                                           | Applicable? | In Compliance? | Comment |
+|---------|------------------|-------------------------------------------------------------------------|-------------|----------------|---------|
+| 5.1     | Organizational   | Policies for information security                                       | yes / no    | yes / no / n/a |         |
+| 5.2     | Organizational   | Information security roles and responsibilities                         |             |                |         |
+| 5.3     | Organizational   | Segregation of duties                                                   |             |                |         |
+| 5.4     | Organizational   | Management responsibilities                                             |             |                |         |
+| 5.5     | Organizational   | Contact with authorities                                                |             |                |         |
+| 5.6     | Organizational   | Contact with special interest groups                                    |             |                |         |
+| 5.7     | Organizational   | Threat intelligence                                                     |             |                |         |
+| 5.8     | Organizational   | Information security in project management                              |             |                |         |
+| 5.9     | Organizational   | Inventory of information and other associated assets                    |             |                |         |
+| 5.10    | Organizational   | Acceptable use of information and other associated assets               |             |                |         |
+| 5.11    | Organizational   | Return of assets                                                        |             |                |         |
+| 5.12    | Organizational   | Classification of information                                           |             |                |         |
+| 5.13    | Organizational   | Labelling of information                                                |             |                |         |
+| 5.14    | Organizational   | Information transfer                                                    |             |                |         |
+| 5.15    | Organizational   | Access control                                                          |             |                |         |
+| 5.16    | Organizational   | Identity management                                                     |             |                |         |
+| 5.17    | Organizational   | Authentication information                                              |             |                |         |
+| 5.18    | Organizational   | Access rights                                                           |             |                |         |
+| 5.19    | Organizational   | Information security in supplier relationships                          |             |                |         |
+| 5.20    | Organizational   | Addressing information security within supplier agreements              |             |                |         |
+| 5.21    | Organizational   | Managing information security in the ICT supply chain                   |             |                |         |
+| 5.22    | Organizational   | Monitoring, review, and change management of supplier services          |             |                |         |
+| 5.23    | Organizational   | Information security for use of cloud services                          |             |                |         |
+| 5.24    | Organizational   | Information security incident management planning and preparation       |             |                |         |
+| 5.25    | Organizational   | Assessment and decision on information security events                  |             |                |         |
+| 5.26    | Organizational   | Response to information security incidents                              |             |                |         |
+| 5.27    | Organizational   | Learning from information security incidents                            |             |                |         |
+| 5.28    | Organizational   | Collection of evidence                                                  |             |                |         |
+| 5.29    | Organizational   | Information security during disruption                                  |             |                |         |
+| 5.30    | Organizational   | ICT readiness for business continuity                                   |             |                |         |
+| 5.31    | Organizational   | Legal, statutory, regulatory, and contractual requirements              |             |                |         |
+| 5.32    | Organizational   | Intellectual property rights                                            |             |                |         |
+| 5.33    | Organizational   | Protection of records                                                   |             |                |         |
+| 5.34    | Organizational   | Privacy and protection of personal identifiable information (PII)       |             |                |         |
+| 5.35    | Organizational   | Independent review of information security                              |             |                |         |
+| 5.36    | Organizational   | Compliance with policies, rules, and standards for information security |             |                |         |
+| 5.37    | Organizational   | Documented operating procedures                                         |             |                |         |
+| 6.1     | People           | Background verification checks                                          |             |                |         |
+| 6.2     | People           | Terms and conditions of employment                                      |             |                |         |
+| 6.3     | People           | Information security awareness, education, and training                 |             |                |         |
+| 6.4     | People           | Disciplinary process                                                    |             |                |         |
+| 6.5     | People           | Responsibilities after termination or change of employment              |             |                |         |
+| 6.6     | People           | Confidentiality or non-disclosure agreements                            |             |                |         |
+| 6.7     | People           | Remote working                                                          |             |                |         |
+| 6.8     | People           | Information security event reporting                                    |             |                |         |
+| 7.1     | Physical         | Physical security perimeters                                            |             |                |         |
+| 7.2     | Physical         | Physical entry                                                          |             |                |         |
+| 7.3     | Physical         | Securing offices, rooms, and facilities                                 |             |                |         |
+| 7.4     | Physical         | Physical security monitoring                                            |             |                |         |
+| 7.5     | Physical         | Protecting against physical and environmental threats                   |             |                |         |
+| 7.6     | Physical         | Working in secure areas                                                 |             |                |         |
+| 7.7     | Physical         | Clear desk and clear screen                                             |             |                |         |
+| 7.8     | Physical         | Equipment siting and protection                                         |             |                |         |
+| 7.9     | Physical         | Security of assets off-premises                                         |             |                |         |
+| 7.10    | Physical         | Storage media                                                           |             |                |         |
+| 7.11    | Physical         | Supporting utilities                                                    |             |                |         |
+| 7.12    | Physical         | Cabling security                                                        |             |                |         |
+| 7.13    | Physical         | Equipment maintenance                                                   |             |                |         |
+| 7.14    | Physical         | Secure disposal or re-use of equipment                                  |             |                |         |
+| 8.1     | Technological    | User end point devices                                                  |             |                |         |
+| 8.2     | Technological    | Privileged access rights                                                |             |                |         |
+| 8.3     | Technological    | Information access restriction                                          |             |                |         |
+| 8.4     | Technological    | Access to source code                                                   |             |                |         |
+| 8.5     | Technological    | Secure authentication                                                   |             |                |         |
+| 8.6     | Technological    | Capacity management                                                     |             |                |         |
+| 8.7     | Technological    | Protection against malware                                              |             |                |         |
+| 8.8     | Technological    | Management of technical vulnerabilities                                 |             |                |         |
+| 8.9     | Technological    | Configuration management                                                |             |                |         |
+| 8.10    | Technological    | Information deletion                                                    |             |                |         |
+| 8.11    | Technological    | Data masking                                                            |             |                |         |
+| 8.12    | Technological    | Data leakage prevention                                                 |             |                |         |
+| 8.13    | Technological    | Information backup                                                      |             |                |         |
+| 8.14    | Technological    | Redundancy of information processing facilities                         |             |                |         |
+| 8.15    | Technological    | Logging                                                                 |             |                |         |
+| 8.16    | Technological    | Monitoring activities                                                   |             |                |         |
+| 8.17    | Technological    | Clock synchronization                                                   |             |                |         |
+| 8.18    | Technological    | Use of privileged utility programs                                      |             |                |         |
+| 8.19    | Technological    | Installation of software on operational systems                         |             |                |         |
+| 8.20    | Technological    | Networks security                                                       |             |                |         |
+| 8.21    | Technological    | Security of network services                                            |             |                |         |
+| 8.22    | Technological    | Segregation of networks                                                 |             |                |         |
+| 8.23    | Technological    | Web filtering                                                           |             |                |         |
+| 8.24    | Technological    | Use of cryptography                                                     |             |                |         |
+| 8.25    | Technological    | Secure development life cycle                                           |             |                |         |
+| 8.26    | Technological    | Application security requirements                                       |             |                |         |
+| 8.27    | Technological    | Secure system architecture and engineering principles                   |             |                |         |
+| 8.28    | Technological    | Secure coding                                                           |             |                |         |
+| 8.29    | Technological    | Security testing in development and acceptance                          |             |                |         |
+| 8.30    | Technological    | Outsourced development                                                  |             |                |         |
+| 8.31    | Technological    | Separation of development, test and production environments             |             |                |         |
+| 8.32    | Technological    | Change management                                                       |             |                |         |
+| 8.33    | Technological    | Test information                                                        |             |                |         |
+| 8.34    | Technological    | Protection of information systems during audit testing                  |             |                |         |
+
+## Implementation Of Information Security Controls
+
+### 5.1 Policies for information security
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.2 Information security roles and responsibilities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.3 Segregation of duties
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.4 Management responsibilities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.5 Contact with authorities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.6 Contact with special interest groups
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.7 Threat intelligence
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.8 Information security in project management
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.9 Inventory of information and other associated assets
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.10 Acceptable use of information and other associated assets
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.11 Return of assets
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.12 Classification of information
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.13 Labelling of information
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.14 Information transfer
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.15 Access control
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.16 Identity management
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.17 Authentication information
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.18 Access rights
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.19 Information security in supplier relationships
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.20 Addressing information security within supplier agreements
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.21 Managing information security in the ICT supply chain
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.22 Monitoring, review, and change management of supplier services
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.23 Information security for use of cloud services
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.24 Information security incident management planning and preparation
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.25 Assessment and decision on information security events
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.26 Response to information security incidents
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.27 Learning from information security incidents
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.28 Collection of evidence
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.29 Information security during disruption
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.30 ICT readiness for business continuity
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.31 Legal, statutory, regulatory, and contractual requirements
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.32 Intellectual property rights
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.33 Protection of records
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.34 Privacy and protection of personal identifiable information (PII)
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.35 Independent review of information security
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.36 Compliance with policies, rules, and standards for information security
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 5.37 Documented operating procedures
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.1 Background verification checks
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.2 Terms and conditions of employment
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.3 Information security awareness, education, and training
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.4 Disciplinary process
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.5 Responsibilities after termination or change of employment
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.6 Confidentiality or non-disclosure agreements
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.7 Remote working
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 6.8 Information security event reporting
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.1 Physical security perimeters
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.2 Physical entry
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.3 Securing offices, rooms, and facilities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.4 Physical security monitoring
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.5 Protecting against physical and environmental threats
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.6 Working in secure areas
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.7 Clear desk and clear screen
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.8 Equipment siting and protection
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.9 Security of assets off-premises
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.10 Storage media
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.11 Supporting utilities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.12 Cabling security
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.13 Equipment maintenance
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 7.14 Secure disposal or re-use of equipment
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.1 User end point devices
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.2 Privileged access rights
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.3 Information access restriction
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.4 Access to source code
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.5 Secure authentication
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.6 Capacity management
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.7 Protection against malware
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.8 Management of technical vulnerabilities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.9 Configuration management
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.10 Information deletion
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.11 Data masking
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.12 Data leakage prevention
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.13 Information backup
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.14 Redundancy of information processing facilities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.15 Logging
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.16 Monitoring activities
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.17 Clock synchronization
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.18 Use of privileged utility programs
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.19 Installation of software on operational systems
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.20 Networks security
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.21 Security of network services
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.22 Segregation of networks
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.23 Web filtering
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.24 Use of cryptography
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.25 Secure development life cycle
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.26 Application security requirements
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.27 Secure system architecture and engineering principles
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.28 Secure coding
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.29 Security testing in development and acceptance
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.30 Outsourced development
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.31 Separation of development, test and production environments
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.32 Change management
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.33 Test information
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+### 8.34 Protection of information systems during audit testing
+
+* **Assessment:** \<enter the current state at your company\>
+* **Plan:** \<describe your plan\>
+* **Implementation:**
+  * \<measure 1\>
+  * \<measure 2\>
+* **Monitoring and review:** \<describe what you'll do\>
+
+---
+
+Template Copyright [openregulatory.com](https://openregulatory.com). See [template
+license](https://openregulatory.com/template-license).
+
+Please don't remove this notice even if you've modified contents of this template.