bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/iso27001/annex-a-2022.md

@@ -1,132 +1,132 @@
-# ISO 27001:2022 Annex A — All 93 Controls
-
-## Table of Contents
-- [A.5 Organisational Controls (37 controls)](#a5-organisational-controls)
-- [A.6 People Controls (8 controls)](#a6-people-controls)
-- [A.7 Physical Controls (14 controls)](#a7-physical-controls)
-- [A.8 Technological Controls (34 controls)](#a8-technological-controls)
-
----
-
-## A.5 Organisational Controls
-
-| ID | Control Name | Description |
-|----|-------------|-------------|
-| A.5.1 | Policies for information security | Define, approve, publish, and review IS policies |
-| A.5.2 | Information security roles and responsibilities | Assign and communicate IS roles |
-| A.5.3 | Segregation of duties | Separate conflicting duties to reduce fraud/error risk |
-| A.5.4 | Management responsibilities | Require managers to enforce IS policies |
-| A.5.5 | Contact with authorities | Maintain contacts with relevant authorities (law enforcement, regulators) |
-| A.5.6 | Contact with special interest groups | Maintain contacts with security forums, professional bodies |
-| A.5.7 | Threat intelligence ⭐NEW | Collect, analyse, and act on information about IS threats |
-| A.5.8 | Information security in project management | Address IS in project management |
-| A.5.9 | Inventory of information and other associated assets | Identify assets and assign ownership |
-| A.5.10 | Acceptable use of information and other associated assets | Define rules for acceptable use of assets |
-| A.5.11 | Return of assets | Ensure assets are returned upon change/termination |
-| A.5.12 | Classification of information | Classify information per legal, value, and sensitivity needs |
-| A.5.13 | Labelling of information | Apply labels per classification scheme |
-| A.5.14 | Information transfer | Define rules and controls for transferring information |
-| A.5.15 | Access control | Define and implement access control rules based on business/security needs |
-| A.5.16 | Identity management | Manage full lifecycle of identities |
-| A.5.17 | Authentication information | Control allocation and use of authentication info (passwords etc.) |
-| A.5.18 | Access rights | Provision, review, modify, and remove access rights |
-| A.5.19 | Information security in supplier relationships | Define IS requirements for supplier relationships |
-| A.5.20 | Addressing information security within supplier agreements | Include IS in supplier contracts |
-| A.5.21 | Managing information security in the ICT supply chain | Monitor and manage IS risks in the ICT supply chain |
-| A.5.22 | Monitoring, review and change management of supplier services | Regularly review and audit supplier service delivery |
-| A.5.23 | Information security for use of cloud services ⭐NEW | Manage IS for acquisition, use, and exit of cloud services |
-| A.5.24 | Information security incident management planning and preparation | Plan and prepare for IS incident management |
-| A.5.25 | Assessment and decision on information security events | Assess events and classify as incidents if applicable |
-| A.5.26 | Response to information security incidents | Respond to incidents per documented procedures |
-| A.5.27 | Learning from information security incidents | Use knowledge from incidents to improve controls |
-| A.5.28 | Collection of evidence | Define procedures for identifying, collecting, and preserving evidence |
-| A.5.29 | Information security during disruption ⭐NEW | Plan for maintaining IS during disruption |
-| A.5.30 | ICT readiness for business continuity ⭐NEW | Plan, implement, monitor ICT continuity |
-| A.5.31 | Legal, statutory, regulatory and contractual requirements | Identify and document legal/regulatory requirements |
-| A.5.32 | Intellectual property rights | Protect intellectual property per legal requirements |
-| A.5.33 | Protection of records | Protect records from loss, destruction, and falsification |
-| A.5.34 | Privacy and protection of PII | Protect privacy and PII per applicable legislation |
-| A.5.35 | Independent review of information security | Review IS implementation and controls independently |
-| A.5.36 | Compliance with policies, rules and standards | Ensure compliance with IS policies and standards |
-| A.5.37 | Documented operating procedures | Document and maintain operating procedures for IS |
-
----
-
-## A.6 People Controls
-
-| ID | Control Name | Description |
-|----|-------------|-------------|
-| A.6.1 | Screening | Background verification checks on all candidates |
-| A.6.2 | Terms and conditions of employment | Contractual IS responsibilities for employees and contractors |
-| A.6.3 | Information security awareness, education and training | IS awareness and training for all personnel |
-| A.6.4 | Disciplinary process | Formal process for IS policy violations |
-| A.6.5 | Responsibilities after termination or change of employment | Define post-employment IS responsibilities |
-| A.6.6 | Confidentiality or non-disclosure agreements | Require NDAs for personnel and contractors |
-| A.6.7 | Remote working | Define IS policies for remote working |
-| A.6.8 | Information security event reporting | Require personnel to report IS events |
-
----
-
-## A.7 Physical Controls
-
-| ID | Control Name | Description |
-|----|-------------|-------------|
-| A.7.1 | Physical security perimeters | Define and use security perimeters to protect sensitive areas |
-| A.7.2 | Physical entry | Control physical access with authentication mechanisms |
-| A.7.3 | Securing offices, rooms and facilities | Design and apply physical security for offices |
-| A.7.4 | Physical security monitoring ⭐NEW | Continuously monitor premises for unauthorised access |
-| A.7.5 | Protecting against physical and environmental threats | Protect against physical/environmental threats (fire, flood, etc.) |
-| A.7.6 | Working in secure areas | Define procedures for working in secure areas |
-| A.7.7 | Clear desk and clear screen | Require clear desk and clear screen policies |
-| A.7.8 | Equipment siting and protection | Protect equipment from threats and environmental hazards |
-| A.7.9 | Security of assets off-premises | Protect assets used off-site |
-| A.7.10 | Storage media | Manage storage media through acquisition, use, transport, and disposal |
-| A.7.11 | Supporting utilities | Protect equipment from power/utility failures |
-| A.7.12 | Cabling security | Protect cables from interception/damage |
-| A.7.13 | Equipment maintenance | Maintain equipment to ensure availability and integrity |
-| A.7.14 | Secure disposal or re-use of equipment | Securely dispose of or sanitise equipment before re-use |
-
----
-
-## A.8 Technological Controls
-
-| ID | Control Name | Description |
-|----|-------------|-------------|
-| A.8.1 | User end point devices | Protect end-point devices with policies and controls |
-| A.8.2 | Privileged access rights | Restrict, manage, and monitor privileged access |
-| A.8.3 | Information access restriction | Restrict access to information per access control policy |
-| A.8.4 | Access to source code | Restrict access to source code, dev tools, and software libraries |
-| A.8.5 | Secure authentication | Implement secure authentication technologies and procedures |
-| A.8.6 | Capacity management | Monitor and manage resource capacity (storage, compute, network) |
-| A.8.7 | Protection against malware | Implement malware detection and prevention controls |
-| A.8.8 | Management of technical vulnerabilities | Identify, evaluate, and remediate technical vulnerabilities |
-| A.8.9 | Configuration management ⭐NEW | Define, document, implement, and monitor configurations |
-| A.8.10 | Information deletion ⭐NEW | Delete information when no longer required |
-| A.8.11 | Data masking ⭐NEW | Mask data in line with access control and business/legal needs |
-| A.8.12 | Data leakage prevention ⭐NEW | Apply DLP controls to systems, networks, and devices |
-| A.8.13 | Information backup | Maintain and test backup copies of information |
-| A.8.14 | Redundancy of information processing facilities | Implement redundancy to meet availability requirements |
-| A.8.15 | Logging | Produce, store, protect, and analyse event logs |
-| A.8.16 | Monitoring activities ⭐NEW | Monitor networks, systems, and applications for anomalies |
-| A.8.17 | Clock synchronisation | Synchronise clocks across systems to a single reference |
-| A.8.18 | Use of privileged utility programs | Restrict and control use of utility programs with admin capabilities |
-| A.8.19 | Installation of software on operational systems | Control software installations on operational systems |
-| A.8.20 | Networks security | Secure, manage, and control networks and devices |
-| A.8.21 | Security of network services | Define security requirements for all network services |
-| A.8.22 | Segregation of networks | Segregate groups of services, users, and systems |
-| A.8.23 | Web filtering ⭐NEW | Manage access to external websites to reduce exposure |
-| A.8.24 | Use of cryptography | Define rules for use of cryptography (algorithms, key management) |
-| A.8.25 | Secure development life cycle | Establish rules for secure software/system development |
-| A.8.26 | Application security requirements | Identify and approve IS requirements for application development |
-| A.8.27 | Secure system architecture and engineering principles | Define and apply security engineering principles |
-| A.8.28 | Secure coding ⭐NEW | Apply secure coding principles to software development |
-| A.8.29 | Security testing in development and acceptance | Define and perform security testing in development pipelines |
-| A.8.30 | Outsourced development | Supervise and monitor outsourced software development |
-| A.8.31 | Separation of development, test and production environments | Separate dev, test, and prod environments |
-| A.8.32 | Change management | Manage changes to IS, systems, and processes |
-| A.8.33 | Test information | Select, protect, and manage test data appropriately |
-| A.8.34 | Protection of information systems during audit testing | Plan and control audit activities to minimise operational disruption |
-
----
-
-⭐NEW = New control introduced in ISO 27001:2022 (not present in 2013 version)
+# ISO 27001:2022 Annex A — All 93 Controls
+
+## Table of Contents
+- [A.5 Organisational Controls (37 controls)](#a5-organisational-controls)
+- [A.6 People Controls (8 controls)](#a6-people-controls)
+- [A.7 Physical Controls (14 controls)](#a7-physical-controls)
+- [A.8 Technological Controls (34 controls)](#a8-technological-controls)
+
+---
+
+## A.5 Organisational Controls
+
+| ID | Control Name | Description |
+|----|-------------|-------------|
+| A.5.1 | Policies for information security | Define, approve, publish, and review IS policies |
+| A.5.2 | Information security roles and responsibilities | Assign and communicate IS roles |
+| A.5.3 | Segregation of duties | Separate conflicting duties to reduce fraud/error risk |
+| A.5.4 | Management responsibilities | Require managers to enforce IS policies |
+| A.5.5 | Contact with authorities | Maintain contacts with relevant authorities (law enforcement, regulators) |
+| A.5.6 | Contact with special interest groups | Maintain contacts with security forums, professional bodies |
+| A.5.7 | Threat intelligence ⭐NEW | Collect, analyse, and act on information about IS threats |
+| A.5.8 | Information security in project management | Address IS in project management |
+| A.5.9 | Inventory of information and other associated assets | Identify assets and assign ownership |
+| A.5.10 | Acceptable use of information and other associated assets | Define rules for acceptable use of assets |
+| A.5.11 | Return of assets | Ensure assets are returned upon change/termination |
+| A.5.12 | Classification of information | Classify information per legal, value, and sensitivity needs |
+| A.5.13 | Labelling of information | Apply labels per classification scheme |
+| A.5.14 | Information transfer | Define rules and controls for transferring information |
+| A.5.15 | Access control | Define and implement access control rules based on business/security needs |
+| A.5.16 | Identity management | Manage full lifecycle of identities |
+| A.5.17 | Authentication information | Control allocation and use of authentication info (passwords etc.) |
+| A.5.18 | Access rights | Provision, review, modify, and remove access rights |
+| A.5.19 | Information security in supplier relationships | Define IS requirements for supplier relationships |
+| A.5.20 | Addressing information security within supplier agreements | Include IS in supplier contracts |
+| A.5.21 | Managing information security in the ICT supply chain | Monitor and manage IS risks in the ICT supply chain |
+| A.5.22 | Monitoring, review and change management of supplier services | Regularly review and audit supplier service delivery |
+| A.5.23 | Information security for use of cloud services ⭐NEW | Manage IS for acquisition, use, and exit of cloud services |
+| A.5.24 | Information security incident management planning and preparation | Plan and prepare for IS incident management |
+| A.5.25 | Assessment and decision on information security events | Assess events and classify as incidents if applicable |
+| A.5.26 | Response to information security incidents | Respond to incidents per documented procedures |
+| A.5.27 | Learning from information security incidents | Use knowledge from incidents to improve controls |
+| A.5.28 | Collection of evidence | Define procedures for identifying, collecting, and preserving evidence |
+| A.5.29 | Information security during disruption ⭐NEW | Plan for maintaining IS during disruption |
+| A.5.30 | ICT readiness for business continuity ⭐NEW | Plan, implement, monitor ICT continuity |
+| A.5.31 | Legal, statutory, regulatory and contractual requirements | Identify and document legal/regulatory requirements |
+| A.5.32 | Intellectual property rights | Protect intellectual property per legal requirements |
+| A.5.33 | Protection of records | Protect records from loss, destruction, and falsification |
+| A.5.34 | Privacy and protection of PII | Protect privacy and PII per applicable legislation |
+| A.5.35 | Independent review of information security | Review IS implementation and controls independently |
+| A.5.36 | Compliance with policies, rules and standards | Ensure compliance with IS policies and standards |
+| A.5.37 | Documented operating procedures | Document and maintain operating procedures for IS |
+
+---
+
+## A.6 People Controls
+
+| ID | Control Name | Description |
+|----|-------------|-------------|
+| A.6.1 | Screening | Background verification checks on all candidates |
+| A.6.2 | Terms and conditions of employment | Contractual IS responsibilities for employees and contractors |
+| A.6.3 | Information security awareness, education and training | IS awareness and training for all personnel |
+| A.6.4 | Disciplinary process | Formal process for IS policy violations |
+| A.6.5 | Responsibilities after termination or change of employment | Define post-employment IS responsibilities |
+| A.6.6 | Confidentiality or non-disclosure agreements | Require NDAs for personnel and contractors |
+| A.6.7 | Remote working | Define IS policies for remote working |
+| A.6.8 | Information security event reporting | Require personnel to report IS events |
+
+---
+
+## A.7 Physical Controls
+
+| ID | Control Name | Description |
+|----|-------------|-------------|
+| A.7.1 | Physical security perimeters | Define and use security perimeters to protect sensitive areas |
+| A.7.2 | Physical entry | Control physical access with authentication mechanisms |
+| A.7.3 | Securing offices, rooms and facilities | Design and apply physical security for offices |
+| A.7.4 | Physical security monitoring ⭐NEW | Continuously monitor premises for unauthorised access |
+| A.7.5 | Protecting against physical and environmental threats | Protect against physical/environmental threats (fire, flood, etc.) |
+| A.7.6 | Working in secure areas | Define procedures for working in secure areas |
+| A.7.7 | Clear desk and clear screen | Require clear desk and clear screen policies |
+| A.7.8 | Equipment siting and protection | Protect equipment from threats and environmental hazards |
+| A.7.9 | Security of assets off-premises | Protect assets used off-site |
+| A.7.10 | Storage media | Manage storage media through acquisition, use, transport, and disposal |
+| A.7.11 | Supporting utilities | Protect equipment from power/utility failures |
+| A.7.12 | Cabling security | Protect cables from interception/damage |
+| A.7.13 | Equipment maintenance | Maintain equipment to ensure availability and integrity |
+| A.7.14 | Secure disposal or re-use of equipment | Securely dispose of or sanitise equipment before re-use |
+
+---
+
+## A.8 Technological Controls
+
+| ID | Control Name | Description |
+|----|-------------|-------------|
+| A.8.1 | User end point devices | Protect end-point devices with policies and controls |
+| A.8.2 | Privileged access rights | Restrict, manage, and monitor privileged access |
+| A.8.3 | Information access restriction | Restrict access to information per access control policy |
+| A.8.4 | Access to source code | Restrict access to source code, dev tools, and software libraries |
+| A.8.5 | Secure authentication | Implement secure authentication technologies and procedures |
+| A.8.6 | Capacity management | Monitor and manage resource capacity (storage, compute, network) |
+| A.8.7 | Protection against malware | Implement malware detection and prevention controls |
+| A.8.8 | Management of technical vulnerabilities | Identify, evaluate, and remediate technical vulnerabilities |
+| A.8.9 | Configuration management ⭐NEW | Define, document, implement, and monitor configurations |
+| A.8.10 | Information deletion ⭐NEW | Delete information when no longer required |
+| A.8.11 | Data masking ⭐NEW | Mask data in line with access control and business/legal needs |
+| A.8.12 | Data leakage prevention ⭐NEW | Apply DLP controls to systems, networks, and devices |
+| A.8.13 | Information backup | Maintain and test backup copies of information |
+| A.8.14 | Redundancy of information processing facilities | Implement redundancy to meet availability requirements |
+| A.8.15 | Logging | Produce, store, protect, and analyse event logs |
+| A.8.16 | Monitoring activities ⭐NEW | Monitor networks, systems, and applications for anomalies |
+| A.8.17 | Clock synchronisation | Synchronise clocks across systems to a single reference |
+| A.8.18 | Use of privileged utility programs | Restrict and control use of utility programs with admin capabilities |
+| A.8.19 | Installation of software on operational systems | Control software installations on operational systems |
+| A.8.20 | Networks security | Secure, manage, and control networks and devices |
+| A.8.21 | Security of network services | Define security requirements for all network services |
+| A.8.22 | Segregation of networks | Segregate groups of services, users, and systems |
+| A.8.23 | Web filtering ⭐NEW | Manage access to external websites to reduce exposure |
+| A.8.24 | Use of cryptography | Define rules for use of cryptography (algorithms, key management) |
+| A.8.25 | Secure development life cycle | Establish rules for secure software/system development |
+| A.8.26 | Application security requirements | Identify and approve IS requirements for application development |
+| A.8.27 | Secure system architecture and engineering principles | Define and apply security engineering principles |
+| A.8.28 | Secure coding ⭐NEW | Apply secure coding principles to software development |
+| A.8.29 | Security testing in development and acceptance | Define and perform security testing in development pipelines |
+| A.8.30 | Outsourced development | Supervise and monitor outsourced software development |
+| A.8.31 | Separation of development, test and production environments | Separate dev, test, and prod environments |
+| A.8.32 | Change management | Manage changes to IS, systems, and processes |
+| A.8.33 | Test information | Select, protect, and manage test data appropriately |
+| A.8.34 | Protection of information systems during audit testing | Plan and control audit activities to minimise operational disruption |
+
+---
+
+⭐NEW = New control introduced in ISO 27001:2022 (not present in 2013 version)

package/src/bmad-plus/packs/pack-shield/references/iso27001/control-mapping.md

@@ -1,153 +1,153 @@
-# ISO 27001 Control Mapping: 2013 ↔ 2022
-
-This file provides cross-reference mapping between ISO 27001:2013 (114 controls) and ISO 27001:2022 (93 controls).
-
-## Summary of Changes
-- Controls reduced from **114 → 93**
-- Domains reduced from **14 → 4 themes**
-- **11 new controls** added (marked ⭐)
-- **Merged**: Many 2013 controls were consolidated into single 2022 controls
-- **Renamed**: Several controls were renamed for clarity
-- **Deleted**: No controls were fully removed — all 2013 concepts are still covered
-
----
-
-## 2022 → 2013 Mapping
-
-### A.5 Organisational Controls (2022) → 2013 Equivalents
-
-| 2022 Control | 2022 Name | 2013 Equivalent(s) |
-|-------------|-----------|-------------------|
-| A.5.1 | Policies for information security | A.5.1.1, A.5.1.2 |
-| A.5.2 | IS roles and responsibilities | A.6.1.1 |
-| A.5.3 | Segregation of duties | A.6.1.2 |
-| A.5.4 | Management responsibilities | A.7.2.1 |
-| A.5.5 | Contact with authorities | A.6.1.3 |
-| A.5.6 | Contact with special interest groups | A.6.1.4 |
-| A.5.7 | Threat intelligence | ⭐ NEW |
-| A.5.8 | IS in project management | A.6.1.5 |
-| A.5.9 | Inventory of information and assets | A.8.1.1, A.8.1.2 |
-| A.5.10 | Acceptable use of information and assets | A.8.1.3 |
-| A.5.11 | Return of assets | A.8.1.4 |
-| A.5.12 | Classification of information | A.8.2.1 |
-| A.5.13 | Labelling of information | A.8.2.2 |
-| A.5.14 | Information transfer | A.13.2.1, A.13.2.2, A.13.2.3 |
-| A.5.15 | Access control | A.9.1.1, A.9.1.2 |
-| A.5.16 | Identity management | A.9.2.1 |
-| A.5.17 | Authentication information | A.9.2.4, A.9.3.1, A.9.4.3 |
-| A.5.18 | Access rights | A.9.2.2, A.9.2.5, A.9.2.6 |
-| A.5.19 | IS in supplier relationships | A.15.1.1 |
-| A.5.20 | IS within supplier agreements | A.15.1.2 |
-| A.5.21 | Managing IS in the ICT supply chain | A.15.1.3 |
-| A.5.22 | Monitoring/review of supplier services | A.15.2.1, A.15.2.2 |
-| A.5.23 | IS for use of cloud services | ⭐ NEW |
-| A.5.24 | IS incident management planning | A.16.1.1 |
-| A.5.25 | Assessment of IS events | A.16.1.4 |
-| A.5.26 | Response to IS incidents | A.16.1.5 |
-| A.5.27 | Learning from IS incidents | A.16.1.6 |
-| A.5.28 | Collection of evidence | A.16.1.7 |
-| A.5.29 | IS during disruption | A.17.1.1, A.17.1.2 |
-| A.5.30 | ICT readiness for business continuity | ⭐ NEW |
-| A.5.31 | Legal, statutory, regulatory requirements | A.18.1.1 |
-| A.5.32 | Intellectual property rights | A.18.1.2 |
-| A.5.33 | Protection of records | A.18.1.3 |
-| A.5.34 | Privacy and protection of PII | A.18.1.4 |
-| A.5.35 | Independent review of IS | A.18.2.1 |
-| A.5.36 | Compliance with policies, rules, standards | A.18.2.2, A.18.2.3 |
-| A.5.37 | Documented operating procedures | A.12.1.1 |
-
-### A.6 People Controls (2022) → 2013 Equivalents
-
-| 2022 Control | 2022 Name | 2013 Equivalent(s) |
-|-------------|-----------|-------------------|
-| A.6.1 | Screening | A.7.1.1 |
-| A.6.2 | Terms and conditions of employment | A.7.1.2 |
-| A.6.3 | IS awareness, education and training | A.7.2.2 |
-| A.6.4 | Disciplinary process | A.7.2.3 |
-| A.6.5 | Responsibilities after termination | A.7.3.1 |
-| A.6.6 | Confidentiality or NDA agreements | A.13.2.4 |
-| A.6.7 | Remote working | A.6.2.2 |
-| A.6.8 | IS event reporting | A.16.1.2, A.16.1.3 |
-
-### A.7 Physical Controls (2022) → 2013 Equivalents
-
-| 2022 Control | 2022 Name | 2013 Equivalent(s) |
-|-------------|-----------|-------------------|
-| A.7.1 | Physical security perimeters | A.11.1.1 |
-| A.7.2 | Physical entry | A.11.1.2, A.11.1.6 |
-| A.7.3 | Securing offices, rooms and facilities | A.11.1.3 |
-| A.7.4 | Physical security monitoring | ⭐ NEW |
-| A.7.5 | Protecting against physical/environmental threats | A.11.1.4 |
-| A.7.6 | Working in secure areas | A.11.1.5 |
-| A.7.7 | Clear desk and clear screen | A.11.2.9 |
-| A.7.8 | Equipment siting and protection | A.11.2.1 |
-| A.7.9 | Security of assets off-premises | A.11.2.6 |
-| A.7.10 | Storage media | A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.5 |
-| A.7.11 | Supporting utilities | A.11.2.2 |
-| A.7.12 | Cabling security | A.11.2.3 |
-| A.7.13 | Equipment maintenance | A.11.2.4 |
-| A.7.14 | Secure disposal or re-use of equipment | A.11.2.7 |
-
-### A.8 Technological Controls (2022) → 2013 Equivalents
-
-| 2022 Control | 2022 Name | 2013 Equivalent(s) |
-|-------------|-----------|-------------------|
-| A.8.1 | User end point devices | A.6.2.1, A.11.2.8 |
-| A.8.2 | Privileged access rights | A.9.2.3 |
-| A.8.3 | Information access restriction | A.9.4.1 |
-| A.8.4 | Access to source code | A.9.4.5 |
-| A.8.5 | Secure authentication | A.9.4.2 |
-| A.8.6 | Capacity management | A.12.1.3 |
-| A.8.7 | Protection against malware | A.12.2.1 |
-| A.8.8 | Management of technical vulnerabilities | A.12.6.1, A.12.6.2 |
-| A.8.9 | Configuration management | ⭐ NEW |
-| A.8.10 | Information deletion | ⭐ NEW |
-| A.8.11 | Data masking | ⭐ NEW |
-| A.8.12 | Data leakage prevention | ⭐ NEW |
-| A.8.13 | Information backup | A.12.3.1 |
-| A.8.14 | Redundancy of information processing facilities | A.17.2.1 |
-| A.8.15 | Logging | A.12.4.1, A.12.4.2, A.12.4.3 |
-| A.8.16 | Monitoring activities | ⭐ NEW |
-| A.8.17 | Clock synchronisation | A.12.4.4 |
-| A.8.18 | Use of privileged utility programs | A.9.4.4 |
-| A.8.19 | Installation of software on operational systems | A.12.5.1 |
-| A.8.20 | Networks security | A.13.1.1 |
-| A.8.21 | Security of network services | A.13.1.2 |
-| A.8.22 | Segregation of networks | A.13.1.3 |
-| A.8.23 | Web filtering | ⭐ NEW |
-| A.8.24 | Use of cryptography | A.10.1.1, A.10.1.2, A.18.1.5 |
-| A.8.25 | Secure development life cycle | A.14.2.1 |
-| A.8.26 | Application security requirements | A.14.1.1, A.14.1.2, A.14.1.3 |
-| A.8.27 | Secure system architecture and engineering principles | A.14.2.5 |
-| A.8.28 | Secure coding | ⭐ NEW |
-| A.8.29 | Security testing in development and acceptance | A.14.2.8, A.14.2.9 |
-| A.8.30 | Outsourced development | A.14.2.7 |
-| A.8.31 | Separation of dev, test and production environments | A.12.1.4, A.14.2.6 |
-| A.8.32 | Change management | A.12.1.2, A.14.2.2, A.14.2.3, A.14.2.4 |
-| A.8.33 | Test information | A.14.3.1 |
-| A.8.34 | Protection of IS during audit testing | A.12.7.1 |
-
----
-
-## Controls Only in 2013 (removed/merged in 2022)
-No controls were deleted outright. All were merged:
-- A.8.2.3 (Handling of assets) → merged into A.5.10 (Acceptable use)
-- A.16.1.3 (Reporting weaknesses) → merged into A.6.8 (IS event reporting)
-- A.17.1.3 (Verify IS continuity) → merged into A.5.29
-
----
-
-## 11 New Controls in 2022 (not in 2013)
-| 2022 ID | Name |
-|---------|------|
-| A.5.7 | Threat intelligence |
-| A.5.23 | Information security for use of cloud services |
-| A.5.30 | ICT readiness for business continuity |
-| A.7.4 | Physical security monitoring |
-| A.8.9 | Configuration management |
-| A.8.10 | Information deletion |
-| A.8.11 | Data masking |
-| A.8.12 | Data leakage prevention |
-| A.8.16 | Monitoring activities |
-| A.8.23 | Web filtering |
-| A.8.28 | Secure coding |
+# ISO 27001 Control Mapping: 2013 ↔ 2022
+
+This file provides cross-reference mapping between ISO 27001:2013 (114 controls) and ISO 27001:2022 (93 controls).
+
+## Summary of Changes
+- Controls reduced from **114 → 93**
+- Domains reduced from **14 → 4 themes**
+- **11 new controls** added (marked ⭐)
+- **Merged**: Many 2013 controls were consolidated into single 2022 controls
+- **Renamed**: Several controls were renamed for clarity
+- **Deleted**: No controls were fully removed — all 2013 concepts are still covered
+
+---
+
+## 2022 → 2013 Mapping
+
+### A.5 Organisational Controls (2022) → 2013 Equivalents
+
+| 2022 Control | 2022 Name | 2013 Equivalent(s) |
+|-------------|-----------|-------------------|
+| A.5.1 | Policies for information security | A.5.1.1, A.5.1.2 |
+| A.5.2 | IS roles and responsibilities | A.6.1.1 |
+| A.5.3 | Segregation of duties | A.6.1.2 |
+| A.5.4 | Management responsibilities | A.7.2.1 |
+| A.5.5 | Contact with authorities | A.6.1.3 |
+| A.5.6 | Contact with special interest groups | A.6.1.4 |
+| A.5.7 | Threat intelligence | ⭐ NEW |
+| A.5.8 | IS in project management | A.6.1.5 |
+| A.5.9 | Inventory of information and assets | A.8.1.1, A.8.1.2 |
+| A.5.10 | Acceptable use of information and assets | A.8.1.3 |
+| A.5.11 | Return of assets | A.8.1.4 |
+| A.5.12 | Classification of information | A.8.2.1 |
+| A.5.13 | Labelling of information | A.8.2.2 |
+| A.5.14 | Information transfer | A.13.2.1, A.13.2.2, A.13.2.3 |
+| A.5.15 | Access control | A.9.1.1, A.9.1.2 |
+| A.5.16 | Identity management | A.9.2.1 |
+| A.5.17 | Authentication information | A.9.2.4, A.9.3.1, A.9.4.3 |
+| A.5.18 | Access rights | A.9.2.2, A.9.2.5, A.9.2.6 |
+| A.5.19 | IS in supplier relationships | A.15.1.1 |
+| A.5.20 | IS within supplier agreements | A.15.1.2 |
+| A.5.21 | Managing IS in the ICT supply chain | A.15.1.3 |
+| A.5.22 | Monitoring/review of supplier services | A.15.2.1, A.15.2.2 |
+| A.5.23 | IS for use of cloud services | ⭐ NEW |
+| A.5.24 | IS incident management planning | A.16.1.1 |
+| A.5.25 | Assessment of IS events | A.16.1.4 |
+| A.5.26 | Response to IS incidents | A.16.1.5 |
+| A.5.27 | Learning from IS incidents | A.16.1.6 |
+| A.5.28 | Collection of evidence | A.16.1.7 |
+| A.5.29 | IS during disruption | A.17.1.1, A.17.1.2 |
+| A.5.30 | ICT readiness for business continuity | ⭐ NEW |
+| A.5.31 | Legal, statutory, regulatory requirements | A.18.1.1 |
+| A.5.32 | Intellectual property rights | A.18.1.2 |
+| A.5.33 | Protection of records | A.18.1.3 |
+| A.5.34 | Privacy and protection of PII | A.18.1.4 |
+| A.5.35 | Independent review of IS | A.18.2.1 |
+| A.5.36 | Compliance with policies, rules, standards | A.18.2.2, A.18.2.3 |
+| A.5.37 | Documented operating procedures | A.12.1.1 |
+
+### A.6 People Controls (2022) → 2013 Equivalents
+
+| 2022 Control | 2022 Name | 2013 Equivalent(s) |
+|-------------|-----------|-------------------|
+| A.6.1 | Screening | A.7.1.1 |
+| A.6.2 | Terms and conditions of employment | A.7.1.2 |
+| A.6.3 | IS awareness, education and training | A.7.2.2 |
+| A.6.4 | Disciplinary process | A.7.2.3 |
+| A.6.5 | Responsibilities after termination | A.7.3.1 |
+| A.6.6 | Confidentiality or NDA agreements | A.13.2.4 |
+| A.6.7 | Remote working | A.6.2.2 |
+| A.6.8 | IS event reporting | A.16.1.2, A.16.1.3 |
+
+### A.7 Physical Controls (2022) → 2013 Equivalents
+
+| 2022 Control | 2022 Name | 2013 Equivalent(s) |
+|-------------|-----------|-------------------|
+| A.7.1 | Physical security perimeters | A.11.1.1 |
+| A.7.2 | Physical entry | A.11.1.2, A.11.1.6 |
+| A.7.3 | Securing offices, rooms and facilities | A.11.1.3 |
+| A.7.4 | Physical security monitoring | ⭐ NEW |
+| A.7.5 | Protecting against physical/environmental threats | A.11.1.4 |
+| A.7.6 | Working in secure areas | A.11.1.5 |
+| A.7.7 | Clear desk and clear screen | A.11.2.9 |
+| A.7.8 | Equipment siting and protection | A.11.2.1 |
+| A.7.9 | Security of assets off-premises | A.11.2.6 |
+| A.7.10 | Storage media | A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.5 |
+| A.7.11 | Supporting utilities | A.11.2.2 |
+| A.7.12 | Cabling security | A.11.2.3 |
+| A.7.13 | Equipment maintenance | A.11.2.4 |
+| A.7.14 | Secure disposal or re-use of equipment | A.11.2.7 |
+
+### A.8 Technological Controls (2022) → 2013 Equivalents
+
+| 2022 Control | 2022 Name | 2013 Equivalent(s) |
+|-------------|-----------|-------------------|
+| A.8.1 | User end point devices | A.6.2.1, A.11.2.8 |
+| A.8.2 | Privileged access rights | A.9.2.3 |
+| A.8.3 | Information access restriction | A.9.4.1 |
+| A.8.4 | Access to source code | A.9.4.5 |
+| A.8.5 | Secure authentication | A.9.4.2 |
+| A.8.6 | Capacity management | A.12.1.3 |
+| A.8.7 | Protection against malware | A.12.2.1 |
+| A.8.8 | Management of technical vulnerabilities | A.12.6.1, A.12.6.2 |
+| A.8.9 | Configuration management | ⭐ NEW |
+| A.8.10 | Information deletion | ⭐ NEW |
+| A.8.11 | Data masking | ⭐ NEW |
+| A.8.12 | Data leakage prevention | ⭐ NEW |
+| A.8.13 | Information backup | A.12.3.1 |
+| A.8.14 | Redundancy of information processing facilities | A.17.2.1 |
+| A.8.15 | Logging | A.12.4.1, A.12.4.2, A.12.4.3 |
+| A.8.16 | Monitoring activities | ⭐ NEW |
+| A.8.17 | Clock synchronisation | A.12.4.4 |
+| A.8.18 | Use of privileged utility programs | A.9.4.4 |
+| A.8.19 | Installation of software on operational systems | A.12.5.1 |
+| A.8.20 | Networks security | A.13.1.1 |
+| A.8.21 | Security of network services | A.13.1.2 |
+| A.8.22 | Segregation of networks | A.13.1.3 |
+| A.8.23 | Web filtering | ⭐ NEW |
+| A.8.24 | Use of cryptography | A.10.1.1, A.10.1.2, A.18.1.5 |
+| A.8.25 | Secure development life cycle | A.14.2.1 |
+| A.8.26 | Application security requirements | A.14.1.1, A.14.1.2, A.14.1.3 |
+| A.8.27 | Secure system architecture and engineering principles | A.14.2.5 |
+| A.8.28 | Secure coding | ⭐ NEW |
+| A.8.29 | Security testing in development and acceptance | A.14.2.8, A.14.2.9 |
+| A.8.30 | Outsourced development | A.14.2.7 |
+| A.8.31 | Separation of dev, test and production environments | A.12.1.4, A.14.2.6 |
+| A.8.32 | Change management | A.12.1.2, A.14.2.2, A.14.2.3, A.14.2.4 |
+| A.8.33 | Test information | A.14.3.1 |
+| A.8.34 | Protection of IS during audit testing | A.12.7.1 |
+
+---
+
+## Controls Only in 2013 (removed/merged in 2022)
+No controls were deleted outright. All were merged:
+- A.8.2.3 (Handling of assets) → merged into A.5.10 (Acceptable use)
+- A.16.1.3 (Reporting weaknesses) → merged into A.6.8 (IS event reporting)
+- A.17.1.3 (Verify IS continuity) → merged into A.5.29
+
+---
+
+## 11 New Controls in 2022 (not in 2013)
+| 2022 ID | Name |
+|---------|------|
+| A.5.7 | Threat intelligence |
+| A.5.23 | Information security for use of cloud services |
+| A.5.30 | ICT readiness for business continuity |
+| A.7.4 | Physical security monitoring |
+| A.8.9 | Configuration management |
+| A.8.10 | Information deletion |
+| A.8.11 | Data masking |
+| A.8.12 | Data leakage prevention |
+| A.8.16 | Monitoring activities |
+| A.8.23 | Web filtering |
+| A.8.28 | Secure coding |