ISO 27001 Compliance Skill

Purpose

Ensures systems and processes comply with ISO 27001:2022 Information Security Management System (ISMS) requirements.

Rules

Key Controls for Web Applications

A.8.24 Use of Cryptography:

• •TLS 1.2+ for all communications
• •AES-256 for data at rest
• •Secure key management

A.8.25 Secure Development Life Cycle:

• •Security requirements in design
• •Code review processes
• •Security testing (SAST/DAST)

A.8.26 Application Security Requirements:

• •Input validation
• •Output encoding
• •Authentication and authorization
• •Session management

A.8.16 Monitoring Activities:

• •Security event logging
• •Log retention (90 days minimum)
• •Monitoring for anomalies

A.5.7 Threat Intelligence:

• •Vulnerability scanning
• •Threat intelligence feeds
• •Incident tracking

Documentation Requirements

MUST MAINTAIN:

• •Information Security Policy
• •Risk Assessment and Treatment Plan
• •Statement of Applicability (SoA)
• •Access Control Policy
• •Cryptographic Controls Policy
• •Incident Response Plan
• •Business Continuity Plan
• •Acceptable Use Policy
• •Data Classification Policy

Audit Preparation

MUST PROVIDE:

• •Evidence of control implementation
• •Logs and monitoring records
• •Incident records
• •Change management records
• •Risk assessments
• •Management review minutes

Related Policies

All ISMS policies at: https://github.com/Hack23/ISMS-PUBLIC