A.12

Introduction: Information systems audits are critical for maintaining the security and integrity of an organization’s IT infrastructure.  They help to identify vulnerabilities and weaknesses in the system, providing valuable insights into areas where improvements can be made.  This article provides a sample checklist for organizations to review their policies and […]

Introduction: Restricting software installation is an essential aspect of IT security, as it helps to prevent unauthorized access and data breaches.  To achieve this, organizations must have effective policies, procedures, and practices in place that limit software installation to authorized personnel with appropriate system privileges.  This article provides a sample […]

Introduction: Technical vulnerabilities are a major concern for organizations, as they can leave critical systems and data at risk of exploitation by cybercriminals.  To address this risk, organizations need to have effective policies, procedures, and practices in place to manage technical vulnerabilities.  This article provides a sample checklist for organizations […]

Introduction: The installation of software on operational systems is an important aspect of maintaining the security and functionality of an organization’s IT infrastructure.  To ensure that only fully tested, approved, and currently supported software is installed for production use, organizations need to review their policies, procedures, and practices associated with […]

Introduction: The A.12.4.4 standard of ISO/IEC 27001 requires organizations to ensure that their system clocks are synchronized and accurate.  This ensures that time-sensitive events are recorded accurately, and that systems across the organization are in sync with one another.  This standard is essential to prevent security breaches and ensure operational […]

Introduction: Logging and monitoring are critical components of an organization’s cybersecurity posture.  It is necessary to ensure that the administrator and operator logs are appropriately maintained, monitored, and reviewed to detect any suspicious activities that might cause harm to an organization’s IT infrastructure.  The ISO 27001 standard provides guidelines to […]

Introduction: In the world of information technology, log information is critical to detecting and preventing security incidents.  Properly storing, protecting, and monitoring log information is an essential aspect of an organization’s overall security posture.  Failure to do so can result in lost data, compromised systems, and regulatory compliance violations.  This […]

Introduction: Effective event logging is crucial for detecting and responding to security incidents.  It allows organizations to monitor and record important events in their systems, applications, and networks, enabling them to identify and investigate potential security threats. ISO 27001 provides guidelines on event logging and management, as outlined in control […]

Introduction: Data is a critical asset of any organization, and it is essential to protect it against any potential loss or damage.  A reliable backup and recovery system is an integral part of an organization’s information security management system (ISMS). ISO/IEC 27001:2013, a widely recognized standard for information security management, […]

Introduction: Malware threats are prevalent and pose a significant risk to organizations.  Malware can cause a range of problems, including data breaches, network outages, and financial losses.  Therefore, it is essential for organizations to have adequate controls against malware.  This is where A.12.2.1 of the ISO 27001 standard comes into […]