Transcription
ISO 27001 & ISO 27017 & ISO 27018Cloud Documentation ote: The documentation should preferably be implemented in the order in which it is listed here. Theorder of implementation of documentation related to Annex A is defined in the Risk Treatment Plan.Please note that some documents in this Toolkit are not mandatory – depending on the size andcomplexity of your company, you can choose whether to implement them or e forDocument andRecord Control012Document name0102Relevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 270017.5ISO/IEC 27018A.9.2Preparations forthe ProjectProject PlanIdentification ofRequirementsISO/IEC 270014.2, A.18.1.1302Procedure forIdentification ofRequirementsISO/IEC 2701718.1.1ISO/IEC 27018A.9.2, A.11.1402.1Appendix 1 – List ofLegal, Regulatory,Contractual andOtherRequirementsISO/IEC 270014.2, A.18.1.1ISO/IEC 2701718.1.1**ISO/IEC 27018A.11.1ver 3.9, 2020-03-23Page 1 of 15
No.5DocumentcodeDocument name03ISMS Scope03ISMS ScopeDocument04General PoliciesRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 270014.3ISO/IEC 270015.2, 5.3604.1InformationSecurity PolicyISO/IEC 270175.1.1ISO/IEC 270185.1.1, A.9.2ISO/IEC 27001,clauses 1.3,A.14.2.4704.2Cloud SecurityPolicyISO/IEC 270176.1.1, 9.4.4,12.1.3, 12.4.1,12.4.4, .1.5,CLD.12.4.5,CLD.13.1.4ISO/IEC 2701812.4.1, A.9.2ver 3.9, 2020-03-23Page 2 of 15
No.DocumentcodeDocument nameRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 27001A.5.1.1, .4804.3Policy for DataPrivacy in the CloudISO/IEC 270175.1.1, 12.4.1,16.1.2ISO/IEC 270185.1.1, 11.2.7,12.4.1, 12.4.2,12.4.3, 16.1.2,A.1.1, A.2.1,A.2.2, A.5.1,A.5.2, A.7.1,A.9.1, A.9.2,A.10.1, A.10.205905Risk Assessmentand Risk TreatmentRisk Assessmentand Risk TreatmentMethodologyISO/IEC 270016.1.2, 6.1.3, 8.2,8.3ISO/IEC 270016.1.2, 8.21005.1Appendix 1 – RiskAssessment Table1105.2Appendix 2 – RiskTreatment TableISO/IEC 270016.1.3, 8.305.3Appendix 3 – RiskAssessment andTreatment ReportISO/IEC 270018.2, 8.31206Applicability ofControlsver 3.9, 2020-03-23Page 3 of 15
No.DocumentcodeDocument nameRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 270016.1.3 d)1306Statement ofApplicabilityISO 27017, allclauses fromsections 5 to 18and Annex AISO 27018, allclauses fromsections 5 to 18and Annex A141507ImplementationPlan07Risk Treatment Plan08Annex A – SecurityControls***A.6Organization ofInformationSecurityA.6.1Bring Your OwnDevice (BYOD)PolicyISO/IEC 270016.1.3, 6.2, 8.3ISO/IEC 27001A.6.2.1, A.6.2.2,A.13.2.1ISO/IEC 2701813.2.1, A.9.2ISO/IEC 27001A.6.2, A.11.2.616A.6.2Mobile Device andTeleworking PolicyISO/IEC 2701711.2.6ISO/IEC 2701811.2.6ver 3.9, 2020-03-23Page 4 of 15
No.DocumentcodeA.7Document nameRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*Human ResourceSecurityISO/IEC tyStatementISO/IEC 270177.1.2, 13.2.4,15.1.2**ISO/IEC 270187.1, 13.2.4, 15,A.10.1ISO/IEC 27001A.7.1.218A.7.2Statement ofAcceptance of ISMSDocumentsISO/IEC 270177.1.2**ISO/IEC 270187.1A.8Asset ManagementISO/IEC 27001A.8.1.1, A.8.1.219A.8.1Inventory of AssetsISO/IEC 270178.1.1, 8.1.2ver 3.9, 2020-03-23**Page 5 of 15
No.2021DocumentcodeA.8.2A.8.3Document nameIT Security PolicyInformationClassification PolicyRelevantclauses in thestandardISO/IEC 27001A.6.2.1, A.6.2.2,A.8.1.2, A.8.1.3,A.8.1.4, datoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018***ISO/IEC 27001A.8.2.1, A.8.2.2,A.8.2.3, A.8.3.1,A.8.3.3, A.9.4.1,A.13.2.3ISO/IEC 2701715.1.2A.9Access Controlver 3.9, 2020-03-23Page 6 of 15
No.DocumentcodeDocument nameRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 27001A.9.1.1, A.9.1.2,A.9.2.1, A.9.2.2,A.9.2.3, A.9.2.4,A.9.2.5, A.9.2.6,A.9.3.1, A.9.4.1,A.9.4.322A.9.1Access ControlPolicyISO/IEC 270176.1.1, 9.2.1,9.2.2, 9.2.3,9.2.4, 9.2.5,9.2.6, 9.3.1,9.4.1, 9.4.2,9.4.3**ISO/IEC 270186.1.1, 9.1, 9.2.1,9.2.2, 9.2.3,9.2.4, 9.2.5,9.2.6, 9.4.2,A.9.2, A.10.8,A.10.9, A.10.1023A.9.2Password Policy(Note: it may beimplemented aspart of AccessControl Policy)ISO/IEC 27001A.9.2.1, A.9.2.2,A.9.2.4, A.9.3.1,A.9.4.3ISO/IEC 270179.2.4ISO/IEC 270189.2.1, A.9.2A.10Cryptographyver 3.9, 2020-03-23Page 7 of 15
No.24DocumentcodeA.10Document namePolicy on the Use ofEncryptionRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 27001A.10.1.1,A.10.1.2,A.18.1.5ISO/IEC 2701710.1.1, 18.1.5ISO/IEC 27018A.9.2, A.11.1A.11252627A.11.1A.11.2A.11.3A.12Physical andEnvironmentalSecurityClear Desk andClear Screen Policy(Note: it may beimplemented aspart of IT SecurityPolicy)Disposal andDestruction Policy(Note: it may beimplemented aspart of SecurityProcedures for ITDepartment)Procedures forWorking in SecureAreasISO/IEC 27001A.11.2.8,A.11.2.9ISO/IEC 27001A.8.3.2, A.11.2.7ISO/IEC 2701711.2.7ISO/IEC2701811.2.7,A.9.2, A.10.7,A.10.13ISO/IEC 27001A.11.1.5Operations Securityver 3.9, 2020-03-23Page 8 of 15
No.28DocumentcodeA.12.1Document nameSecurity Proceduresfor IT DepartmentRelevantclauses in thestandardISO/IEC .2,A.14.2.4Mandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018***ISO/IEC 2701711.2.7, 12.1.2,12.1.3, 12.3.1,12.4.1, 12.4.3ISO/IEC 2701811.2.7, 12.1.4,12.3.1, 12.4.1,13.2.1, A.9.2,A.10.4, A.10.5,A.10.6, A.11.229A.12.2ChangeManagement Policy(Note: it may beimplemented aspart of SecurityProcedures for ITDepartment)ISO/IEC 27001A.12.1.2,A.14.2.4ISO/IEC 2701712.1.2ISO/IEC 27018A.9.2ver 3.9, 2020-03-23Page 9 of 15
No.303132DocumentcodeA.12.3Document nameBackup Policy(Note: it may beimplemented aspart of SecurityProcedures for tionTransfer Policy(Note: it may beimplemented aspart of SecurityProcedures for ITDepartment)A.14System AcquisitionDevelopment andMaintenanceA.14SecureDevelopment PolicyRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 27001A.12.3.1ISO/IEC 2701712.3.1ISO/IEC 27018A.12.3.1, A.9.2ISO/IEC 27001A.13.2.1,A.13.2.2ISO/IEC 27018A.9.2, A.9.3,A.10.4, A.10.5ISO/IEC IEC 2701714.2.1, 14.2.9ISO/IEC 27018A.9.2ver 3.9, 2020-03-23Page 10 of 15
No.33DocumentcodeA.14.1A.1534A.15.1Document nameAppendix 1 –Specification ofInformation SystemRequirementsRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 27001A.14.1.1ISO/IEC 2701714.1.1**ISO/IEC 27018A.4.1SupplierRelationshipsSupplier SecurityPolicyISO/IEC 27001A.7.1.1, A.7.1.2,A.7.2.2, .1,A.15.2.2**ISO/IEC 270177.2.2, 15.1.2,15.1.3,CLD.8.1.5ISO/IEC 270187.2.2, A.9.2ver 3.9, 2020-03-23Page 11 of 15
No.DocumentcodeDocument nameRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC curity Clauses forClients, Suppliersand PartnersISO/IEC 270176.1.1, 6.1.3,8.2.2, 9.2.1,9.2.2, 9.2.4,9.4.1, 9.4.4,10.1.1, 11.2.7,12.1.2, 12.1.3,12.3.1, 12.4.1,12.4.4, 12.6.1,14.1.1, 14.2.1,15.1.2, 15.1.3,16.1.1, 16.1.2,16.1.7, 18.1.1,18.1.3, 18.1.5,18.2.1,CLD.6.3.1,CLD.8.1.5**ISO/IEC 270185.1.1, 6.1.1,6.1.3, 9.2, 9.4.1,10.1.1, 12.1.4,12.3.1, 12.4.1,16.1, 18.2.1,A.1.1, A.5.1,A.9.1, A.10.1,A.10.3, A.10.4,A.10.5, A.10.6,A.10.11,A.10.12, A.11.1ver 3.9, 2020-03-23Page 12 of 15
No.DocumentcodeA.1636A.16Document nameRelevantclauses in thestandardMandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*InformationSecurity EC .16.1.5,A.16.1.6,A.16.1.7**ISO/IEC 2701716.1.1,16.1.2,16.1.7,18.1.2ISO/IEC 2701816.1.1, A.9.23738A.16.140ISO/IEC 27001A.16.1.6A.17Business ContinuityA.17Disaster RecoveryPlanISO/IEC 27001A.17.1.2Training &AwarenessTraining andAwareness PlanISO/IEC 270017.2, 7.30939Appendix 1 –Incident Log0910Internal Audit10Internal AuditProcedure**ISO/IEC 270019.2ver 3.9, 2020-03-23Page 13 of 15
No.4142DocumentcodeDocument nameRelevantclauses in thestandard10.1Appendix 1 –Annual InternalAudit ProgramISO/IEC 270019.210.2Appendix 2 –Internal AuditReportISO/IEC 270019.2Mandatoryaccordingto ISO27001Mandatory Mandatoryaccordingaccordingto ISOto ISO27017*27018*ISO/IEC 270019.24310.3Appendix 3 –Internal AuditChecklistISO/IEC 27017,all clauses fromsections 5 to 18and Annex AISO/IEC 27018,all clauses fromsections 5 to 18and Annex rtISO/IEC 270016.2, 9.1ManagementReview MinutesISO/IEC 270019.312Corrective Actions12Procedure forCorrective ActionISO/IEC 2700110.112.1Appendix 1 –Corrective ActionFormISO/IEC 2700110.1ver 3.9, 2020-03-23Page 14 of 15
*The marked documents are developed according to ISO 27017 and/or ISO 27018.**The listed documents are only mandatory if the corresponding controls are identified as applicablein the Statement of Applicability.***Folder “Annex A” does not include a separate folder for ISO 27001 section “A.18 – Compliance”because the documentation that covers controls from this section can be found in these folders: 02 – Procedure for Identification of Requirements08, A.8 – Asset Management08, A.10 – Cryptographyver 3.9, 2020-03-23Page 15 of 15
ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit 017-iso-27018-cloud-documentation-toolkit/ Note: The documentation should preferably be implemented in the order in which it is listed here. The
