框架
ISO/IEC 27001:2022
概述
这是信息安全管理体系（ISMS）的国际标准。第4至10条为强制性的管理体系要求；附录A列出93项参考控制措施，组织通过风险处理选定这些措施，并在适用性声明中说明选用理由。
适用人群
适用于需要获得国际认可的安全能力证明的组织：常见于向企业和公共部门销售产品或服务的软件及服务公司，尤其是在美国以外地区。
评估方式
由经认可的认证机构进行第1阶段（文件审查）和第2阶段（实施审核）审核。证书有效期为三年，第一年和第二年须进行监督审核。详见如何获得认证。
123
附录 A 控制措施及 ISMS 条款
123
映射到其他框架
100%
已覆盖主题（50/50）
计数：条款按最低层级计数（6.1.1–6.1.3，而非 6.1）。
对比分析
NIST CSF 2.0 vs ISO 27001ISO 27001 vs CIS v8.1ISO 27001 vs SOC 2ISO 27001 vs PCI DSSISO 27001 vs 800-53ISO 27001 vs HIPAAISO 27001 vs GDPRISO 27001 vs NIS2ISO 27001 vs Essential Eight
要求
要求编号和标题均按各框架官方发布的英文原文显示。
| ID | 要求 | 主题 | 映射于 |
|---|---|---|---|
| A.5 Organizational controls · 37 | |||
| A.5.1 | Policies for information security | 治理政策 | 9 / 13 |
| A.5.2 | Information security roles and responsibilities | 角色与职责 | 9 / 13 |
| A.5.3 | Segregation of duties | — | 3 / 13 |
| A.5.4 | Management responsibilities | 角色与职责 | 9 / 13 |
| A.5.5 | Contact with authorities | 报告 | 12 / 13 |
| A.5.6 | Contact with special interest groups | 沟通 | 8 / 13 |
| A.5.7 | Threat intelligence | 威胁情报 | 7 / 13 |
| A.5.8 | Information security in project management | — | 1 / 13 |
| A.5.9 | Inventory of information and other associated assets | 资产管理 | 13 / 13 |
| A.5.10 | Acceptable use of information and other associated assets | — | 2 / 13 |
| A.5.11 | Return of assets | 资产管理 | 13 / 13 |
| A.5.12 | Classification of information | 数据分类 | 9 / 13 |
| A.5.13 | Labelling of information | 数据分类 | 9 / 13 |
| A.5.14 | Information transfer | 数据保护, 邮件安全 | 12 / 13 |
| A.5.15 | Access control | 访问控制, 零信任 | 11 / 13 |
| A.5.16 | Identity management | 访问控制 | 11 / 13 |
| A.5.17 | Authentication information | — | 2 / 13 |
| A.5.18 | Access rights | 访问控制 | 11 / 13 |
| A.5.19 | Information security in supplier relationships | 供应链风险, 供应商风险管理 | 10 / 13 |
| A.5.20 | Addressing information security within supplier agreements | 供应商风险管理 | 10 / 13 |
| A.5.21 | Managing information security in the ICT supply chain | 供应链风险 | 9 / 13 |
| A.5.22 | Monitoring, review and change management of supplier services | 供应商风险管理 | 10 / 13 |
| A.5.23 | Information security for use of cloud services | 云安全 | 11 / 13 |
| A.5.24 | Information security incident management planning and preparation | 事件响应 | 12 / 13 |
| A.5.25 | Assessment and decision on information security events | SIEM / SOC, 事件响应 | 12 / 13 |
| A.5.26 | Response to information security incidents | 事件响应, 缓解, 沟通与恢复 | 12 / 13 |
| A.5.27 | Learning from information security incidents | 经验教训 | 9 / 13 |
| A.5.28 | Collection of evidence | 取证分析 | 7 / 13 |
| A.5.29 | Information security during disruption | 恢复规划, 业务连续性 | 9 / 13 |
| A.5.30 | ICT readiness for business continuity | 恢复规划, 业务连续性, 灾难恢复 | 10 / 13 |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | 合规 | 10 / 13 |
| A.5.32 | Intellectual property rights | — | 2 / 13 |
| A.5.33 | Protection of records | — | 2 / 13 |
| A.5.34 | Privacy and protection of PII | — | 2 / 13 |
| A.5.35 | Independent review of information security | — | 3 / 13 |
| A.5.36 | Compliance with policies, rules and standards for information security | 合规 | 10 / 13 |
| A.5.37 | Documented operating procedures | 治理政策 | 9 / 13 |
| A.6 People controls · 8 | |||
| A.6.1 | Screening | 内部威胁 | 9 / 13 |
| A.6.2 | Terms and conditions of employment | — | 2 / 13 |
| A.6.3 | Information security awareness, education and training | 意识与培训 | 10 / 13 |
| A.6.4 | Disciplinary process | 内部威胁 | 9 / 13 |
| A.6.5 | Responsibilities after termination or change of employment | — | 2 / 13 |
| A.6.6 | Confidentiality or non-disclosure agreements | — | 1 / 13 |
| A.6.7 | Remote working | 移动安全 | 7 / 13 |
| A.6.8 | Information security event reporting | 报告 | 12 / 13 |
| A.7 Physical controls · 14 | |||
| A.7.1 | Physical security perimeters | 物理安全 | 8 / 13 |
| A.7.2 | Physical entry | 物理安全 | 8 / 13 |
| A.7.3 | Securing offices, rooms and facilities | 物理安全 | 8 / 13 |
| A.7.4 | Physical security monitoring | 物理安全 | 8 / 13 |
| A.7.5 | Protecting against physical and environmental threats | 物理安全 | 8 / 13 |
| A.7.6 | Working in secure areas | 物理安全 | 8 / 13 |
| A.7.7 | Clear desk and clear screen | — | 2 / 13 |
| A.7.8 | Equipment siting and protection | 物理安全 | 8 / 13 |
| A.7.9 | Security of assets off-premises | — | 1 / 13 |
| A.7.10 | Storage media | — | 2 / 13 |
| A.7.11 | Supporting utilities | 物理安全 | 8 / 13 |
| A.7.12 | Cabling security | 物理安全 | 8 / 13 |
| A.7.13 | Equipment maintenance | — | 2 / 13 |
| A.7.14 | Secure disposal or re-use of equipment | 资产管理 | 13 / 13 |
| A.8 Technological controls · 34 | |||
| A.8.1 | User endpoint devices | 终端防护, 移动安全 | 10 / 13 |
| A.8.2 | Privileged access rights | 特权访问 | 10 / 13 |
| A.8.3 | Information access restriction | 访问控制 | 11 / 13 |
| A.8.4 | Access to source code | — | 1 / 13 |
| A.8.5 | Secure authentication | 多因素认证, 零信任, API 安全 | 10 / 13 |
| A.8.6 | Capacity management | — | 2 / 13 |
| A.8.7 | Protection against malware | 终端防护 | 10 / 13 |
| A.8.8 | Management of technical vulnerabilities | 漏洞管理, 补丁管理 | 13 / 13 |
| A.8.9 | Configuration management | 安全配置 | 9 / 13 |
| A.8.10 | Information deletion | 数据保护 | 11 / 13 |
| A.8.11 | Data masking | 数据保护 | 11 / 13 |
| A.8.12 | Data leakage prevention | DLP | 7 / 13 |
| A.8.13 | Information backup | 备份与恢复 | 11 / 13 |
| A.8.14 | Redundancy of information processing facilities | 业务连续性, 灾难恢复 | 10 / 13 |
| A.8.15 | Logging | 日志与审计 | 10 / 13 |
| A.8.16 | Monitoring activities | 持续监控, 入侵检测, 异常检测, SIEM / SOC, 内部威胁 | 12 / 13 |
| A.8.17 | Clock synchronization | 日志与审计 | 10 / 13 |
| A.8.18 | Use of privileged utility programs | 特权访问 | 10 / 13 |
| A.8.19 | Installation of software on operational systems | 终端防护 | 10 / 13 |
| A.8.20 | Networks security | 防火墙 / 网络分段, DNS 安全, WAF | 9 / 13 |
| A.8.21 | Security of network services | 防火墙 / 网络分段, DNS 安全 | 9 / 13 |
| A.8.22 | Segregation of networks | 防火墙 / 网络分段, 零信任 | 9 / 13 |
| A.8.23 | Web filtering | — | 1 / 13 |
| A.8.24 | Use of cryptography | 加密 | 10 / 13 |
| A.8.25 | Secure development life cycle | 安全开发 | 8 / 13 |
| A.8.26 | Application security requirements | 安全开发, Web 安全, API 安全 | 8 / 13 |
| A.8.27 | Secure system architecture and engineering principles | — | 1 / 13 |
| A.8.28 | Secure coding | 安全开发 | 8 / 13 |
| A.8.29 | Security testing in development and acceptance | 安全开发 | 8 / 13 |
| A.8.30 | Outsourced development | — | 2 / 13 |
| A.8.31 | Separation of development, test and production environments | — | 2 / 13 |
| A.8.32 | Change management | — | 4 / 13 |
| A.8.33 | Test information | — | 2 / 13 |
| A.8.34 | Protection of information systems during audit testing | — | 1 / 13 |
| ISMS clauses 4–10 · 30 | |||
| Clause 4.1 | Understanding the organization and its context | 业务环境 | 5 / 13 |
| Clause 4.2 | Understanding the needs and expectations of interested parties | 业务环境 | 5 / 13 |
| Clause 4.3 | Determining the scope of the ISMS | — | 2 / 13 |
| Clause 4.4 | Information security management system | — | 1 / 13 |
| Clause 5.1 | Leadership and commitment | — | 2 / 13 |
| Clause 5.2 | Policy | 治理政策 | 9 / 13 |
| Clause 5.3 | Organizational roles, responsibilities and authorities | — | 3 / 13 |
| Clause 6.1.1 | General | 风险管理 | 10 / 13 |
| Clause 6.1.2 | Information security risk assessment | 风险评估 | 10 / 13 |
| Clause 6.1.3 | Information security risk treatment | 风险管理, 风险评估 | 10 / 13 |
| Clause 6.2 | Information security objectives and planning to achieve them | — | 3 / 13 |
| Clause 6.3 | Planning of changes | — | 2 / 13 |
| Clause 7.1 | Resources | — | 2 / 13 |
| Clause 7.2 | Competence | — | 3 / 13 |
| Clause 7.3 | Awareness | 意识与培训 | 10 / 13 |
| Clause 7.4 | Communication | 沟通, 沟通与恢复 | 9 / 13 |
| Clause 7.5.1 | General | — | 1 / 13 |
| Clause 7.5.2 | Creating and updating | — | 1 / 13 |
| Clause 7.5.3 | Control of documented information | — | 1 / 13 |
| Clause 8.1 | Operational planning and control | — | 2 / 13 |
| Clause 8.2 | Information security risk assessment | — | 4 / 13 |
| Clause 8.3 | Information security risk treatment | — | 4 / 13 |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | 合规 | 10 / 13 |
| Clause 9.2.1 | General | — | 1 / 13 |
| Clause 9.2.2 | Internal audit programme | — | 1 / 13 |
| Clause 9.3.1 | General | — | 1 / 13 |
| Clause 9.3.2 | Management review inputs | — | 1 / 13 |
| Clause 9.3.3 | Management review results | — | 1 / 13 |
| Clause 10.1 | Continual improvement | 经验教训 | 9 / 13 |
| Clause 10.2 | Nonconformity and corrective action | — | 2 / 13 |
主题覆盖情况
已映射 ISO 27001 要求的主题（50）：