Annex A Controls
The Off-Premises Security Reality Check Here's a truth that makes security managers uncomfortable: your organization's most sensitive data probably spends more time outside your secure perimeter than inside it. Laptops on trains, backup tapes in courier vans, engineers working from coffee shops with questionable WiFi—this
Annex A Controls
A.7.5 — Protecting Against Physical and Environmental Threats Environmental threats don't care about your NIST framework implementation or how sophisticated your SIEM deployment is. During one particularly memorable audit, I watched a CTO explain their million-dollar cybersecurity investment while standing ankle-deep in water from a burst pipe
Annex A Controls
A.7.1 Physical Security Perimeters: Beyond the Garden Fence Mentality Control A.7.1 demands that organizations define and use security perimeters to protect areas containing information and associated assets. In fifteen years of auditing, I've seen everything from impressive-looking mantrap entries that you can bypass through
Annex A Controls
The Reality Gap Between Procedures and Practice I've certified organizations with pristine incident response procedures, elegant escalation matrices, and comprehensive security playbooks that collect digital dust because nobody reports anything meaningful. The infrastructure exists. The technology exists. But the cultural foundation doesn't. Here's what
Annex A Controls
A.6.6 and A.6.7 — NDAs and Remote Working Security: The Foundation Most Organizations Get Wrong Every organization I audit tells me they "take confidentiality seriously" and have "robust remote working policies." Then I ask to see their NDA register, and they look at
Annex A Controls
The Human Factor in Information Security: Why Controls A.6.4 and A.6.5 Matter After fifteen years of conducting ISO 27001 audits, I can tell you that the most sophisticated cyberattacks often pale in comparison to the damage caused by a single disgruntled employee with legitimate access. Controls
Annex A Controls
A.6.1 Screening — Risk-Proportionate Verification That Actually Works Control A.6.1 requires background verification checks on all personnel candidates, carried out prior to joining and ongoing, taking into consideration applicable laws and being proportional to business requirements, information classification, and perceived risks. What this means in practice: your
Annex A Controls
Understanding ISO 27001's Privacy Control Framework Controls A.5.34 through A.5.37 represent some of the most misunderstood requirements in ISO 27001:2022. I've seen organizations treat these as separate checkbox exercises—privacy team drafts A.5.34, internal audit owns A.5.35,
Annex A Controls
A.5.29 through A.5.33 — Business Continuity and Compliance: The Controls That Make or Break Crisis Response I've been called into organizations six months after they've survived what they thought was their worst-case scenario, only to discover they'd created vulnerabilities far worse
Annex A Controls
The Incident Management Reality Check Most organizations I audit have incident management processes that look immaculate on paper and crumble spectacularly when something actually goes wrong. I've watched security teams fumble through their first real breach while frantically searching SharePoint for a procedure document nobody has read since
Annex A Controls
Understanding Controls A.5.23 and A.5.24: The Cloud Security Lifecycle After fifteen years of auditing organizations across every sector, I've watched cloud adoption evolve from experimental to essential—and I've seen the same security mistakes repeated countless times. Controls A.5.23 and
Annex A Controls
The Foundation Crisis: Understanding A.5.19 Information Security in Supplier Relationships The audit still haunts me. A mid-sized fintech with pristine internal controls—hardened infrastructure, quarterly penetration tests, mandatory security awareness training. Then I asked for their supplier inventory. The IT director sheepishly produced a spreadsheet from 2022 listing