Free library. 154 requirements, cited to their clauses.
Evidence library
Filter 154 held evidence requirements by framework, code or word. Open any one for the requirement, the evidence records and the cross-framework links. Build a request list.
| Clause | Requirement | Framework | Domain | Evidence |
|---|---|---|---|---|
| 5.1 | Policies for information security | ISO 27001:2022 | Organizational controls | 5 |
| 5.2 | Information security roles and responsibilities | ISO 27001:2022 | Organizational controls | 5 |
| 5.3 | Segregation of duties | ISO 27001:2022 | Organizational controls | 5 |
| 5.4 | Management responsibilities | ISO 27001:2022 | Organizational controls | 5 |
| 5.5 | Contact with authorities | ISO 27001:2022 | Organizational controls | 5 |
| 5.6 | Contact with special interest groups | ISO 27001:2022 | Organizational controls | 5 |
| 5.7 | Threat intelligence | ISO 27001:2022 | Organizational controls | 5 |
| 5.8 | Information security in project management | ISO 27001:2022 | Organizational controls | 5 |
| 5.9 | Inventory of information and other associated assets | ISO 27001:2022 | Organizational controls | 5 |
| 5.10 | Acceptable use of information and other associated assets | ISO 27001:2022 | Organizational controls | 5 |
| 5.11 | Return of assets | ISO 27001:2022 | Organizational controls | 5 |
| 5.12 | Classification of information | ISO 27001:2022 | Organizational controls | 5 |
| 5.13 | Labelling of information | ISO 27001:2022 | Organizational controls | 5 |
| 5.14 | Information transfer | ISO 27001:2022 | Organizational controls | 5 |
| 5.15 | Access control | ISO 27001:2022 | Organizational controls | 5 |
| 5.16 | Identity management | ISO 27001:2022 | Organizational controls | 5 |
| 5.17 | Authentication information | ISO 27001:2022 | Organizational controls | 5 |
| 5.18 | Access rights | ISO 27001:2022 | Organizational controls | 5 |
| 5.19 | Information security in supplier relationships | ISO 27001:2022 | Organizational controls | 5 |
| 5.20 | Addressing information security within supplier agreements | ISO 27001:2022 | Organizational controls | 5 |
| 5.21 | Managing information security in the information and communication technology (ICT) supply chain | ISO 27001:2022 | Organizational controls | 5 |
| 5.22 | Monitoring, review and change management of supplier services | ISO 27001:2022 | Organizational controls | 5 |
| 5.23 | Information security for use of cloud services | ISO 27001:2022 | Organizational controls | 5 |
| 5.24 | Information security incident management planning and preparation | ISO 27001:2022 | Organizational controls | 5 |
| 5.25 | Assessment and decision on information security events | ISO 27001:2022 | Organizational controls | 5 |
| 5.26 | Response to information security incidents | ISO 27001:2022 | Organizational controls | 5 |
| 5.27 | Learning from information security incidents | ISO 27001:2022 | Organizational controls | 5 |
| 5.28 | Collection of evidence | ISO 27001:2022 | Organizational controls | 5 |
| 5.29 | Information security during disruption | ISO 27001:2022 | Organizational controls | 5 |
| 5.30 | ICT readiness for business continuity | ISO 27001:2022 | Organizational controls | 5 |
| 5.31 | Legal, statutory, regulatory and contractual requirements | ISO 27001:2022 | Organizational controls | 5 |
| 5.32 | Intellectual property rights | ISO 27001:2022 | Organizational controls | 5 |
| 5.33 | Protection of records | ISO 27001:2022 | Organizational controls | 5 |
| 5.34 | Privacy and protection of personal identifiable information (PII) | ISO 27001:2022 | Organizational controls | 5 |
| 5.35 | Independent review of information security | ISO 27001:2022 | Organizational controls | 5 |
| 5.36 | Compliance with policies, rules and standards for information security | ISO 27001:2022 | Organizational controls | 5 |
| 5.37 | Documented operating procedures | ISO 27001:2022 | Organizational controls | 5 |
| 6.1 | Screening | ISO 27001:2022 | People controls | 5 |
| 6.2 | Terms and conditions of employment | ISO 27001:2022 | People controls | 5 |
| 6.3 | Information security awareness, education and training | ISO 27001:2022 | People controls | 5 |
| 6.4 | Disciplinary process | ISO 27001:2022 | People controls | 5 |
| 6.5 | Responsibilities after termination or change of employment | ISO 27001:2022 | People controls | 5 |
| 6.6 | Confidentiality or non-disclosure agreements | ISO 27001:2022 | People controls | 5 |
| 6.7 | Remote working | ISO 27001:2022 | People controls | 5 |
| 6.8 | Information security event reporting | ISO 27001:2022 | People controls | 5 |
| 7.1 | Physical security perimeters | ISO 27001:2022 | Physical controls | 5 |
| 7.2 | Physical entry | ISO 27001:2022 | Physical controls | 5 |
| 7.3 | Securing offices, rooms and facilities | ISO 27001:2022 | Physical controls | 5 |
| 7.4 | Physical security monitoring | ISO 27001:2022 | Physical controls | 5 |
| 7.5 | Protecting against physical and environmental threats | ISO 27001:2022 | Physical controls | 5 |
| 7.6 | Working in secure areas | ISO 27001:2022 | Physical controls | 5 |
| 7.7 | Clear desk and clear screen | ISO 27001:2022 | Physical controls | 5 |
| 7.8 | Equipment siting and protection | ISO 27001:2022 | Physical controls | 5 |
| 7.9 | Security of assets off-premises | ISO 27001:2022 | Physical controls | 5 |
| 7.10 | Storage media | ISO 27001:2022 | Physical controls | 5 |
| 7.11 | Supporting utilities | ISO 27001:2022 | Physical controls | 5 |
| 7.12 | Cabling security | ISO 27001:2022 | Physical controls | 5 |
| 7.13 | Equipment maintenance | ISO 27001:2022 | Physical controls | 5 |
| 7.14 | Secure disposal or re-use of equipment | ISO 27001:2022 | Physical controls | 5 |
| 8.1 | User end point devices | ISO 27001:2022 | Technological controls | 5 |
| 8.2 | Privileged access rights | ISO 27001:2022 | Technological controls | 5 |
| 8.3 | Information access restriction | ISO 27001:2022 | Technological controls | 5 |
| 8.4 | Access to source code | ISO 27001:2022 | Technological controls | 5 |
| 8.5 | Secure authentication | ISO 27001:2022 | Technological controls | 5 |
| 8.6 | Capacity management | ISO 27001:2022 | Technological controls | 5 |
| 8.7 | Protection against malware | ISO 27001:2022 | Technological controls | 5 |
| 8.8 | Management of technical vulnerabilities | ISO 27001:2022 | Technological controls | 5 |
| 8.9 | Configuration management | ISO 27001:2022 | Technological controls | 5 |
| 8.10 | Information deletion | ISO 27001:2022 | Technological controls | 5 |
| 8.11 | Data masking | ISO 27001:2022 | Technological controls | 5 |
| 8.12 | Data leakage prevention | ISO 27001:2022 | Technological controls | 5 |
| 8.13 | Information backup | ISO 27001:2022 | Technological controls | 5 |
| 8.14 | Redundancy of information processing facilities | ISO 27001:2022 | Technological controls | 5 |
| 8.15 | Logging | ISO 27001:2022 | Technological controls | 5 |
| 8.16 | Monitoring activities | ISO 27001:2022 | Technological controls | 5 |
| 8.17 | Clock synchronization | ISO 27001:2022 | Technological controls | 5 |
| 8.18 | Use of privileged utility programs | ISO 27001:2022 | Technological controls | 5 |
| 8.19 | Installation of software on operational systems | ISO 27001:2022 | Technological controls | 5 |
| 8.20 | Networks security | ISO 27001:2022 | Technological controls | 5 |
| 8.21 | Security of network services | ISO 27001:2022 | Technological controls | 5 |
| 8.22 | Segregation of networks | ISO 27001:2022 | Technological controls | 5 |
| 8.23 | Web filtering | ISO 27001:2022 | Technological controls | 5 |
| 8.24 | Use of cryptography | ISO 27001:2022 | Technological controls | 5 |
| 8.25 | Secure development life cycle | ISO 27001:2022 | Technological controls | 5 |
| 8.26 | Application security requirements | ISO 27001:2022 | Technological controls | 5 |
| 8.27 | Secure system architecture and engineering principles | ISO 27001:2022 | Technological controls | 5 |
| 8.28 | Secure coding | ISO 27001:2022 | Technological controls | 5 |
| 8.29 | Security testing in development and acceptance | ISO 27001:2022 | Technological controls | 5 |
| 8.30 | Outsourced development | ISO 27001:2022 | Technological controls | 5 |
| 8.31 | Separation of development, test and production environments | ISO 27001:2022 | Technological controls | 5 |
| 8.32 | Change management | ISO 27001:2022 | Technological controls | 5 |
| 8.33 | Test information | ISO 27001:2022 | Technological controls | 5 |
| 8.34 | Protection of information systems during audit testing | ISO 27001:2022 | Technological controls | 5 |
| SOC2-A1.1 | A1.1 Managing processing capacity | SOC 2 | A - Availability | 3 |
| SOC2-A1.2 | A1.2 Environmental protection, backup and recovery infrastructure | SOC 2 | A - Availability | 5 |
| SOC2-A1.3 | A1.3 Testing recovery plan procedures | SOC 2 | A - Availability | 4 |
| SOC2-C1.1 | C1.1 Identifying and maintaining confidential information | SOC 2 | C - Confidentiality | 4 |
| SOC2-C1.2 | C1.2 Disposing of confidential information | SOC 2 | C - Confidentiality | 3 |
| SOC2-CC1.1 | CC1.1 Commitment to integrity and ethical values (COSO principle 1) | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC1.2 | CC1.2 Board independence and oversight of internal control (COSO principle 2) | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC1.3 | CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC1.4 | CC1.4 Attracting, developing and retaining competent people (COSO principle 4) | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC1.5 | CC1.5 Accountability for internal control responsibilities (COSO principle 5) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC2.1 | CC2.1 Relevant, quality information to support internal control (COSO principle 13) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC2.2 | CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC2.3 | CC2.3 Communication with external parties about internal control (COSO principle 15) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC3.1 | CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6) | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC3.2 | CC3.2 Identifying and analysing risks to objectives (COSO principle 7) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC3.3 | CC3.3 Considering fraud risk (COSO principle 8) | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC3.4 | CC3.4 Identifying and assessing significant changes (COSO principle 9) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC4.1 | CC4.1 Ongoing and separate evaluations of control (COSO principle 16) | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC4.2 | CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) | SOC 2 | CC - Common Criteria (Security) | 3 |
| SOC2-CC5.1 | CC5.1 Selecting control activities that mitigate risk (COSO principle 10) | SOC 2 | CC - Common Criteria (Security) | 3 |
| SOC2-CC5.2 | CC5.2 General controls over technology (COSO principle 11) | SOC 2 | CC - Common Criteria (Security) | 3 |
| SOC2-CC5.3 | CC5.3 Deploying controls through policies and procedures (COSO principle 12) | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC6.1 | CC6.1 Logical access security over protected information assets | SOC 2 | CC - Common Criteria (Security) | 7 |
| SOC2-CC6.2 | CC6.2 Registering and authorising users before issuing credentials | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC6.3 | CC6.3 Role-based access, least privilege and segregation of duties | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC6.4 | CC6.4 Restricting physical access to facilities and assets | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC6.5 | CC6.5 Protecting data on assets until disposal | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC6.6 | CC6.6 Protection against threats from outside the system boundary | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC6.7 | CC6.7 Restricting and protecting information in transmission, movement and removal | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC6.8 | CC6.8 Preventing and detecting unauthorised or malicious software | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC7.1 | CC7.1 Detecting configuration changes and new vulnerabilities | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC7.2 | CC7.2 Monitoring system components for anomalies | SOC 2 | CC - Common Criteria (Security) | 4 |
| SOC2-CC7.3 | CC7.3 Evaluating security events to identify incidents | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC7.4 | CC7.4 Responding to security incidents | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC7.5 | CC7.5 Recovering from security incidents | SOC 2 | CC - Common Criteria (Security) | 3 |
| SOC2-CC8.1 | CC8.1 Managing changes to procedures, software, data and infrastructure | SOC 2 | CC - Common Criteria (Security) | 5 |
| SOC2-CC9.1 | CC9.1 Mitigating risks of business disruption | SOC 2 | CC - Common Criteria (Security) | 3 |
| SOC2-CC9.2 | CC9.2 Assessing and managing vendor and business partner risk | SOC 2 | CC - Common Criteria (Security) | 6 |
| SOC2-P1.1 | P1.1 Privacy notice to data subjects | SOC 2 | P - Privacy | 4 |
| SOC2-P2.1 | P2.1 Choice and consent | SOC 2 | P - Privacy | 4 |
| SOC2-P3.1 | P3.1 Collecting personal information consistent with objectives | SOC 2 | P - Privacy | 3 |
| SOC2-P3.2 | P3.2 Explicit consent before collecting information that requires it | SOC 2 | P - Privacy | 3 |
| SOC2-P4.1 | P4.1 Limiting use to identified purposes | SOC 2 | P - Privacy | 3 |
| SOC2-P4.2 | P4.2 Retaining personal information | SOC 2 | P - Privacy | 3 |
| SOC2-P4.3 | P4.3 Securely disposing of personal information | SOC 2 | P - Privacy | 3 |
| SOC2-P5.1 | P5.1 Data subject access | SOC 2 | P - Privacy | 4 |
| SOC2-P5.2 | P5.2 Correction of personal information | SOC 2 | P - Privacy | 4 |
| SOC2-P6.1 | P6.1 Disclosure to third parties with consent | SOC 2 | P - Privacy | 3 |
| SOC2-P6.2 | P6.2 Record of authorised disclosures | SOC 2 | P - Privacy | 2 |
| SOC2-P6.3 | P6.3 Record of unauthorised disclosures and breaches | SOC 2 | P - Privacy | 2 |
| SOC2-P6.4 | P6.4 Privacy commitments from vendors and third parties | SOC 2 | P - Privacy | 3 |
| SOC2-P6.5 | P6.5 Vendor commitments to report unauthorised disclosures | SOC 2 | P - Privacy | 2 |
| SOC2-P6.6 | P6.6 Notifying breaches and incidents | SOC 2 | P - Privacy | 3 |
| SOC2-P6.7 | P6.7 Accounting of personal information held and disclosed | SOC 2 | P - Privacy | 3 |
| SOC2-P7.1 | P7.1 Quality of personal information | SOC 2 | P - Privacy | 3 |
| SOC2-P8.1 | P8.1 Inquiries, complaints, disputes and compliance monitoring | SOC 2 | P - Privacy | 4 |
| SOC2-PI1.1 | PI1.1 Quality information about processing objectives, data definitions and specifications | SOC 2 | PI - Processing Integrity | 3 |
| SOC2-PI1.2 | PI1.2 Controls over system inputs | SOC 2 | PI - Processing Integrity | 3 |
| SOC2-PI1.3 | PI1.3 Controls over system processing | SOC 2 | PI - Processing Integrity | 3 |
| SOC2-PI1.4 | PI1.4 Controls over output delivery | SOC 2 | PI - Processing Integrity | 3 |
| SOC2-PI1.5 | PI1.5 Controls over stored inputs, work in process and outputs | SOC 2 | PI - Processing Integrity | 3 |