Frameworks · ISO/IEC 27001 and 27002
ISO/IEC 27001 describes the requirements for an information security management system (ISMS) and is the standard you certify against; ISO/IEC 27002 is the accompanying catalogue of controls. Applicable to any organisation, whatever its sector or size. In short: don't just select the controls in your Statement of Applicability, but prove that they are actually in place on your systems.
What it requires
You decide which controls are needed based on a risk assessment and record that choice in the Statement of Applicability. Annex A of ISO 27001 refers to the controls of ISO 27002 for this.
ISO 27002:2022 organises the controls in four chapters: organisational (5), people (6), physical (7) and technological (8). The technological chapter is what you can measure on servers, workstations and accounts.
Internal audits and the management review require documented information as evidence that the ISMS works. A hardened system you measured last year must be shown again this year.
How you make it demonstrable
Easy2audit measures your systems and accounts against the technical controls of ISO/IEC 27002:2022, with the emphasis on the technological controls of chapter 8 and the technically measurable organisational controls such as 5.15 Access Control, and scores the same scan against the other frameworks as well.
All security settings of a system are linked in Easy2audit to the clauses of the standard, so you see per clause which settings belong to it. For a Windows 11 system, Easy2audit checks 46 security settings for clause 5.15 Access Control of ISO 27002. You never have to work out yourself which settings fall under which clause per operating system, and an external auditor finds the mapping already verified.
demo environment · sample scores · a selection, the application covers the full framework
Also measured
also available: NIST benchmarks · ISA 315 reporting for the financial statement audit