ISO/IEC 27001:2022 Information Security Controls Explained

Course Curriculum

Chapter 1: Introduction

Lecture 1: Introduction

Chapter 2: Changes in ISO Annex A:2022

Lecture 1: Changes in ISO Annex A:2022

Chapter 3: 5. Organizational Controls

Lecture 1: Introduction

Lecture 2: 5.1. Information Security Policy

Lecture 3: 5.2. Information Security Roles and Responsibilities

Lecture 4: 5.3. Segregation of Duties

Lecture 5: 5.4. Management Responsibilities

Lecture 6: 5.5 Contact with Authorities

Lecture 7: 5.6 Contact with Special Interest Groups

Lecture 8: 5.7 Threat Intelligence

Lecture 9: 5.8 Information Security in Project Management

Lecture 10: 5.9 Inventory of Information and Other Associated Assets

Lecture 11: 5.10 Acceptable Use of Information and Other Associated Assets

Lecture 12: 5.11 Return of Assets

Lecture 13: 5.12 Classification of Information

Lecture 14: 5.13 Labeling of Information

Lecture 15: 5.14 Information Transfer

Lecture 16: 5.15 Access Control

Lecture 17: 5.16 Identity Management

Lecture 18: 5.17 Authentication Information

Lecture 19: 5.18 Access Rights

Lecture 20: 5.19 Information Security in Supplier Relationships

Lecture 21: 5.20 Addressing Security Within Supplier Agreements

Lecture 22: 5.21 Managing Information Security in the ICT Supply Chain

Lecture 23: 5.22 Monitoring, Review & Change Management of Supplier Services

Lecture 24: 5.25 Assessment and Decision on Information Security Events

Lecture 25: 5.23 Information Security for Use of Cloud Services

Lecture 26: 5.24 Information Security Incident Management Planning and Preparation

Lecture 27: 5.27 Learning from Information Security Incidents

Lecture 28: 5.26 Response to Information Security Incidents

Lecture 29: 5.28 Collection of Evidence

Lecture 30: 5.29 Information Security During Disruption

Lecture 31: 5.30 ICT Readiness for Business Continuity

Lecture 32: 5.31 Statutory, Regulatory and Contractual Requirements

Lecture 33: 5.32 Intellectual Property Rights

Lecture 34: 5.33 Protection of records

Lecture 35: 5.34 Privacy and Protection of PII

Lecture 36: 5.35 Independent Review of Information Security

Lecture 37: 5.36 Compliance with Policies, Rules and Standards for Information Security

Lecture 38: 5.37 Documented operating procedures

Chapter 4: 6. People Controls

Lecture 1: Introduction

Lecture 2: 6.1 Screening

Lecture 3: 6.2 Terms and Conditions of Employment

Lecture 4: 6.3 Information Security Awareness, Education and training

Lecture 5: 6.4 Disciplinary Process

Lecture 6: 6.5 Responsibilities After Termination or Change of Employment

Lecture 7: 6.6 Confidentiality or Non-disclosure Agreements

Lecture 8: 6.7 Remote working

Lecture 9: 6.8 Information Security Event Reporting

Chapter 5: 7. Physical Controls

Lecture 1: Introduction

Lecture 2: 7.1 Physical Security Perimeters

Lecture 3: 7.2 Physical Entry

Lecture 4: 7.4 Physical security monitoring

Lecture 5: 7.3 Securing Offices, Rooms and Facilities

Lecture 6: 7.5 Protecting Against Physical and Environmental Threat

Lecture 7: 7.6 Working in Secure Areas

Lecture 8: 7.7 Clear Desk and Clear Screen

Lecture 9: 7.8 Equipment Siting and Protection

Lecture 10: 7.9 Security of Assets Off-premises

Lecture 11: 7.10 Storage Media

Lecture 12: 7.11 Supporting Utilities

Lecture 13: 7.12 Cabling Security

Lecture 14: 7.13 Equipment maintenance

Lecture 15: 7.14 Secure Disposal or Re-use of Equipment

Chapter 6: 8. Technological Controls

Lecture 1: Introduction

Lecture 2: 8.1 User Endpoint Devices

Lecture 3: 8.2 Privileged access rights

Lecture 4: 8.3 Information Access Restriction

Lecture 5: 8.4 Access To Source Code

Lecture 6: 8.5 Secure Authentication

Lecture 7: 8.6 Capacity Management

Lecture 8: 8.7 Protection Against Malware

Lecture 9: 8.8 Management of Technical Vulnerabilities

Lecture 10: 8.9 Configuration Management

Lecture 11: 8.10 Information Deletion

Lecture 12: 8.11 Data Masking

Lecture 13: 8.12 Data Leakage Prevention

Lecture 14: 8.13 Information Backup

Lecture 15: 8.14 Redundancy of Information Processing Facilities

Lecture 16: 8.15 Logging

Lecture 17: 8.16 Monitoring Activities

Lecture 18: 8.17 Clock Synchronization

Lecture 19: 8.18 Use of Priviledged Utility Program

Lecture 20: 8.19 Installation of Software on Operational Systems

Lecture 21: 8.20 Networks Security

Lecture 22: 8.21 Security of Network Service

Lecture 23: 8.22 Segregation of Networks

Lecture 24: 8.23 Web Filtering

Lecture 25: 8.24 Use of Cryptography

Lecture 26: 8.25 Secure Development Life Cycle

Lecture 27: 8.27 Secure System Architecture and Engineering Principles

Lecture 28: 8.28 Secure Coding

Lecture 29: 8.29 Security Testing in Development and Acceptance

Lecture 30: 8.26 Application Security Requirements