International
ISO/IEC 27001 compliance, made simple
ISO/IEC 27001 is the leading international standard for information security management systems (ISMS). It's certifiable — an accredited auditor can formally certify an organisation against it — and is widely recognised across every major market.
ComplianceDesk gives you 85 pre-built ISO/IEC 27001 controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving ISO/IEC 27001 compliance stops being a spreadsheet exercise.
Every ISO/IEC 27001 control, organised for you
The real control library ComplianceDesk seeds the moment you activate ISO/IEC 27001 — 85 controls across 4 categories.
Organizational Controls
- ISO-1.1 Information security policy approved and communicated
- ISO-1.2 Information security roles and responsibilities defined
- ISO-1.3 Asset inventory maintained
- ISO-1.4 Supplier security requirements defined
- ISO-1.5 Information security incident management process
- ISO-1.6 ICT readiness for business continuity
- ISO-1.7 Threat intelligence collected and analysed
- ISO-1.8 Acceptable use of assets defined
- ISO-1.9 Information classification scheme
- ISO-1.10 Rules for information transfer
- ISO-1.11 Identity management lifecycle
- ISO-1.12 Authentication information management
- ISO-1.13 Access rights provisioning and review
- ISO-1.14 Security of cloud services
- ISO-1.15 Legal, statutory, regulatory and contractual requirements identified
- ISO-1.16 Privacy and protection of PII
- ISO-1.17 Compliance with information security policies reviewed
- ISO-1.18 Segregation of duties
- ISO-1.19 Management responsibilities for information security
- ISO-1.20 Contact with authorities maintained
- ISO-1.21 Contact with special interest groups maintained
- ISO-1.22 Information security integrated into project management
- ISO-1.23 Return of assets on termination or change of employment
- ISO-1.24 Labelling of information per classification scheme
- ISO-1.25 Access control policy established
- ISO-1.26 Information security in the ICT supply chain
- ISO-1.27 Monitoring, review and change management of supplier services
- ISO-1.28 Learning from information security incidents
- ISO-1.29 Collection of evidence for security events
- ISO-1.30 Information security maintained during disruption
- ISO-1.31 Intellectual property rights protected
- ISO-1.32 Protection of records
- ISO-1.33 Independent review of information security
- ISO-1.34 Documented operating procedures
People Controls
- ISO-2.1 Background verification checks
- ISO-2.2 Terms and conditions of employment include security obligations
- ISO-2.3 Security awareness, education and training programme
- ISO-2.4 Disciplinary process for security violations
- ISO-2.5 Responsibilities after termination or change of employment
- ISO-2.6 Confidentiality or non-disclosure agreements
- ISO-2.7 Remote working security measures
- ISO-2.8 Information security event reporting channel
Physical Controls
- ISO-3.1 Physical security perimeters defined
- ISO-3.2 Physical entry controls
- ISO-3.3 Clear desk and clear screen policy
- ISO-3.4 Secure disposal or reuse of equipment
- ISO-3.5 Physical security monitoring
- ISO-3.6 Protection against environmental and physical threats
- ISO-3.7 Equipment siting and protection
- ISO-3.8 Security of assets off-premises
- ISO-3.9 Storage media handling
- ISO-3.10 Equipment maintenance
- ISO-3.11 Securing offices, rooms and facilities
- ISO-3.12 Working in secure areas
- ISO-3.13 Supporting utilities protected
- ISO-3.14 Cabling security
Technological Controls
- ISO-4.1 Access control policy and user access management
- ISO-4.2 Use of cryptography
- ISO-4.3 Logging and monitoring
- ISO-4.4 Network security management
- ISO-4.5 Secure development lifecycle
- ISO-4.6 Backup of information
- ISO-4.7 User endpoint device security
- ISO-4.8 Secure authentication
- ISO-4.9 Protection against malware
- ISO-4.10 Management of technical vulnerabilities
- ISO-4.11 Configuration management
- ISO-4.12 Secure information deletion
- ISO-4.13 Data leakage prevention measures
- ISO-4.14 Network segregation
- ISO-4.15 Change management for technology systems
- ISO-4.16 Separation of development, testing and production environments
- ISO-4.17 Web filtering
- ISO-4.18 Access to source code managed
- ISO-4.19 Capacity management
- ISO-4.20 Data masking applied
- ISO-4.21 Redundancy of information processing facilities
- ISO-4.22 Clock synchronisation
- ISO-4.23 Use of privileged utility programs restricted
- ISO-4.24 Installation of software on operational systems controlled
- ISO-4.25 Security of network services
- ISO-4.26 Security testing in development and acceptance
- ISO-4.27 Outsourced development directed and reviewed
- ISO-4.28 Test information protected and managed
- ISO-4.29 Protection of information systems during audit testing
Frequently asked questions
How many controls does ComplianceDesk track for ISO/IEC 27001?
85, organised into 4 categories, ready to assign to an owner as soon as you activate the framework.
Can I track ISO/IEC 27001 alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up ISO/IEC 27001 in ComplianceDesk?
Activating ISO/IEC 27001 instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Related guides
- NIS2 Explained: The EU's Expanded Cybersecurity Directive →
- ISO 31000: Why There's No Such Thing as "ISO 31000 Certified" →
- COBIT Explained: IT Governance Beyond Just Security →
- DORA Explained: What the EU's Digital Operational Resilience Act Requires →
- CSA STAR: Cloud Security Certification Explained →
- NIST Cybersecurity Framework (CSF): A Practical Overview →
- Business Continuity Planning: ISO 22301 Explained →
- How to Run a Vendor Risk Assessment (With a Practical Template) →
- SOC 2 Type I vs Type II: What's the Difference, and Which Do You Need? →
- ISO 27001 Certification: A Step-by-Step Guide to the Process →
Other International frameworks
See your full compliance picture
131 frameworks, one system of record.