Blog
Articles and resources on information security, compliance, and best practices.
ISO 27001 Control A.6.7: Remote Working
Annex A control 6.7 requires security measures for work done outside the organization's premises. How to secure remote and hybrid work and what auditors check.
ISO 27001 Control A.6.8: Information Security Event Reporting
Annex A control 6.8 requires a timely mechanism for staff to report security events. How to build reporting channels people actually use, and what auditors check.
ISO 27001 Control A.6.2: Terms and Conditions of Employment
Annex A control 6.2 requires employment agreements to state security responsibilities. What to put in the contract, how to cover contractors, and what auditors expect to see.
ISO 27001 Control A.6.1: Screening
Annex A control 6.1 requires background verification of people before they join and on an ongoing basis. How to screen proportionately, stay lawful, and evidence it for audit.
ISO 27001 Clause 10.2: Nonconformity and Corrective Action
Clause 10.2 governs how you handle things that go wrong in the ISMS. The difference between correction and corrective action, how to do root cause properly, and what auditors check.
ISO 27001 Clause 10.1: Continual Improvement
Clause 10.1 requires you to continually improve the ISMS. What continual improvement means in practice, how to evidence it, and why the 2022 revision put it first in Clause 10.
ISO 27001 Clause 9.3: Management Review
Clause 9.3 requires top management to review the ISMS at planned intervals. The required inputs, the decisions expected as outputs, and what auditors look for in the minutes.
ISO 27001 Clause 9.2: Internal Audit
Clause 9.2 requires internal audits at planned intervals to test whether your ISMS conforms and works. How to build an audit programme, stay impartial, and pass certification.
ISO 27001 Clause 9.1: Monitoring, Measurement, Analysis and Evaluation
Clause 9.1 requires you to measure whether your ISMS and controls actually work. What to monitor, how to define metrics that pass audit, and what evidence to keep.
ISO 27001 Clause 8.3: Risk Treatment
Clause 8.3 requires you to implement your risk treatment plan and retain evidence. How to track control implementation and what auditors expect to see.