.svg)
ISO 27001
Featured Insights
ISO 27001 A.5.7: Threat Intelligence
ISO 27001 A.5.7 requires an organization to collect and analyze information about information security threats, turn it into threat intelligence, and ...
Filter by Tag
ISO 27001 A.5.18: Access Rights
ISO 27001 A.5.18 requires that access rights to information and systems are provisioned, reviewed, modified, and removed across the whole lifecycle,...
ISO 27001 A.5.17: Authentication Information
ISO 27001 A.5.17 requires that authentication information, the passwords, keys, tokens, and secrets people and systems use to prove identity, is...
ISO 27001 A.5.16: Identity Management
ISO 27001 A.5.16 requires an organization to manage the full life cycle of identities, for both people and non-human accounts, from creation through...
ISO 27001 A.8.3: Information Access Restriction
ISO 27001 A.8.3 requires that access to information and application functions is restricted in line with the access control policy, enforced at the...
ISO 27001 A.8.12: Data Leakage Prevention
ISO 27001 A.8.12 requires data leakage prevention measures on the systems, networks, and devices that handle sensitive information, so that data...
ISO 27001 A.8.1: User Endpoint Devices
ISO 27001 A.8.1 requires that information stored on, processed by, or accessible through user endpoint devices, meaning laptops, desktops, phones,...
ISO 27001 A.8.4: Access to Source Code
ISO 27001 A.8.4 requires that read and write access to source code, development tools, and software libraries is restricted to what a person needs...
ISO 27001 A.8.28: Secure Coding
To satisfy ISO 27001 A.8.28, apply secure coding principles to how your team writes software: adopt language-specific coding standards, plan security...
ISO 27001 A.8.25: Secure Development Life Cycle
To satisfy ISO 27001 A.8.25, write down the rules that govern how your team builds software, then apply them consistently across the whole life...
ISO 27001 A.8.24: Use of Cryptography
ISO 27001 A.8.24 requires a policy on the use of cryptography, including key management, applied according to risk rather than encrypting everything...
ISO 27001 A.8.13: Information Backup
ISO 27001 A.8.13 requires that backup copies of information, software, and systems are maintained and tested against an agreed backup policy. It is a...
ISO 27001 A.8.7: Protection Against Malware
ISO 27001 A.8.7 requires that protection against malware is implemented and backed by appropriate user awareness across every system that runs code....
ISO 27001 A.8.9: Configuration Management
To satisfy ISO 27001 A.8.9, define a secure configuration baseline for your hardware, software, services, and networks, document every deviation from...
ISO 27001 A.8.8: Management of Technical Vulnerabilities
ISO 27001 A.8.8 requires that an organization obtain information about the technical vulnerabilities in the systems it uses, assess its exposure to...
ISO 27001 A.8.16: Monitoring Activities
ISO 27001 A.8.16 requires that networks, systems, and applications are monitored for anomalous behavior and that potential security incidents are...
ISO 27001 A.8.15: Logging
ISO 27001 A.8.15 requires an organization to produce, store, protect, and review logs that record activities, exceptions, faults, and security...
ISO 27001 A.8.5: Secure Authentication
ISO 27001 A.8.5 requires that secure authentication technologies and procedures are implemented based on how sensitive the information and system...
ISO 27001 A.5.15: Access Control
ISO 27001 A.5.15 requires an organization to establish and maintain an access control policy that governs who may reach information and systems,...
ISO 27001 A.5.24: Information Security Incident Management Planning and Preparation
ISO 27001 A.5.24 requires an organization to plan and prepare for security incidents before they happen: define the roles, the response process, the...
ISO 27001 A.8.2: Privileged Access Rights
ISO 27001 A.8.2 requires that privileged access rights, the elevated permissions that let a person change configuration, read all data, or bypass...
ISO 27001 A.8.32: Change Management
To satisfy ISO 27001 A.8.32, put every change to production systems, applications, and infrastructure through one documented path: a request, a risk...
ISO 27001 A.8.20: Network Security
ISO 27001 A.8.20 requires that the networks carrying an organization's information are secured, managed, and controlled to protect the systems and...
vCISO Services for Mid-Market SaaS: How to Evaluate Fractional Security Leadership in 2026
vCISO services give a mid-market SaaS company senior security leadership on a fractional basis: someone who owns the security program, drives SOC 2...
GRC Software vs a GRC Service for Security Reviews in 2026
It helps to be clear about the difference between GRC software and the security review itself. The software is a tool. The security review is the...
Top 8 vCISO Services for Mid-Market SaaS in 2026
The right vCISO service for a mid-market SaaS company is the one that owns and runs the security program end to end, on a fractional basis, the way a...
What a Security Architect Actually Does: Three Roles and Where Requirements Come From
A security architect does three jobs: sets security requirements for systems other people design, assesses and reviews those designs, and solutions...
How to Run a Security Assessment Across 90 Applications in 90 Days
When an application portfolio is too large to pen-test, an inquiry-based maturity assessment gets you a defensible, board-ready picture in weeks...
Designing Centralized Identity Across Hybrid Environments: A Security Architecture Walkthrough
Centralizing identity across cloud and on-prem environments is a security architecture problem before it is a tool-selection problem. You start by...
Security Architecture in Practice: The Questions Teams Actually Ask
Security architecture is the practice of designing how people, process, and technology work together to protect an organization's systems. It is not...