.svg)
ISO 27001
Featured Insights
ISO 27001 A.5.7: Threat Intelligence
ISO 27001 A.5.7 requires an organization to collect and analyze information about information security threats, turn it into threat intelligence, and ...
Filter by Tag
ISO 27001 A.5.18: Access Rights
ISO 27001 A.5.18 requires that access rights to information and systems are provisioned, reviewed, modified, and removed across the whole lifecycle,...
ISO 27001 A.5.17: Authentication Information
ISO 27001 A.5.17 requires that authentication information, the passwords, keys, tokens, and secrets people and systems use to prove identity, is...
ISO 27001 A.5.16: Identity Management
ISO 27001 A.5.16 requires an organization to manage the full life cycle of identities, for both people and non-human accounts, from creation through...
ISO 27001 A.8.3: Information Access Restriction
ISO 27001 A.8.3 requires that access to information and application functions is restricted in line with the access control policy, enforced at the...
ISO 27001 A.8.12: Data Leakage Prevention
ISO 27001 A.8.12 requires data leakage prevention measures on the systems, networks, and devices that handle sensitive information, so that data...
ISO 27001 A.8.1: User Endpoint Devices
ISO 27001 A.8.1 requires that information stored on, processed by, or accessible through user endpoint devices, meaning laptops, desktops, phones,...
ISO 27001 A.8.4: Access to Source Code
ISO 27001 A.8.4 requires that read and write access to source code, development tools, and software libraries is restricted to what a person needs...
ISO 27001 A.8.28: Secure Coding
To satisfy ISO 27001 A.8.28, apply secure coding principles to how your team writes software: adopt language-specific coding standards, plan security...
ISO 27001 A.8.25: Secure Development Life Cycle
To satisfy ISO 27001 A.8.25, write down the rules that govern how your team builds software, then apply them consistently across the whole life...
ISO 27001 A.8.24: Use of Cryptography
ISO 27001 A.8.24 requires a policy on the use of cryptography, including key management, applied according to risk rather than encrypting everything...
ISO 27001 A.8.13: Information Backup
ISO 27001 A.8.13 requires that backup copies of information, software, and systems are maintained and tested against an agreed backup policy. It is a...
ISO 27001 A.8.7: Protection Against Malware
ISO 27001 A.8.7 requires that protection against malware is implemented and backed by appropriate user awareness across every system that runs code....
ISO 27001 A.8.9: Configuration Management
To satisfy ISO 27001 A.8.9, define a secure configuration baseline for your hardware, software, services, and networks, document every deviation from...
ISO 27001 A.8.8: Management of Technical Vulnerabilities
ISO 27001 A.8.8 requires that an organization obtain information about the technical vulnerabilities in the systems it uses, assess its exposure to...
ISO 27001 A.8.16: Monitoring Activities
ISO 27001 A.8.16 requires that networks, systems, and applications are monitored for anomalous behavior and that potential security incidents are...
ISO 27001 A.8.15: Logging
ISO 27001 A.8.15 requires an organization to produce, store, protect, and review logs that record activities, exceptions, faults, and security...
ISO 27001 A.8.5: Secure Authentication
ISO 27001 A.8.5 requires that secure authentication technologies and procedures are implemented based on how sensitive the information and system...
ISO 27001 A.5.15: Access Control
ISO 27001 A.5.15 requires an organization to establish and maintain an access control policy that governs who may reach information and systems,...
ISO 27001 A.5.24: Information Security Incident Management Planning and Preparation
ISO 27001 A.5.24 requires an organization to plan and prepare for security incidents before they happen: define the roles, the response process, the...
ISO 27001 A.8.2: Privileged Access Rights
ISO 27001 A.8.2 requires that privileged access rights, the elevated permissions that let a person change configuration, read all data, or bypass...
ISO 27001 A.8.32: Change Management
To satisfy ISO 27001 A.8.32, put every change to production systems, applications, and infrastructure through one documented path: a request, a risk...
ISO 27001 A.8.20: Network Security
ISO 27001 A.8.20 requires that the networks carrying an organization's information are secured, managed, and controlled to protect the systems and...
Mapping the CCSPA to ISO 27001, NIST CSF 2.0, and CPCSC: The Complete Crosswalk
This crosswalk maps the seven obligation areas of the Critical Cyber Systems Protection Act (CCSPA), enacted June 16, 2026 as Part 2 of Bill C-8,...
ISO 27001 Cost in 2026: The 4 Factors That Set It
TL;DR
For a Canadian company, ISO 27001 typically costs between CAD$15,000 and $40,000 for a small organization (under 50 employees) and CAD$40,000...
ISO 27001 vs. SOC 2: Which Should Come First?
The answer is almost always determined by one thing: who is buying from you and where they are located. US enterprise buyers want SOC 2. EU and...
Most of ISO 42001 Is Already Built
How much of an existing SOC 2 or ISO 27001 program carries into ISO 42001, and why the framework tax is mostly imaginary for teams that built a real...
SOC 2 to ISO 27001 Control Mapping: What Transfers and What's Net-New
The question arrives once a company closes its first European contract or a board-level prospect asks for ISO 27001 alongside the SOC 2 report: We...
ISO 27001 Internal Audit: What Gets Reviewed
Most organizations pursuing ISO 27001 know they need an internal audit before the external stage 2. What they're less clear on is what that audit...
Five ISO 27001 Internal Audit Findings Before Certification
An ISO 27001 internal audit with no major nonconformities is a good result. It means the ISMS is documented, controls are operating, and the evidence...