[Day 3] 9. Assignment

Here’s a refined list of controls to address the listed issues based on ISO 27001 Annex A:

1. Top management may lose interest in implementing information security:

Controls:

• A.5.1.1: Establishing an information security policy approved by top management.
• A.5.1.2: Ensuring that management demonstrates leadership and commitment to the ISMS.
• A.5.1.3: Assigning roles and responsibilities for maintaining the ISMS.
• A.7.2.2: Providing regular training and awareness for management about the importance of ISMS.

---

2. A vendor may cause an important data leakage:

Controls:

• A.6.2.1: Defining and implementing policies for supplier relationships.
• A.6.2.3: Monitoring and reviewing supplier services regularly.
• A.8.2.4: Implementing restrictions on access to sensitive data for vendors.
• A.9.4.1: Using secure authentication methods for vendor access.

---

3. A vendor may cause disruption of a service due to poor service:

Controls:

• A.6.2.1: Establishing information security requirements for suppliers.
• A.6.2.3: Monitoring and reviewing supplier services regularly.
• A.10.2.1: Backing up information at agreed intervals.
• A.10.2.2: Testing and validating backup processes.
• A.10.2.3: Ensuring the security of backup storage.

---

4. A new employee may provide a fake experience certificate:

Controls:

• A.8.1.2: Verifying the authenticity of background information during recruitment.
• A.7.1.1: Conducting thorough background checks.

---

5. An employee holding a key position may sell important data to competitors:

Controls:

• A.8.1.3: Restricting access based on roles and responsibilities.
• A.8.2.1: Implementing user access management policies.
• A.8.2.2: Performing regular reviews of access permissions.
• A.8.2.3: Revoking access rights promptly when an employee leaves or changes roles.
• A.8.3: Ensuring proper handling and destruction of sensitive information.

---

6. A generator may fail during a power cut due to malfunctioning of a component:

Controls:

• A.9.2.1: Establishing secure areas and controlling physical access.
• A.9.2.2: Protecting equipment from environmental threats.
• A.9.2.4: Ensuring proper maintenance and testing of power supply systems.

---

7. A UPS may fail due to heat and dust accumulation:

Controls:

• A.9.2.3: Installing appropriate environmental controls (e.g., cooling, humidity control).
• A.9.2.4: Performing regular maintenance and cleaning of UPS systems.
• A.9.2.6: Implementing monitoring systems to detect potential equipment failures.

---

8. A visitor may shut down a critical server:

Controls:

• A.9.1.2: Restricting access to sensitive areas for visitors.
• A.9.2.1: Implementing strict physical access controls (e.g., visitor logs, escorts).
• A.9.4.2: Restricting access to servers through secure authentication.

---

9. A discarded pen drive may contain sensitive data:

Controls:

• A.8.3.2: Ensuring secure disposal of media containing sensitive information.
• A.8.3.1: Protecting media during its lifecycle, including handling and storage.

---

10. A ransomware attack may make data unavailable:

Controls:

• A.12.3.1: Protecting against malware through regular updates and scans.
• A.10.1.1: Implementing redundancy to ensure data availability.
• A.10.2.1: Regularly backing up critical information.
• A.16.1.4: Establishing a response plan for information security incidents.

---

11. A database server may fail because of a full hard disk:

Controls:

• A.12.1.3: Capacity management to ensure resources are sufficient for current and future needs.
• A.10.2.1: Regular backups of the database to prevent data loss.
• A.12.4.1: Monitoring systems to detect and alert on potential storage issues.

---

12. An employee given a temporary promotion may commit fraud after the original employee returns:

Controls:

• A.8.1.3: Implementing role-based access control (RBAC).
• A.8.2.2: Reviewing access permissions for employees in temporary roles.
• A.8.2.3: Revoking access promptly after the temporary role ends.
• A.12.4.1: Enabling activity logging and monitoring to detect unusual behavior.

---