Annex A Physical and Technological Controls Kit

Site register, zone model, entry control and visitors, A.7.4 monitoring, environmental and climate threats, utilities, cabling, maintenance, third-party sites

Clear desk and clear screen rules, enforced lock settings, printing, meeting rooms, hot desking, home and travel, sweep checks, metrics, worked results

Sanitisation method by classification and destination, techniques by media type, verification and validation, chain of custody, certificates, disposal log

Facility profile, shared responsibility, evidence pack, weighted checklist (access, power, cooling, fire, contract, audit rights, climate), scoring, decision

Device categories, minimum requirements, lifecycle, patch deadlines, BYOD work-data separation and privacy, lost devices, compliance states, size tiers

Threat picture, layered controls (EDR, e-mail and web filtering, allow-listing, macros), detection and response times, awareness, coverage metrics, exceptions

Baseline catalogue per platform (CIS Benchmarks by name), common hardening, configuration as code, drift detection, baseline lifecycle, deviations, metrics

ISMS backup policy: tiers from BIA with RPO and RTO, 3-2-1-1-0 copies, immutability, encryption, retention, ransomware, SaaS backups, restore testing

Masking and pseudonymisation techniques, test data, re-identification risk, DLP channels, rule catalogue, tuning, alert handling, staff privacy

Network zones and flow matrix, firewall rule lifecycle, remote access, wireless, DNS and web filtering, network service agreements, monitoring, evidence

SOC, MDR or hybrid model, log source register and health, detection use cases, alert triage and service levels, escalation to incidents, metrics

SDLC stages and gates, risk classes, security requirements, architecture, secure coding, testing, environments, test data, AI assistants, supply chain

Approved algorithms and key sizes, deprecation dates to 2035, TLS 1.3 and hybrid ML-KEM, RNG, password hashing, key lifecycle, agility, checks, exceptions

Logging policy statements, required sources by tier, fields and UTC time sync, SIEM pipeline, integrity, searchable vs retrievable retention, privacy, coverage metrics, use cases

Enterprise vulnerability policy: asset coverage, scan cadence, CVSS 4.0, EPSS, KEV and SSVC prioritisation, BOD 26-04 factors, SLAs, exceptions, metrics

PAM scope, roles, account types, tier model, MFA, least privilege, JIT, admin workstations, service and vendor accounts, break-glass, recording, review