СУІБ та ISO/IEC 27001
Готові шаблони Markdown для інженерії, продукту, комплаєнсу, бізнесу та інших сфер. Перегляньте та відкрийте в редакторі одним кліком.
Access Control Policy Template (ISO/IEC 27001 A.5.15)
Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics
ISO/IEC 27001:2022 + Amd 1:2024 A.5.15 to A.5.18, A.8.2, A.8.3, A.8.5 (cited only); ISO/IEC 27002:2022; NIST SP 800-63B-4Annex A Organizational Controls Guide Template (ISO/IEC 27001 A.5)
A.5.1 to A.5.37 in own words: intent, typical implementation, tier notes, evidence auditors sample, pitfalls, linked templates, self-check, study record
ISO/IEC 27001:2022 + Amd 1:2024 Annex A A.5.1 to A.5.37 (cited only); ISO/IEC 27002:2022Annex A People and Physical Controls Guide Template (ISO/IEC 27001 A.6, A.7)
A.6.1 to A.6.8 and A.7.1 to A.7.14 in own words: intent, tier notes, evidence, pitfalls, physical boundary decision for cloud and colocation, self-check, study record
ISO/IEC 27001:2022 + Amd 1:2024 Annex A A.6.1 to A.6.8, A.7.1 to A.7.14 (cited only); ISO/IEC 27002:2022Annex A Technological Controls Guide Template (ISO/IEC 27001 A.8)
A.8.1 to A.8.34 in own words: intent, tier notes, evidence tools and exports, pitfalls, secure development lifecycle map, self-check, study record
ISO/IEC 27001:2022 + Amd 1:2024 Annex A A.8.1 to A.8.34 (cited only); ISO/IEC 27002:2022Audit Findings Register Template (ISO/IEC 27001 9.2 and 10.2)
One register for internal, certification body, customer and assessment findings: ID convention, grades, fields, status workflow, links to CAPA, reporting
ISO/IEC 27001:2022 + Amd 1:2024 clauses 9.2, 9.3, 10.2 and A.5.35 (cited only)Authorities and Interest Groups Contacts Template (ISO/IEC 27001 A.5.5, A.5.6)
Contacts register for A.5.5 and A.5.6: contact rules, authorities, CSIRTs, law enforcement, ISACs, vendor PSIRTs, restricted annex, verification log
ISO/IEC 27001:2022 + Amd 1:2024 A.5.5, A.5.6 (cited only); ISO/IEC 27002:2022Backup Policy Template (ISO/IEC 27001 A.8.13)
ISMS backup policy: tiers from BIA with RPO and RTO, 3-2-1-1-0 copies, immutability, encryption, retention, ransomware, SaaS backups, restore testing
ISO/IEC 27001:2022 + Amd 1:2024 A.8.13 (cited only); ISO/IEC 27002:2022Backup and Restore Test Log Template (ISO/IEC 27001 A.8.13)
Restore test plan and log: measurement rules, planned tests per tier, executed restores, RPO and RTO achieved versus target, issues and retests
ISO/IEC 27001:2022 + Amd 1:2024 A.8.13 (cited only); ISO/IEC 27002:2022ISO/IEC 27001 Certification Audit Explained Template
Learning guide: accreditation, choosing a CB, audit time, Stage 1 and 2, findings, decision, surveillance, recertification, transfers, remote audits
ISO/IEC 27001:2022 + Amd 1:2024 (cited only); ISO/IEC 17021-1:2015; ISO/IEC 27006-1:2024; IAF MD 1, 2, 4, 11Certification Body Selection Template (ISO/IEC 27001 and 27006-1)
CB selection for ISO/IEC 27001: accreditation check, impartiality, audit time, multi-site, remote audit, 3-year cost, transfer, RFQ, scoring, decision
ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 (cited only); IAF MD 1, 2, 4, 11, 29Certification Cycle Plan Template (ISO/IEC 27001 3-year cycle)
3-year certificate cycle, timing rules, Gantt timeline, audit coverage, change notifications, suspension and withdrawal, recertification, transfers, budget
ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 certification cycle for ISO/IEC 27001:2022 + Amd 1:2024 (cited only)Certification Findings Action Plan Template (ISO/IEC 27001)
CB audit findings log, correction, extent check, root cause, corrective action, CB deadlines, submission log, verification and closure
ISO/IEC 27001:2022 + Amd 1:2024 clause 10.2 (cited only); ISO/IEC 17021-1:2015; ISO/IEC 27006-1:2024Certification Mark Usage Rules Template (ISO/IEC 27001)
Certificate and CB mark use: rule sources, licensed marks, scope-limited claims, prohibited uses, channels, wording examples, approval log
ISO/IEC 27001:2022 + Amd 1:2024 clause 7.4 (cited only); ISO/IEC 17021-1:2015 clause 8.3; CB and accreditation rulesClear Desk and Clear Screen Policy Template (ISO/IEC 27001 A.7.7)
Clear desk and clear screen rules, enforced lock settings, printing, meeting rooms, hot desking, home and travel, sweep checks, metrics, worked results
ISO/IEC 27001:2022 + Amd 1:2024 A.7.7 (cited only); ISO/IEC 27002:2022Cloud Service Controls Template (ISO/IEC 27017:2026)
Cloud customer and provider controls: role determination, shared responsibility matrix, implementation table, extra cloud controls, disclosures, monitoring
ISO/IEC 27001:2022 6.1.3, A.5.19 to A.5.23 (cited only); ISO/IEC 27017:2026; ISO/IEC 27002:2022Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)
Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act
ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-4:2016Public Cloud PII Processor Controls Template (ISO/IEC 27018:2025)
ISO/IEC 27018:2025 for cloud PII processors: customer commitments, transparency, sub-processors, deletion, disclosure requests, breach notice, control table
ISO/IEC 27018:2025 (cited only); ISO/IEC 27002:2022; ISO/IEC 29100:2024Cloud Services Security Policy Template (ISO/IEC 27001 A.5.23)
Cloud policy for A.5.23: shared responsibility, tiers, due diligence, contract terms, configuration, monitoring, exit, shadow IT, cloud register
ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27017:2026; ISO/IEC 27036-4:2016Confidentiality Agreement Template (ISO/IEC 27001 A.6.6)
Confidentiality requirements analysis, five agreement variants, signing gate, register, review, model clauses incl. protected disclosures and return
ISO/IEC 27001:2022 A.6.6 (cited only); ISO/IEC 27002:2022Continual Improvement Register Template (ISO/IEC 27001 clause 10.1)
Improvement opportunities from all sources, triage against nonconformities, benefit and ease scoring, decision, owner, status, benefit review, reporting
ISO/IEC 27001:2022 + Amd 1:2024 clauses 10.1 and 9.3 (cited only); ISO/IEC 27003:2017Control Evidence Matrix Template (ISO/IEC 27001 Clauses and 93 Controls)
Evidence register for clauses 4 to 10 and all 93 Annex A controls: owner, record, location, frequency, last collected, status, Stage 2 and surveillance use
ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10, Annex A (cited only); ISO/IEC 27002:2022; ISO/IEC 17021-1:2015Control Framework Crosswalk Template (ISO 27001, NIST CSF, SOC 2, NIS2, DORA)
88 mapping rows from ISO/IEC 27001 clauses and Annex A to NIST CSF 2.0, SOC 2 TSC IDs, NIS2 Art. 21(2), DORA articles, CIS v8.1, strength ratings, reverse gaps
ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and Annex A (cited only); NIST CSF 2.0; AICPA TSC 2017 (IDs only); NIS2; DORA; CIS Controls v8.1 (names only)Crisis Management and Communications Plan Template (ISO 22361)
Crisis team and deputies, activation criteria, decision log and battle rhythm, stakeholder communication matrix, notification clocks, holding statements, ransomware scenario, exercises
ISO 22361:2022 (cited only); ISO/IEC 27001:2022 + Amd 1:2024 A.5.5, A.5.24 to A.5.29; ISO 22301:2019 + Amd 1:2024Cryptographic Key and Certificate Register Template (ISO/IEC 27001 A.8.24)
Key and certificate inventory: field definitions, lifecycle states, register rows, expiry alerts, algorithm checks, post-quantum exposure, change log
ISO/IEC 27001:2022 + Amd 1:2024 A.8.24 (cited only); ISO/IEC 27002:2022; NIST SP 800-57 Part 1 Rev. 5