HHostingByteSoftware
Ctrl K
ComunidadGuías…

isms-core-operational/CONTROLS.md

Rama main · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
<h1 align="center">🎋 ISMS CORE Operational — Controls Index</h1>

<p align="center">
  <strong>ISO 27001:2022 Annex A — Operational Policies + Compliance Checklists</strong>
</p>

<p align="center">
  <img src="https://img.shields.io/badge/Control_Packs-53-0066CC?style=flat-square" alt="53 Control Packs"/>
  <img src="https://img.shields.io/badge/Annex_A_Controls-93-32CD32?style=flat-square" alt="93 Annex A Controls"/>
  <img src="https://img.shields.io/badge/ISO_27001-2022-DC143C?style=flat-square" alt="ISO 27001:2022"/>
</p>

<p align="center">
  <em>This repository provides operational policies and compliance checklists. Certification/compliance depends on your organization's scope, operation, and evidence.</em>
</p>

---

## Repository Structure

```
isms-core-operational/
├── A.5-organisational-controls/     # 21 control packs (covers 37 Annex A controls)
├── A.6-people-controls/             # 4 control packs (covers 8 Annex A controls)
├── A.7-physical-controls/           # 6 control packs (covers 14 Annex A controls)
└── A.8-technological-controls/      # 22 control packs (covers 34 Annex A controls)
```

Each control folder contains:

```
isms-a.X.X-control-name/
├── POL/                  ← Operational policy
├── SCR/                  ← Generator script
└── WKBK/                 ← Generated compliance checklist workbook
```

---

## A.5 Organizational Controls

<p>
<img src="https://img.shields.io/badge/A.5-Organizational-9400D3?style=flat-square" alt="Organizational"/>
<img src="https://img.shields.io/badge/21_packs-0066CC?style=flat-square" alt="21 packs"/>
<img src="https://img.shields.io/badge/100%25_Complete-00AA00?style=flat-square" alt="100% Complete"/>
</p>

📁 **[A.5-organisational-controls/](A.5-organisational-controls/)**

| Control | Name | Artifacts |
|---------|------|-----------|
| [A.5.1-2, 6.1-2](A.5-organisational-controls/isms-a.5.1-2-6.1-2-secure-employment-and-roles/) | Secure Employment and Roles | POL, SCR, WKBK |
| [A.5.3](A.5-organisational-controls/isms-a.5.3-segregation-of-duties/) | Segregation of Duties | POL, SCR, WKBK |
| [A.5.4](A.5-organisational-controls/isms-a.5.4-management-responsibilities/) | Management Responsibilities | POL, SCR, WKBK |
| [A.5.5-6](A.5-organisational-controls/isms-a.5.5-6-external-communications/) | External Communications | POL, SCR, WKBK |
| [A.5.7](A.5-organisational-controls/isms-a.5.7-threat-intelligence/) | Threat Intelligence | POL, SCR, WKBK |
| [A.5.8](A.5-organisational-controls/isms-a.5.8-information-security-in-project-management/) | Information Security in Project Management | POL, SCR, WKBK |
| [A.5.9](A.5-organisational-controls/isms-a.5.9-inventory-of-information-and-assets/) | Inventory of Information and Assets | POL, SCR, WKBK |
| [A.5.10-11](A.5-organisational-controls/isms-a.5.10-11-asset-usage-lifecycle/) | Asset Usage Lifecycle | POL, SCR, WKBK |
| [A.5.12-13](A.5-organisational-controls/isms-a.5.12-13-classification-and-labelling/) | Classification and Labelling | POL, SCR, WKBK |
| [A.5.14](A.5-organisational-controls/isms-a.5.14-information-transfer/) | Information Transfer | POL, SCR, WKBK |
| [A.5.15-16, 18](A.5-organisational-controls/isms-a.5.15-16-18-identity-access-management/) | Identity Access Management | POL, SCR, WKBK |
| [A.5.17](A.5-organisational-controls/isms-a.5.17-authentication-information/) | Authentication Information | POL, SCR, WKBK |
| [A.5.19-23](A.5-organisational-controls/isms-a.5.19-23-cloud-services/) | Cloud Services | POL, SCR, WKBK |
| [A.5.24-28](A.5-organisational-controls/isms-a.5.24-28-incident-management-lifecycle/) | Incident Management Lifecycle | POL, SCR, WKBK |
| [A.5.29](A.5-organisational-controls/isms-a.5.29-security-during-disruption/) | Security During Disruption | POL, SCR, WKBK |
| [A.5.30, 8.13-14](A.5-organisational-controls/isms-a.5.30-8.13-14-business-continuity-dr/) | Business Continuity & DR | POL, SCR, WKBK |
| [A.5.31](A.5-organisational-controls/isms-a.5.31-legal-statutory-regulatory-contractual-requirements/) | Legal, Statutory, Regulatory & Contractual | POL, SCR, WKBK |
| [A.5.32-33](A.5-organisational-controls/isms-a.5.32-33-information-protection/) | Records and Information Protection | POL, SCR, WKBK |
| [A.5.34](A.5-organisational-controls/isms-a.5.34-privacy-and-pii/) | Privacy and PII | POL, SCR, WKBK |
| [A.5.35-36](A.5-organisational-controls/isms-a.5.35-36-compliance-review/) | Compliance Review | POL, SCR, WKBK |
| [A.5.37](A.5-organisational-controls/isms-a.5.37-documented-procedures/) | Documented Operating Procedures | POL, SCR, WKBK |

---

## A.6 People Controls

<p>
<img src="https://img.shields.io/badge/A.6-People-FF6600?style=flat-square" alt="People"/>
<img src="https://img.shields.io/badge/4_packs-0066CC?style=flat-square" alt="4 packs"/>
<img src="https://img.shields.io/badge/100%25_Complete-00AA00?style=flat-square" alt="100% Complete"/>
</p>

📁 **[A.6-people-controls/](A.6-people-controls/)**

| Control | Name | Artifacts |
|---------|------|-----------|
| [A.6.3](A.6-people-controls/isms-a.6.3-awareness-and-training/) | Awareness and Training | POL, SCR, WKBK |
| [A.6.4-5](A.6-people-controls/isms-a.6.4-5-employment-exit/) | Disciplinary Process & Employment Exit | POL, SCR, WKBK |
| [A.6.6](A.6-people-controls/isms-a.6.6-confidentiality-nda/) | Confidentiality / NDA | POL, SCR, WKBK |
| [A.6.7-8](A.6-people-controls/isms-a.6.7-8-remote-working-and-reporting/) | Remote Working and Reporting | POL, SCR, WKBK |

---

## A.7 Physical Controls

<p>
<img src="https://img.shields.io/badge/A.7-Physical-32CD32?style=flat-square" alt="Physical"/>
<img src="https://img.shields.io/badge/6_packs-0066CC?style=flat-square" alt="6 packs"/>
<img src="https://img.shields.io/badge/100%25_Complete-00AA00?style=flat-square" alt="100% Complete"/>
</p>

📁 **[A.7-physical-controls/](A.7-physical-controls/)**

| Control | Name | Artifacts |
|---------|------|-----------|
| [A.7.1-3](A.7-physical-controls/isms-A.7.1-3-physical-access-control/) | Physical Access Control | POL, SCR, WKBK |
| [A.7.4-5, 11](A.7-physical-controls/isms-a.7.4-5-11-physical-infrastructure/) | Physical Infrastructure | POL, SCR, WKBK |
| [A.7.6-7, 14](A.7-physical-controls/isms-a.7.6-7-14-information-media-handling/) | Information & Media Handling | POL, SCR, WKBK |
| [A.7.8-9](A.7-physical-controls/isms-a.7.8-9-equipment-location-security/) | Equipment Location Security | POL, SCR, WKBK |
| [A.7.10](A.7-physical-controls/isms-a.7.10-storage-media/) | Storage Media | POL, SCR, WKBK |
| [A.7.12-13](A.7-physical-controls/isms-a.7.12-13-infrastructure-maintenance/) | Infrastructure Maintenance | POL, SCR, WKBK |

---

## A.8 Technological Controls

<p>
<img src="https://img.shields.io/badge/A.8-Technological-DC143C?style=flat-square" alt="Technological"/>
<img src="https://img.shields.io/badge/22_packs-0066CC?style=flat-square" alt="22 packs"/>
<img src="https://img.shields.io/badge/100%25_Complete-00AA00?style=flat-square" alt="100% Complete"/>
</p>

📁 **[A.8-technological-controls/](A.8-technological-controls/)**

| Control | Name | Artifacts |
|---------|------|-----------|
| [A.8.1, 7, 18-19](A.8-technological-controls/isms-a.8.1-7-18-19-endpoint-security/) | Endpoint Security | POL, SCR, WKBK |
| [A.8.2-3, 5](A.8-technological-controls/isms-a.8.2-3-5-authentication-privileged-access/) | Authentication & Privileged Access | POL, SCR, WKBK |
| [A.8.4](A.8-technological-controls/isms-a.8.4-access-to-source-code/) | Access to Source Code | POL, SCR, WKBK |
| [A.8.6](A.8-technological-controls/isms-a.8.6-capacity-management/) | Capacity Management | POL, SCR, WKBK |
| [A.8.8](A.8-technological-controls/isms-a.8.8-vulnerability-management/) | Vulnerability Management | POL, SCR, WKBK |
| [A.8.9](A.8-technological-controls/isms-a.8.9-configuration-management/) | Configuration Management | POL, SCR, WKBK |
| [A.8.10](A.8-technological-controls/isms-a.8.10-data-deletion/) | Data Deletion | POL, SCR, WKBK |
| [A.8.11](A.8-technological-controls/isms-a.8.11-data-masking/) | Data Masking | POL, SCR, WKBK |
| [A.8.12](A.8-technological-controls/isms-a.8.12-data-leakage-prevention/) | Data Leakage Prevention | POL, SCR, WKBK |
| [A.8.15](A.8-technological-controls/isms-a.8.15-logging/) | Logging | POL, SCR, WKBK |
| [A.8.16](A.8-technological-controls/isms-a.8.16-monitoring/) | Monitoring | POL, SCR, WKBK |
| [A.8.17](A.8-technological-controls/isms-a.8.17-clock-synchronization/) | Clock Synchronization | POL, SCR, WKBK |
| [A.8.20-22](A.8-technological-controls/isms-a.8.20-22-network-security/) | Network Security | POL, SCR, WKBK |
| [A.8.23](A.8-technological-controls/isms-a.8.23-web-filtering/) | Web Filtering | POL, SCR, WKBK |
| [A.8.24](A.8-technological-controls/isms-a.8.24-use-of-cryptography/) | Use of Cryptography | POL, SCR, WKBK |
| [A.8.25-26, 29](A.8-technological-controls/isms-a.8.25-26-29-secure-development/) | Secure Development | POL, SCR, WKBK |
| [A.8.27](A.8-technological-controls/isms-a.8.27-secure-systems-engineering/) | Secure Systems Engineering | POL, SCR, WKBK |
| [A.8.28](A.8-technological-controls/isms-a.8.28-secure-coding/) | Secure Coding | POL, SCR, WKBK |
| [A.8.30](A.8-technological-controls/isms-a.8.30-outsourced-development/) | Outsourced Development | POL, SCR, WKBK |
| [A.8.31](A.8-technological-controls/isms-a.8.31-environment-separation/) | Environment Separation | POL, SCR, WKBK |
| [A.8.32](A.8-technological-controls/isms-a.8.32-change-management/) | Change Management | POL, SCR, WKBK |
| [A.8.33-34](A.8-technological-controls/isms-a.8.33-34-testing-and-audit-protection/) | Testing and Audit Protection | POL, SCR, WKBK |

---

## Artifact Legend

| Code | Type | Description | Badge |
|------|------|-------------|-------|
| **POL** | Policy | Operational policy — requirements, guidance, roles, evidence | <img src="https://img.shields.io/badge/POL-9400D3?style=flat-square" alt="POL"/> |
| **SCR** | Scripts | Python generator for compliance checklist workbook | <img src="https://img.shields.io/badge/SCR-3776AB?style=flat-square" alt="SCR"/> |
| **WKBK** | Workbook | Generated Excel compliance checklist | <img src="https://img.shields.io/badge/WKBK-217346?style=flat-square" alt="WKBK"/> |

---

## Getting Started

1. **Choose a section** - Browse by control category above
2. **Read the policy** - Start with `POL/` for requirements
3. **Generate the checklist** - Run the script in `SCR/`
4. **Use the workbook** - Open the Excel file in `WKBK/` and track compliance

---

<p align="center">
  <strong>ISMS CORE Operational v1.0</strong> | ISO 27001:2022 Annex A
</p>

<p align="center">
  <em>Where bamboo antennas actually work.</em> 🎋
</p>