File size: 22,884 Bytes
b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb 1e42c44 b1768eb | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 | {
"library_version": "0.1.0",
"note": "Written by Devseis in its own words for retrieval by the auditor model. ISO/IEC 27001:2022 control titles are cited; the standard's text is not reproduced. GDPR and AI Act entries summarise the law and are not legal advice.",
"controls": [
{
"id": "A.5.9",
"framework": "ISO 27001:2022",
"title": "Inventory of information and other associated assets",
"summary": "Know which information assets, devices and software exist and who owns them, and keep that list current.",
"auditor_looks_for": [
"An up-to-date asset list that includes endpoints and installed software",
"An owner for each asset"
],
"endpoint_relevance": "Each endpoint and the software on it (including AI tools) should appear in the inventory."
},
{
"id": "A.5.12",
"framework": "ISO 27001:2022",
"title": "Classification of information",
"summary": "Label information by how sensitive it is so that the right protection can be applied.",
"auditor_looks_for": [
"A classification scheme",
"Evidence that sensitive data is identified, e.g. personal data"
],
"endpoint_relevance": "Personal or confidential files stored on laptops need to be found and protected accordingly."
},
{
"id": "A.5.15",
"framework": "ISO 27001:2022",
"title": "Access control",
"summary": "Grant access to information and systems based on business need, and document the rules.",
"auditor_looks_for": [
"An access control policy",
"Administrative access limited to named, approved people"
],
"endpoint_relevance": "Only approved IT staff should hold administrator rights on endpoints."
},
{
"id": "A.5.16",
"framework": "ISO 27001:2022",
"title": "Identity management",
"summary": "Every account belongs to an identifiable person or a documented service, through its whole life cycle.",
"auditor_looks_for": [
"No shared or anonymous accounts",
"Disabled guest and default accounts"
],
"endpoint_relevance": "Guest accounts and anonymous logins break the link between actions and people."
},
{
"id": "A.5.17",
"framework": "ISO 27001:2022",
"title": "Authentication information",
"summary": "Passwords and other secrets are allocated, managed and protected under clear rules.",
"auditor_looks_for": [
"A password rule set (length, reuse, change) enforced by the system",
"Users told how to protect their passwords"
],
"endpoint_relevance": "The device's password policy is the technical enforcement of these rules."
},
{
"id": "A.5.18",
"framework": "ISO 27001:2022",
"title": "Access rights",
"summary": "Access rights are granted, reviewed regularly and removed when no longer needed.",
"auditor_looks_for": [
"Periodic review of who has administrator rights",
"Removal of rights that are not justified"
],
"endpoint_relevance": "Employee accounts that are local administrators without approval are a finding."
},
{
"id": "A.5.20",
"framework": "ISO 27001:2022",
"title": "Addressing information security within supplier agreements",
"summary": "Agreements with suppliers set out the security requirements they must meet.",
"auditor_looks_for": [
"Signed agreements with security and data protection clauses"
],
"endpoint_relevance": "Cloud and AI services used from endpoints are suppliers that need agreements."
},
{
"id": "A.5.24",
"framework": "ISO 27001:2022",
"title": "Information security incident management planning and preparation",
"summary": "Plan in advance how security incidents are reported, handled and communicated.",
"auditor_looks_for": [
"A documented incident procedure with roles",
"Contact points and escalation paths"
],
"endpoint_relevance": "Endpoint logs and alerts feed the incident process."
},
{
"id": "A.5.26",
"framework": "ISO 27001:2022",
"title": "Response to information security incidents",
"summary": "Respond to incidents according to the documented procedure.",
"auditor_looks_for": [
"Records of past incidents and how they were handled"
],
"endpoint_relevance": "Investigations depend on endpoint evidence being available and trustworthy."
},
{
"id": "A.5.34",
"framework": "ISO 27001:2022",
"title": "Privacy and protection of PII",
"summary": "Meet the legal and contractual requirements for protecting personal data.",
"auditor_looks_for": [
"Links between the ISMS and GDPR compliance",
"Minimised collection and sharing of personal data"
],
"endpoint_relevance": "Diagnostic data sharing and OS AI features can send personal data off the device."
},
{
"id": "A.6.3",
"framework": "ISO 27001:2022",
"title": "Information security awareness, education and training",
"summary": "People receive awareness and training suited to their role, and it is kept current.",
"auditor_looks_for": [
"Training records",
"Topics that match the risks people face (including AI use)"
],
"endpoint_relevance": "Users decide what they install and share; training reduces shadow IT and shadow AI."
},
{
"id": "A.6.7",
"framework": "ISO 27001:2022",
"title": "Remote working",
"summary": "Protect information accessed, processed or stored outside the organisation's premises.",
"auditor_looks_for": [
"Rules for remote access tools",
"Only approved remote access services enabled"
],
"endpoint_relevance": "Remote desktop and screen sharing services open the device to outside access."
},
{
"id": "A.7.7",
"framework": "ISO 27001:2022",
"title": "Clear desk and clear screen",
"summary": "Unattended screens and papers must not expose information.",
"auditor_looks_for": [
"Automatic screen lock after a short idle time",
"A password needed to unlock"
],
"endpoint_relevance": "The screen lock settings are the technical control for clear screen."
},
{
"id": "A.7.10",
"framework": "ISO 27001:2022",
"title": "Storage media",
"summary": "Manage removable media through its life cycle according to the classification of the data on it.",
"auditor_looks_for": [
"Rules for USB and external drives",
"Encryption or blocking of removable media"
],
"endpoint_relevance": "Unrestricted USB writing lets data leave the device unencrypted."
},
{
"id": "A.8.1",
"framework": "ISO 27001:2022",
"title": "User endpoint devices",
"summary": "Protect information stored on, processed by or reachable from user devices.",
"auditor_looks_for": [
"A baseline configuration for laptops and desktops",
"Encryption, firewall, screen lock and malware protection enforced"
],
"endpoint_relevance": "This is the main control the whole endpoint baseline supports."
},
{
"id": "A.8.2",
"framework": "ISO 27001:2022",
"title": "Privileged access rights",
"summary": "Restrict and manage the allocation and use of administrator rights.",
"auditor_looks_for": [
"Named, approved administrators",
"No everyday user accounts with administrator rights"
],
"endpoint_relevance": "Local administrator membership on each device shows whether this control works."
},
{
"id": "A.8.5",
"framework": "ISO 27001:2022",
"title": "Secure authentication",
"summary": "Authentication methods and procedures resist guessing, brute force and misuse.",
"auditor_looks_for": [
"Account lockout after repeated failures",
"Strong password or multi-factor requirements"
],
"endpoint_relevance": "Lockout, complexity and screen-unlock settings implement this on the device."
},
{
"id": "A.8.7",
"framework": "ISO 27001:2022",
"title": "Protection against malware",
"summary": "Protect against malware with technical controls supported by user awareness.",
"auditor_looks_for": [
"Anti-malware running with current signatures",
"Protection that cannot easily be switched off"
],
"endpoint_relevance": "Antivirus status, real-time scanning, tamper protection and signature age are checked on each device."
},
{
"id": "A.8.8",
"framework": "ISO 27001:2022",
"title": "Management of technical vulnerabilities",
"summary": "Find technical weaknesses in time, judge the exposure and fix them.",
"auditor_looks_for": [
"Timely patching",
"Supported operating system versions"
],
"endpoint_relevance": "Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed."
},
{
"id": "A.8.12",
"framework": "ISO 27001:2022",
"title": "Data leakage prevention",
"summary": "Apply measures that stop sensitive information leaving through unauthorised channels.",
"auditor_looks_for": [
"Controls on removable media and uploads",
"Monitoring of data leaving the organisation"
],
"endpoint_relevance": "USB storage write access is a common leakage channel."
},
{
"id": "A.8.13",
"framework": "ISO 27001:2022",
"title": "Information backup",
"summary": "Keep backup copies of information and software and test that they can be restored.",
"auditor_looks_for": [
"Backups configured and recent",
"Recovery keys and restore procedures available"
],
"endpoint_relevance": "Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware."
},
{
"id": "A.8.15",
"framework": "ISO 27001:2022",
"title": "Logging",
"summary": "Produce, protect and review logs of activities, exceptions and security events.",
"auditor_looks_for": [
"Logon and account changes recorded",
"Logs kept long enough for investigation"
],
"endpoint_relevance": "Without security event logs, a breach on the device cannot be reconstructed."
},
{
"id": "A.8.17",
"framework": "ISO 27001:2022",
"title": "Clock synchronization",
"summary": "Synchronise system clocks to an approved time source.",
"auditor_looks_for": [
"All devices using network time"
],
"endpoint_relevance": "Correct timestamps are needed to correlate events across devices during an incident."
},
{
"id": "A.8.19",
"framework": "ISO 27001:2022",
"title": "Installation of software on operational systems",
"summary": "Control which software users may install.",
"auditor_looks_for": [
"An approved software list",
"Restrictions on self-installed software"
],
"endpoint_relevance": "Unapproved AI tools and remote access tools are signs this control is missing."
},
{
"id": "A.8.20",
"framework": "ISO 27001:2022",
"title": "Networks security",
"summary": "Secure, manage and control networks and network devices to protect information.",
"auditor_looks_for": [
"Host firewalls enabled",
"Unsolicited inbound connections blocked"
],
"endpoint_relevance": "The host firewall protects the laptop on untrusted networks such as hotels and cafés."
},
{
"id": "A.8.24",
"framework": "ISO 27001:2022",
"title": "Use of cryptography",
"summary": "Define and apply rules for using cryptography, including key management.",
"auditor_looks_for": [
"Full-disk encryption with strong algorithms",
"Recovery keys stored safely"
],
"endpoint_relevance": "Disk encryption protects data on lost or stolen devices."
},
{
"id": "Art. 5(1)(c)",
"framework": "GDPR",
"title": "Data minimisation",
"summary": "Personal data must be adequate, relevant and limited to what is necessary for the purpose.",
"auditor_looks_for": [
"Only necessary data collected or shared",
"OS and app data sharing reduced to the minimum"
],
"endpoint_relevance": "Optional diagnostic data and AI features that capture screen content collect more than needed."
},
{
"id": "Art. 5(1)(e)",
"framework": "GDPR",
"title": "Storage limitation",
"summary": "Personal data must not be kept in identifiable form longer than necessary.",
"auditor_looks_for": [
"Retention rules",
"Old personal data deleted"
],
"endpoint_relevance": "Copies of personal data left on laptops are often kept far longer than allowed."
},
{
"id": "Art. 5(1)(f)",
"framework": "GDPR",
"title": "Integrity and confidentiality",
"summary": "Personal data must be protected against unauthorised access, loss and damage with appropriate measures.",
"auditor_looks_for": [
"Technical security measures in place"
],
"endpoint_relevance": "The endpoint security baseline is part of these measures."
},
{
"id": "Art. 25",
"framework": "GDPR",
"title": "Data protection by design and by default",
"summary": "Build data protection into systems and use privacy-friendly settings by default.",
"auditor_looks_for": [
"Privacy-protective default settings on devices and software"
],
"endpoint_relevance": "Telemetry and AI data-collection features should be off unless needed."
},
{
"id": "Art. 28",
"framework": "GDPR",
"title": "Processor",
"summary": "Use only processors that give sufficient guarantees, under a written contract with required terms.",
"auditor_looks_for": [
"A data processing agreement with each processor"
],
"endpoint_relevance": "Cloud AI tools used with work data are processors and need an agreement."
},
{
"id": "Art. 30",
"framework": "GDPR",
"title": "Records of processing activities",
"summary": "Keep a written record of the processing activities you carry out.",
"auditor_looks_for": [
"A current record of processing (RoPA)"
],
"endpoint_relevance": "Processing done with endpoint tools, including AI tools, belongs in the record."
},
{
"id": "Art. 32(1)(a)",
"framework": "GDPR",
"title": "Security of processing: pseudonymisation and encryption",
"summary": "Where appropriate, protect personal data with pseudonymisation and encryption.",
"auditor_looks_for": [
"Encrypted devices and removable media"
],
"endpoint_relevance": "Disk encryption is the standard measure for laptops holding personal data."
},
{
"id": "Art. 32(1)(b)",
"framework": "GDPR",
"title": "Security of processing: confidentiality, integrity, availability and resilience",
"summary": "Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.",
"auditor_looks_for": [
"Access control, malware protection, patching and network protection on devices"
],
"endpoint_relevance": "Most endpoint baseline checks support this requirement."
},
{
"id": "Art. 32(1)(c)",
"framework": "GDPR",
"title": "Security of processing: restore availability and access after an incident",
"summary": "Be able to restore access to personal data in time after a physical or technical incident.",
"auditor_looks_for": [
"Working backups",
"Recovery keys available"
],
"endpoint_relevance": "Backups and disk-encryption recovery keys make restoration possible."
},
{
"id": "Art. 32(1)(d)",
"framework": "GDPR",
"title": "Security of processing: regular testing and evaluation",
"summary": "Regularly test, assess and evaluate whether security measures work.",
"auditor_looks_for": [
"Periodic audits such as this one",
"Evidence that findings are followed up"
],
"endpoint_relevance": "Weekly audits and logging provide this evidence."
},
{
"id": "Art. 33",
"framework": "GDPR",
"title": "Notification of a personal data breach to the supervisory authority",
"summary": "Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.",
"auditor_looks_for": [
"A breach procedure",
"Logs and accurate time to establish what happened"
],
"endpoint_relevance": "Security logs and time synchronisation make the 72-hour assessment possible."
},
{
"id": "Art. 34",
"framework": "GDPR",
"title": "Communication of a personal data breach to the data subject",
"summary": "Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.",
"auditor_looks_for": [
"Encryption that makes lost data unintelligible"
],
"endpoint_relevance": "Encrypted devices and media can avoid the need to notify individuals."
},
{
"id": "Art. 35",
"framework": "GDPR",
"title": "Data protection impact assessment",
"summary": "Assess the impact before processing that is likely to result in a high risk to people.",
"auditor_looks_for": [
"DPIAs for high-risk processing"
],
"endpoint_relevance": "New tools with high-risk processing, such as AI used on employees, may need a DPIA."
},
{
"id": "Art. 44",
"framework": "GDPR",
"title": "General principle for transfers",
"summary": "Transfer personal data outside the EEA only under the conditions of Chapter V.",
"auditor_looks_for": [
"A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services"
],
"endpoint_relevance": "Cloud AI tools often process data outside the EEA."
},
{
"id": "Art. 4",
"framework": "EU AI Act",
"title": "AI literacy",
"summary": "Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.",
"auditor_looks_for": [
"AI training for staff who use AI tools"
],
"endpoint_relevance": "AI tools found on endpoints show who needs AI literacy training."
},
{
"id": "Art. 5",
"framework": "EU AI Act",
"title": "Prohibited AI practices",
"summary": "Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.",
"auditor_looks_for": [
"No AI tools used for banned purposes"
],
"endpoint_relevance": "The purpose of each detected AI tool must be checked against the banned list."
},
{
"id": "Art. 6",
"framework": "EU AI Act",
"title": "Classification rules for high-risk AI systems",
"summary": "An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.",
"auditor_looks_for": [
"A risk classification for each AI system in use"
],
"endpoint_relevance": "Classification depends on what the tool is used for, not only on which tool it is."
},
{
"id": "Art. 14",
"framework": "EU AI Act",
"title": "Human oversight",
"summary": "High-risk AI systems must be designed so that people can oversee them effectively.",
"auditor_looks_for": [
"Named, trained people overseeing each high-risk AI system"
],
"endpoint_relevance": "Applies only when a high-risk AI system is in use."
},
{
"id": "Art. 26",
"framework": "EU AI Act",
"title": "Obligations of deployers of high-risk AI systems",
"summary": "Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.",
"auditor_looks_for": [
"An AI register",
"Use according to instructions",
"Monitoring and log retention"
],
"endpoint_relevance": "The AI software inventory is the starting point for these duties."
},
{
"id": "Art. 26(6)",
"framework": "EU AI Act",
"title": "Deployers: keep automatically generated logs for at least six months",
"summary": "Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.",
"auditor_looks_for": [
"Log retention of at least six months for high-risk AI systems"
],
"endpoint_relevance": "Only applies if a detected AI tool is used in a high-risk way."
},
{
"id": "Art. 50",
"framework": "EU AI Act",
"title": "Transparency obligations for providers and deployers of certain AI systems",
"summary": "People must be told when they interact with an AI system, and deepfakes and certain AI-generated text must be disclosed.",
"auditor_looks_for": [
"Disclosure practices for chatbots and AI-generated content"
],
"endpoint_relevance": "Staff publishing AI-generated content need clear rules."
},
{
"id": "Annex III",
"framework": "EU AI Act",
"title": "High-risk AI systems referred to in Article 6(2)",
"summary": "Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.",
"auditor_looks_for": [
"No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes"
],
"endpoint_relevance": "A general AI assistant becomes high-risk if used, for example, to screen job applicants."
},
{
"id": "A.5.32",
"framework": "ISO 27001:2022",
"title": "Intellectual property rights",
"summary": "Protect intellectual property rights and use only properly licensed software.",
"auditor_looks_for": [
"A software licence register",
"No pirated software, activation cracks or unlicensed copies on devices"
],
"endpoint_relevance": "Torrent clients and activation cracks on a device point to unlicensed software and a weak software-installation control."
}
]
}
|