| { |
| "library_version": "0.1.0", |
| "note": "Written by Devseis in its own words for retrieval by the auditor model. ISO/IEC 27001:2022 control titles are cited; the standard's text is not reproduced. GDPR and AI Act entries summarise the law and are not legal advice.", |
| "controls": [ |
| { "id": "A.5.9", "framework": "ISO 27001:2022", "title": "Inventory of information and other associated assets", |
| "summary": "Know which information assets, devices and software exist and who owns them, and keep that list current.", |
| "auditor_looks_for": ["An up-to-date asset list that includes endpoints and installed software", "An owner for each asset"], |
| "endpoint_relevance": "Each endpoint and the software on it (including AI tools) should appear in the inventory." }, |
| { "id": "A.5.12", "framework": "ISO 27001:2022", "title": "Classification of information", |
| "summary": "Label information by how sensitive it is so that the right protection can be applied.", |
| "auditor_looks_for": ["A classification scheme", "Evidence that sensitive data is identified, e.g. personal data"], |
| "endpoint_relevance": "Personal or confidential files stored on laptops need to be found and protected accordingly." }, |
| { "id": "A.5.15", "framework": "ISO 27001:2022", "title": "Access control", |
| "summary": "Grant access to information and systems based on business need, and document the rules.", |
| "auditor_looks_for": ["An access control policy", "Administrative access limited to named, approved people"], |
| "endpoint_relevance": "Only approved IT staff should hold administrator rights on endpoints." }, |
| { "id": "A.5.16", "framework": "ISO 27001:2022", "title": "Identity management", |
| "summary": "Every account belongs to an identifiable person or a documented service, through its whole life cycle.", |
| "auditor_looks_for": ["No shared or anonymous accounts", "Disabled guest and default accounts"], |
| "endpoint_relevance": "Guest accounts and anonymous logins break the link between actions and people." }, |
| { "id": "A.5.17", "framework": "ISO 27001:2022", "title": "Authentication information", |
| "summary": "Passwords and other secrets are allocated, managed and protected under clear rules.", |
| "auditor_looks_for": ["A password rule set (length, reuse, change) enforced by the system", "Users told how to protect their passwords"], |
| "endpoint_relevance": "The device's password policy is the technical enforcement of these rules." }, |
| { "id": "A.5.18", "framework": "ISO 27001:2022", "title": "Access rights", |
| "summary": "Access rights are granted, reviewed regularly and removed when no longer needed.", |
| "auditor_looks_for": ["Periodic review of who has administrator rights", "Removal of rights that are not justified"], |
| "endpoint_relevance": "Employee accounts that are local administrators without approval are a finding." }, |
| { "id": "A.5.20", "framework": "ISO 27001:2022", "title": "Addressing information security within supplier agreements", |
| "summary": "Agreements with suppliers set out the security requirements they must meet.", |
| "auditor_looks_for": ["Signed agreements with security and data protection clauses"], |
| "endpoint_relevance": "Cloud and AI services used from endpoints are suppliers that need agreements." }, |
| { "id": "A.5.24", "framework": "ISO 27001:2022", "title": "Information security incident management planning and preparation", |
| "summary": "Plan in advance how security incidents are reported, handled and communicated.", |
| "auditor_looks_for": ["A documented incident procedure with roles", "Contact points and escalation paths"], |
| "endpoint_relevance": "Endpoint logs and alerts feed the incident process." }, |
| { "id": "A.5.26", "framework": "ISO 27001:2022", "title": "Response to information security incidents", |
| "summary": "Respond to incidents according to the documented procedure.", |
| "auditor_looks_for": ["Records of past incidents and how they were handled"], |
| "endpoint_relevance": "Investigations depend on endpoint evidence being available and trustworthy." }, |
| { "id": "A.5.34", "framework": "ISO 27001:2022", "title": "Privacy and protection of PII", |
| "summary": "Meet the legal and contractual requirements for protecting personal data.", |
| "auditor_looks_for": ["Links between the ISMS and GDPR compliance", "Minimised collection and sharing of personal data"], |
| "endpoint_relevance": "Diagnostic data sharing and OS AI features can send personal data off the device." }, |
| { "id": "A.6.3", "framework": "ISO 27001:2022", "title": "Information security awareness, education and training", |
| "summary": "People receive awareness and training suited to their role, and it is kept current.", |
| "auditor_looks_for": ["Training records", "Topics that match the risks people face (including AI use)"], |
| "endpoint_relevance": "Users decide what they install and share; training reduces shadow IT and shadow AI." }, |
| { "id": "A.6.7", "framework": "ISO 27001:2022", "title": "Remote working", |
| "summary": "Protect information accessed, processed or stored outside the organisation's premises.", |
| "auditor_looks_for": ["Rules for remote access tools", "Only approved remote access services enabled"], |
| "endpoint_relevance": "Remote desktop and screen sharing services open the device to outside access." }, |
| { "id": "A.7.7", "framework": "ISO 27001:2022", "title": "Clear desk and clear screen", |
| "summary": "Unattended screens and papers must not expose information.", |
| "auditor_looks_for": ["Automatic screen lock after a short idle time", "A password needed to unlock"], |
| "endpoint_relevance": "The screen lock settings are the technical control for clear screen." }, |
| { "id": "A.7.10", "framework": "ISO 27001:2022", "title": "Storage media", |
| "summary": "Manage removable media through its life cycle according to the classification of the data on it.", |
| "auditor_looks_for": ["Rules for USB and external drives", "Encryption or blocking of removable media"], |
| "endpoint_relevance": "Unrestricted USB writing lets data leave the device unencrypted." }, |
| { "id": "A.8.1", "framework": "ISO 27001:2022", "title": "User endpoint devices", |
| "summary": "Protect information stored on, processed by or reachable from user devices.", |
| "auditor_looks_for": ["A baseline configuration for laptops and desktops", "Encryption, firewall, screen lock and malware protection enforced"], |
| "endpoint_relevance": "This is the main control the whole endpoint baseline supports." }, |
| { "id": "A.8.2", "framework": "ISO 27001:2022", "title": "Privileged access rights", |
| "summary": "Restrict and manage the allocation and use of administrator rights.", |
| "auditor_looks_for": ["Named, approved administrators", "No everyday user accounts with administrator rights"], |
| "endpoint_relevance": "Local administrator membership on each device shows whether this control works." }, |
| { "id": "A.8.5", "framework": "ISO 27001:2022", "title": "Secure authentication", |
| "summary": "Authentication methods and procedures resist guessing, brute force and misuse.", |
| "auditor_looks_for": ["Account lockout after repeated failures", "Strong password or multi-factor requirements"], |
| "endpoint_relevance": "Lockout, complexity and screen-unlock settings implement this on the device." }, |
| { "id": "A.8.7", "framework": "ISO 27001:2022", "title": "Protection against malware", |
| "summary": "Protect against malware with technical controls supported by user awareness.", |
| "auditor_looks_for": ["Anti-malware running with current signatures", "Protection that cannot easily be switched off"], |
| "endpoint_relevance": "Antivirus status, real-time scanning, tamper protection and signature age are checked on each device." }, |
| { "id": "A.8.8", "framework": "ISO 27001:2022", "title": "Management of technical vulnerabilities", |
| "summary": "Find technical weaknesses in time, judge the exposure and fix them.", |
| "auditor_looks_for": ["Timely patching", "Supported operating system versions"], |
| "endpoint_relevance": "Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed." }, |
| { "id": "A.8.12", "framework": "ISO 27001:2022", "title": "Data leakage prevention", |
| "summary": "Apply measures that stop sensitive information leaving through unauthorised channels.", |
| "auditor_looks_for": ["Controls on removable media and uploads", "Monitoring of data leaving the organisation"], |
| "endpoint_relevance": "USB storage write access is a common leakage channel." }, |
| { "id": "A.8.13", "framework": "ISO 27001:2022", "title": "Information backup", |
| "summary": "Keep backup copies of information and software and test that they can be restored.", |
| "auditor_looks_for": ["Backups configured and recent", "Recovery keys and restore procedures available"], |
| "endpoint_relevance": "Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware." }, |
| { "id": "A.8.15", "framework": "ISO 27001:2022", "title": "Logging", |
| "summary": "Produce, protect and review logs of activities, exceptions and security events.", |
| "auditor_looks_for": ["Logon and account changes recorded", "Logs kept long enough for investigation"], |
| "endpoint_relevance": "Without security event logs, a breach on the device cannot be reconstructed." }, |
| { "id": "A.8.17", "framework": "ISO 27001:2022", "title": "Clock synchronization", |
| "summary": "Synchronise system clocks to an approved time source.", |
| "auditor_looks_for": ["All devices using network time"], |
| "endpoint_relevance": "Correct timestamps are needed to correlate events across devices during an incident." }, |
| { "id": "A.8.19", "framework": "ISO 27001:2022", "title": "Installation of software on operational systems", |
| "summary": "Control which software users may install.", |
| "auditor_looks_for": ["An approved software list", "Restrictions on self-installed software"], |
| "endpoint_relevance": "Unapproved AI tools and remote access tools are signs this control is missing." }, |
| { "id": "A.8.20", "framework": "ISO 27001:2022", "title": "Networks security", |
| "summary": "Secure, manage and control networks and network devices to protect information.", |
| "auditor_looks_for": ["Host firewalls enabled", "Unsolicited inbound connections blocked"], |
| "endpoint_relevance": "The host firewall protects the laptop on untrusted networks such as hotels and cafés." }, |
| { "id": "A.8.24", "framework": "ISO 27001:2022", "title": "Use of cryptography", |
| "summary": "Define and apply rules for using cryptography, including key management.", |
| "auditor_looks_for": ["Full-disk encryption with strong algorithms", "Recovery keys stored safely"], |
| "endpoint_relevance": "Disk encryption protects data on lost or stolen devices." }, |
|
|
| { "id": "Art. 5(1)(c)", "framework": "GDPR", "title": "Data minimisation", |
| "summary": "Personal data must be adequate, relevant and limited to what is necessary for the purpose.", |
| "auditor_looks_for": ["Only necessary data collected or shared", "OS and app data sharing reduced to the minimum"], |
| "endpoint_relevance": "Optional diagnostic data and AI features that capture screen content collect more than needed." }, |
| { "id": "Art. 5(1)(e)", "framework": "GDPR", "title": "Storage limitation", |
| "summary": "Personal data must not be kept in identifiable form longer than necessary.", |
| "auditor_looks_for": ["Retention rules", "Old personal data deleted"], |
| "endpoint_relevance": "Copies of personal data left on laptops are often kept far longer than allowed." }, |
| { "id": "Art. 5(1)(f)", "framework": "GDPR", "title": "Integrity and confidentiality", |
| "summary": "Personal data must be protected against unauthorised access, loss and damage with appropriate measures.", |
| "auditor_looks_for": ["Technical security measures in place"], |
| "endpoint_relevance": "The endpoint security baseline is part of these measures." }, |
| { "id": "Art. 25", "framework": "GDPR", "title": "Data protection by design and by default", |
| "summary": "Build data protection into systems and use privacy-friendly settings by default.", |
| "auditor_looks_for": ["Privacy-protective default settings on devices and software"], |
| "endpoint_relevance": "Telemetry and AI data-collection features should be off unless needed." }, |
| { "id": "Art. 28", "framework": "GDPR", "title": "Processor", |
| "summary": "Use only processors that give sufficient guarantees, under a written contract with required terms.", |
| "auditor_looks_for": ["A data processing agreement with each processor"], |
| "endpoint_relevance": "Cloud AI tools used with work data are processors and need an agreement." }, |
| { "id": "Art. 30", "framework": "GDPR", "title": "Records of processing activities", |
| "summary": "Keep a written record of the processing activities you carry out.", |
| "auditor_looks_for": ["A current record of processing (RoPA)"], |
| "endpoint_relevance": "Processing done with endpoint tools, including AI tools, belongs in the record." }, |
| { "id": "Art. 32(1)(a)", "framework": "GDPR", "title": "Security of processing: pseudonymisation and encryption", |
| "summary": "Where appropriate, protect personal data with pseudonymisation and encryption.", |
| "auditor_looks_for": ["Encrypted devices and removable media"], |
| "endpoint_relevance": "Disk encryption is the standard measure for laptops holding personal data." }, |
| { "id": "Art. 32(1)(b)", "framework": "GDPR", "title": "Security of processing: confidentiality, integrity, availability and resilience", |
| "summary": "Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.", |
| "auditor_looks_for": ["Access control, malware protection, patching and network protection on devices"], |
| "endpoint_relevance": "Most endpoint baseline checks support this requirement." }, |
| { "id": "Art. 32(1)(c)", "framework": "GDPR", "title": "Security of processing: restore availability and access after an incident", |
| "summary": "Be able to restore access to personal data in time after a physical or technical incident.", |
| "auditor_looks_for": ["Working backups", "Recovery keys available"], |
| "endpoint_relevance": "Backups and disk-encryption recovery keys make restoration possible." }, |
| { "id": "Art. 32(1)(d)", "framework": "GDPR", "title": "Security of processing: regular testing and evaluation", |
| "summary": "Regularly test, assess and evaluate whether security measures work.", |
| "auditor_looks_for": ["Periodic audits such as this one", "Evidence that findings are followed up"], |
| "endpoint_relevance": "Weekly audits and logging provide this evidence." }, |
| { "id": "Art. 33", "framework": "GDPR", "title": "Notification of a personal data breach to the supervisory authority", |
| "summary": "Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.", |
| "auditor_looks_for": ["A breach procedure", "Logs and accurate time to establish what happened"], |
| "endpoint_relevance": "Security logs and time synchronisation make the 72-hour assessment possible." }, |
| { "id": "Art. 34", "framework": "GDPR", "title": "Communication of a personal data breach to the data subject", |
| "summary": "Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.", |
| "auditor_looks_for": ["Encryption that makes lost data unintelligible"], |
| "endpoint_relevance": "Encrypted devices and media can avoid the need to notify individuals." }, |
| { "id": "Art. 35", "framework": "GDPR", "title": "Data protection impact assessment", |
| "summary": "Assess the impact before processing that is likely to result in a high risk to people.", |
| "auditor_looks_for": ["DPIAs for high-risk processing"], |
| "endpoint_relevance": "New tools with high-risk processing, such as AI used on employees, may need a DPIA." }, |
| { "id": "Art. 44", "framework": "GDPR", "title": "General principle for transfers", |
| "summary": "Transfer personal data outside the EEA only under the conditions of Chapter V.", |
| "auditor_looks_for": ["A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services"], |
| "endpoint_relevance": "Cloud AI tools often process data outside the EEA." }, |
|
|
| { "id": "Art. 4", "framework": "EU AI Act", "title": "AI literacy", |
| "summary": "Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.", |
| "auditor_looks_for": ["AI training for staff who use AI tools"], |
| "endpoint_relevance": "AI tools found on endpoints show who needs AI literacy training." }, |
| { "id": "Art. 5", "framework": "EU AI Act", "title": "Prohibited AI practices", |
| "summary": "Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.", |
| "auditor_looks_for": ["No AI tools used for banned purposes"], |
| "endpoint_relevance": "The purpose of each detected AI tool must be checked against the banned list." }, |
| { "id": "Art. 6", "framework": "EU AI Act", "title": "Classification rules for high-risk AI systems", |
| "summary": "An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.", |
| "auditor_looks_for": ["A risk classification for each AI system in use"], |
| "endpoint_relevance": "Classification depends on what the tool is used for, not only on which tool it is." }, |
| { "id": "Art. 14", "framework": "EU AI Act", "title": "Human oversight", |
| "summary": "High-risk AI systems must be designed so that people can oversee them effectively.", |
| "auditor_looks_for": ["Named, trained people overseeing each high-risk AI system"], |
| "endpoint_relevance": "Applies only when a high-risk AI system is in use." }, |
| { "id": "Art. 26", "framework": "EU AI Act", "title": "Obligations of deployers of high-risk AI systems", |
| "summary": "Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.", |
| "auditor_looks_for": ["An AI register", "Use according to instructions", "Monitoring and log retention"], |
| "endpoint_relevance": "The AI software inventory is the starting point for these duties." }, |
| { "id": "Art. 26(6)", "framework": "EU AI Act", "title": "Deployers: keep automatically generated logs for at least six months", |
| "summary": "Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.", |
| "auditor_looks_for": ["Log retention of at least six months for high-risk AI systems"], |
| "endpoint_relevance": "Only applies if a detected AI tool is used in a high-risk way." }, |
| { "id": "Art. 50", "framework": "EU AI Act", "title": "Transparency obligations for providers and deployers of certain AI systems", |
| "summary": "People must be told when they interact with an AI system, and deepfakes and certain AI-generated text must be disclosed.", |
| "auditor_looks_for": ["Disclosure practices for chatbots and AI-generated content"], |
| "endpoint_relevance": "Staff publishing AI-generated content need clear rules." }, |
| { "id": "Annex III", "framework": "EU AI Act", "title": "High-risk AI systems referred to in Article 6(2)", |
| "summary": "Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.", |
| "auditor_looks_for": ["No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes"], |
| "endpoint_relevance": "A general AI assistant becomes high-risk if used, for example, to screen job applicants." } |
| ] |
| } |
|
|
