{ "library_version": "0.1.0", "note": "Written by Devseis in its own words for retrieval by the auditor model. ISO/IEC 27001:2022 control titles are cited; the standard's text is not reproduced. GDPR and AI Act entries summarise the law and are not legal advice.", "controls": [ { "id": "A.5.9", "framework": "ISO 27001:2022", "title": "Inventory of information and other associated assets", "summary": "Know which information assets, devices and software exist and who owns them, and keep that list current.", "auditor_looks_for": ["An up-to-date asset list that includes endpoints and installed software", "An owner for each asset"], "endpoint_relevance": "Each endpoint and the software on it (including AI tools) should appear in the inventory." }, { "id": "A.5.12", "framework": "ISO 27001:2022", "title": "Classification of information", "summary": "Label information by how sensitive it is so that the right protection can be applied.", "auditor_looks_for": ["A classification scheme", "Evidence that sensitive data is identified, e.g. personal data"], "endpoint_relevance": "Personal or confidential files stored on laptops need to be found and protected accordingly." }, { "id": "A.5.15", "framework": "ISO 27001:2022", "title": "Access control", "summary": "Grant access to information and systems based on business need, and document the rules.", "auditor_looks_for": ["An access control policy", "Administrative access limited to named, approved people"], "endpoint_relevance": "Only approved IT staff should hold administrator rights on endpoints." }, { "id": "A.5.16", "framework": "ISO 27001:2022", "title": "Identity management", "summary": "Every account belongs to an identifiable person or a documented service, through its whole life cycle.", "auditor_looks_for": ["No shared or anonymous accounts", "Disabled guest and default accounts"], "endpoint_relevance": "Guest accounts and anonymous logins break the link between actions and people." }, { "id": "A.5.17", "framework": "ISO 27001:2022", "title": "Authentication information", "summary": "Passwords and other secrets are allocated, managed and protected under clear rules.", "auditor_looks_for": ["A password rule set (length, reuse, change) enforced by the system", "Users told how to protect their passwords"], "endpoint_relevance": "The device's password policy is the technical enforcement of these rules." }, { "id": "A.5.18", "framework": "ISO 27001:2022", "title": "Access rights", "summary": "Access rights are granted, reviewed regularly and removed when no longer needed.", "auditor_looks_for": ["Periodic review of who has administrator rights", "Removal of rights that are not justified"], "endpoint_relevance": "Employee accounts that are local administrators without approval are a finding." }, { "id": "A.5.20", "framework": "ISO 27001:2022", "title": "Addressing information security within supplier agreements", "summary": "Agreements with suppliers set out the security requirements they must meet.", "auditor_looks_for": ["Signed agreements with security and data protection clauses"], "endpoint_relevance": "Cloud and AI services used from endpoints are suppliers that need agreements." }, { "id": "A.5.24", "framework": "ISO 27001:2022", "title": "Information security incident management planning and preparation", "summary": "Plan in advance how security incidents are reported, handled and communicated.", "auditor_looks_for": ["A documented incident procedure with roles", "Contact points and escalation paths"], "endpoint_relevance": "Endpoint logs and alerts feed the incident process." }, { "id": "A.5.26", "framework": "ISO 27001:2022", "title": "Response to information security incidents", "summary": "Respond to incidents according to the documented procedure.", "auditor_looks_for": ["Records of past incidents and how they were handled"], "endpoint_relevance": "Investigations depend on endpoint evidence being available and trustworthy." }, { "id": "A.5.34", "framework": "ISO 27001:2022", "title": "Privacy and protection of PII", "summary": "Meet the legal and contractual requirements for protecting personal data.", "auditor_looks_for": ["Links between the ISMS and GDPR compliance", "Minimised collection and sharing of personal data"], "endpoint_relevance": "Diagnostic data sharing and OS AI features can send personal data off the device." }, { "id": "A.6.3", "framework": "ISO 27001:2022", "title": "Information security awareness, education and training", "summary": "People receive awareness and training suited to their role, and it is kept current.", "auditor_looks_for": ["Training records", "Topics that match the risks people face (including AI use)"], "endpoint_relevance": "Users decide what they install and share; training reduces shadow IT and shadow AI." }, { "id": "A.6.7", "framework": "ISO 27001:2022", "title": "Remote working", "summary": "Protect information accessed, processed or stored outside the organisation's premises.", "auditor_looks_for": ["Rules for remote access tools", "Only approved remote access services enabled"], "endpoint_relevance": "Remote desktop and screen sharing services open the device to outside access." }, { "id": "A.7.7", "framework": "ISO 27001:2022", "title": "Clear desk and clear screen", "summary": "Unattended screens and papers must not expose information.", "auditor_looks_for": ["Automatic screen lock after a short idle time", "A password needed to unlock"], "endpoint_relevance": "The screen lock settings are the technical control for clear screen." }, { "id": "A.7.10", "framework": "ISO 27001:2022", "title": "Storage media", "summary": "Manage removable media through its life cycle according to the classification of the data on it.", "auditor_looks_for": ["Rules for USB and external drives", "Encryption or blocking of removable media"], "endpoint_relevance": "Unrestricted USB writing lets data leave the device unencrypted." }, { "id": "A.8.1", "framework": "ISO 27001:2022", "title": "User endpoint devices", "summary": "Protect information stored on, processed by or reachable from user devices.", "auditor_looks_for": ["A baseline configuration for laptops and desktops", "Encryption, firewall, screen lock and malware protection enforced"], "endpoint_relevance": "This is the main control the whole endpoint baseline supports." }, { "id": "A.8.2", "framework": "ISO 27001:2022", "title": "Privileged access rights", "summary": "Restrict and manage the allocation and use of administrator rights.", "auditor_looks_for": ["Named, approved administrators", "No everyday user accounts with administrator rights"], "endpoint_relevance": "Local administrator membership on each device shows whether this control works." }, { "id": "A.8.5", "framework": "ISO 27001:2022", "title": "Secure authentication", "summary": "Authentication methods and procedures resist guessing, brute force and misuse.", "auditor_looks_for": ["Account lockout after repeated failures", "Strong password or multi-factor requirements"], "endpoint_relevance": "Lockout, complexity and screen-unlock settings implement this on the device." }, { "id": "A.8.7", "framework": "ISO 27001:2022", "title": "Protection against malware", "summary": "Protect against malware with technical controls supported by user awareness.", "auditor_looks_for": ["Anti-malware running with current signatures", "Protection that cannot easily be switched off"], "endpoint_relevance": "Antivirus status, real-time scanning, tamper protection and signature age are checked on each device." }, { "id": "A.8.8", "framework": "ISO 27001:2022", "title": "Management of technical vulnerabilities", "summary": "Find technical weaknesses in time, judge the exposure and fix them.", "auditor_looks_for": ["Timely patching", "Supported operating system versions"], "endpoint_relevance": "Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed." }, { "id": "A.8.12", "framework": "ISO 27001:2022", "title": "Data leakage prevention", "summary": "Apply measures that stop sensitive information leaving through unauthorised channels.", "auditor_looks_for": ["Controls on removable media and uploads", "Monitoring of data leaving the organisation"], "endpoint_relevance": "USB storage write access is a common leakage channel." }, { "id": "A.8.13", "framework": "ISO 27001:2022", "title": "Information backup", "summary": "Keep backup copies of information and software and test that they can be restored.", "auditor_looks_for": ["Backups configured and recent", "Recovery keys and restore procedures available"], "endpoint_relevance": "Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware." }, { "id": "A.8.15", "framework": "ISO 27001:2022", "title": "Logging", "summary": "Produce, protect and review logs of activities, exceptions and security events.", "auditor_looks_for": ["Logon and account changes recorded", "Logs kept long enough for investigation"], "endpoint_relevance": "Without security event logs, a breach on the device cannot be reconstructed." }, { "id": "A.8.17", "framework": "ISO 27001:2022", "title": "Clock synchronization", "summary": "Synchronise system clocks to an approved time source.", "auditor_looks_for": ["All devices using network time"], "endpoint_relevance": "Correct timestamps are needed to correlate events across devices during an incident." }, { "id": "A.8.19", "framework": "ISO 27001:2022", "title": "Installation of software on operational systems", "summary": "Control which software users may install.", "auditor_looks_for": ["An approved software list", "Restrictions on self-installed software"], "endpoint_relevance": "Unapproved AI tools and remote access tools are signs this control is missing." }, { "id": "A.8.20", "framework": "ISO 27001:2022", "title": "Networks security", "summary": "Secure, manage and control networks and network devices to protect information.", "auditor_looks_for": ["Host firewalls enabled", "Unsolicited inbound connections blocked"], "endpoint_relevance": "The host firewall protects the laptop on untrusted networks such as hotels and cafés." }, { "id": "A.8.24", "framework": "ISO 27001:2022", "title": "Use of cryptography", "summary": "Define and apply rules for using cryptography, including key management.", "auditor_looks_for": ["Full-disk encryption with strong algorithms", "Recovery keys stored safely"], "endpoint_relevance": "Disk encryption protects data on lost or stolen devices." }, { "id": "Art. 5(1)(c)", "framework": "GDPR", "title": "Data minimisation", "summary": "Personal data must be adequate, relevant and limited to what is necessary for the purpose.", "auditor_looks_for": ["Only necessary data collected or shared", "OS and app data sharing reduced to the minimum"], "endpoint_relevance": "Optional diagnostic data and AI features that capture screen content collect more than needed." }, { "id": "Art. 5(1)(e)", "framework": "GDPR", "title": "Storage limitation", "summary": "Personal data must not be kept in identifiable form longer than necessary.", "auditor_looks_for": ["Retention rules", "Old personal data deleted"], "endpoint_relevance": "Copies of personal data left on laptops are often kept far longer than allowed." }, { "id": "Art. 5(1)(f)", "framework": "GDPR", "title": "Integrity and confidentiality", "summary": "Personal data must be protected against unauthorised access, loss and damage with appropriate measures.", "auditor_looks_for": ["Technical security measures in place"], "endpoint_relevance": "The endpoint security baseline is part of these measures." }, { "id": "Art. 25", "framework": "GDPR", "title": "Data protection by design and by default", "summary": "Build data protection into systems and use privacy-friendly settings by default.", "auditor_looks_for": ["Privacy-protective default settings on devices and software"], "endpoint_relevance": "Telemetry and AI data-collection features should be off unless needed." }, { "id": "Art. 28", "framework": "GDPR", "title": "Processor", "summary": "Use only processors that give sufficient guarantees, under a written contract with required terms.", "auditor_looks_for": ["A data processing agreement with each processor"], "endpoint_relevance": "Cloud AI tools used with work data are processors and need an agreement." }, { "id": "Art. 30", "framework": "GDPR", "title": "Records of processing activities", "summary": "Keep a written record of the processing activities you carry out.", "auditor_looks_for": ["A current record of processing (RoPA)"], "endpoint_relevance": "Processing done with endpoint tools, including AI tools, belongs in the record." }, { "id": "Art. 32(1)(a)", "framework": "GDPR", "title": "Security of processing: pseudonymisation and encryption", "summary": "Where appropriate, protect personal data with pseudonymisation and encryption.", "auditor_looks_for": ["Encrypted devices and removable media"], "endpoint_relevance": "Disk encryption is the standard measure for laptops holding personal data." }, { "id": "Art. 32(1)(b)", "framework": "GDPR", "title": "Security of processing: confidentiality, integrity, availability and resilience", "summary": "Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.", "auditor_looks_for": ["Access control, malware protection, patching and network protection on devices"], "endpoint_relevance": "Most endpoint baseline checks support this requirement." }, { "id": "Art. 32(1)(c)", "framework": "GDPR", "title": "Security of processing: restore availability and access after an incident", "summary": "Be able to restore access to personal data in time after a physical or technical incident.", "auditor_looks_for": ["Working backups", "Recovery keys available"], "endpoint_relevance": "Backups and disk-encryption recovery keys make restoration possible." }, { "id": "Art. 32(1)(d)", "framework": "GDPR", "title": "Security of processing: regular testing and evaluation", "summary": "Regularly test, assess and evaluate whether security measures work.", "auditor_looks_for": ["Periodic audits such as this one", "Evidence that findings are followed up"], "endpoint_relevance": "Weekly audits and logging provide this evidence." }, { "id": "Art. 33", "framework": "GDPR", "title": "Notification of a personal data breach to the supervisory authority", "summary": "Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.", "auditor_looks_for": ["A breach procedure", "Logs and accurate time to establish what happened"], "endpoint_relevance": "Security logs and time synchronisation make the 72-hour assessment possible." }, { "id": "Art. 34", "framework": "GDPR", "title": "Communication of a personal data breach to the data subject", "summary": "Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.", "auditor_looks_for": ["Encryption that makes lost data unintelligible"], "endpoint_relevance": "Encrypted devices and media can avoid the need to notify individuals." }, { "id": "Art. 35", "framework": "GDPR", "title": "Data protection impact assessment", "summary": "Assess the impact before processing that is likely to result in a high risk to people.", "auditor_looks_for": ["DPIAs for high-risk processing"], "endpoint_relevance": "New tools with high-risk processing, such as AI used on employees, may need a DPIA." }, { "id": "Art. 44", "framework": "GDPR", "title": "General principle for transfers", "summary": "Transfer personal data outside the EEA only under the conditions of Chapter V.", "auditor_looks_for": ["A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services"], "endpoint_relevance": "Cloud AI tools often process data outside the EEA." }, { "id": "Art. 4", "framework": "EU AI Act", "title": "AI literacy", "summary": "Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.", "auditor_looks_for": ["AI training for staff who use AI tools"], "endpoint_relevance": "AI tools found on endpoints show who needs AI literacy training." }, { "id": "Art. 5", "framework": "EU AI Act", "title": "Prohibited AI practices", "summary": "Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.", "auditor_looks_for": ["No AI tools used for banned purposes"], "endpoint_relevance": "The purpose of each detected AI tool must be checked against the banned list." }, { "id": "Art. 6", "framework": "EU AI Act", "title": "Classification rules for high-risk AI systems", "summary": "An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.", "auditor_looks_for": ["A risk classification for each AI system in use"], "endpoint_relevance": "Classification depends on what the tool is used for, not only on which tool it is." }, { "id": "Art. 14", "framework": "EU AI Act", "title": "Human oversight", "summary": "High-risk AI systems must be designed so that people can oversee them effectively.", "auditor_looks_for": ["Named, trained people overseeing each high-risk AI system"], "endpoint_relevance": "Applies only when a high-risk AI system is in use." }, { "id": "Art. 26", "framework": "EU AI Act", "title": "Obligations of deployers of high-risk AI systems", "summary": "Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.", "auditor_looks_for": ["An AI register", "Use according to instructions", "Monitoring and log retention"], "endpoint_relevance": "The AI software inventory is the starting point for these duties." }, { "id": "Art. 26(6)", "framework": "EU AI Act", "title": "Deployers: keep automatically generated logs for at least six months", "summary": "Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.", "auditor_looks_for": ["Log retention of at least six months for high-risk AI systems"], "endpoint_relevance": "Only applies if a detected AI tool is used in a high-risk way." }, { "id": "Art. 50", "framework": "EU AI Act", "title": "Transparency obligations for providers and deployers of certain AI systems", "summary": "People must be told when they interact with an AI system, and deepfakes and certain AI-generated text must be disclosed.", "auditor_looks_for": ["Disclosure practices for chatbots and AI-generated content"], "endpoint_relevance": "Staff publishing AI-generated content need clear rules." }, { "id": "Annex III", "framework": "EU AI Act", "title": "High-risk AI systems referred to in Article 6(2)", "summary": "Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.", "auditor_looks_for": ["No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes"], "endpoint_relevance": "A general AI assistant becomes high-risk if used, for example, to screen job applicants." } ] }