Catalog 0.4 (70 computer checks: unique login, prohibited software, tamper protection on Mac/Linux), app 0.5.1
1e42c44 verified | { | |
| "library_version": "0.1.0", | |
| "note": "Written by Devseis in its own words for retrieval by the auditor model. ISO/IEC 27001:2022 control titles are cited; the standard's text is not reproduced. GDPR and AI Act entries summarise the law and are not legal advice.", | |
| "controls": [ | |
| { | |
| "id": "A.5.9", | |
| "framework": "ISO 27001:2022", | |
| "title": "Inventory of information and other associated assets", | |
| "summary": "Know which information assets, devices and software exist and who owns them, and keep that list current.", | |
| "auditor_looks_for": [ | |
| "An up-to-date asset list that includes endpoints and installed software", | |
| "An owner for each asset" | |
| ], | |
| "endpoint_relevance": "Each endpoint and the software on it (including AI tools) should appear in the inventory." | |
| }, | |
| { | |
| "id": "A.5.12", | |
| "framework": "ISO 27001:2022", | |
| "title": "Classification of information", | |
| "summary": "Label information by how sensitive it is so that the right protection can be applied.", | |
| "auditor_looks_for": [ | |
| "A classification scheme", | |
| "Evidence that sensitive data is identified, e.g. personal data" | |
| ], | |
| "endpoint_relevance": "Personal or confidential files stored on laptops need to be found and protected accordingly." | |
| }, | |
| { | |
| "id": "A.5.15", | |
| "framework": "ISO 27001:2022", | |
| "title": "Access control", | |
| "summary": "Grant access to information and systems based on business need, and document the rules.", | |
| "auditor_looks_for": [ | |
| "An access control policy", | |
| "Administrative access limited to named, approved people" | |
| ], | |
| "endpoint_relevance": "Only approved IT staff should hold administrator rights on endpoints." | |
| }, | |
| { | |
| "id": "A.5.16", | |
| "framework": "ISO 27001:2022", | |
| "title": "Identity management", | |
| "summary": "Every account belongs to an identifiable person or a documented service, through its whole life cycle.", | |
| "auditor_looks_for": [ | |
| "No shared or anonymous accounts", | |
| "Disabled guest and default accounts" | |
| ], | |
| "endpoint_relevance": "Guest accounts and anonymous logins break the link between actions and people." | |
| }, | |
| { | |
| "id": "A.5.17", | |
| "framework": "ISO 27001:2022", | |
| "title": "Authentication information", | |
| "summary": "Passwords and other secrets are allocated, managed and protected under clear rules.", | |
| "auditor_looks_for": [ | |
| "A password rule set (length, reuse, change) enforced by the system", | |
| "Users told how to protect their passwords" | |
| ], | |
| "endpoint_relevance": "The device's password policy is the technical enforcement of these rules." | |
| }, | |
| { | |
| "id": "A.5.18", | |
| "framework": "ISO 27001:2022", | |
| "title": "Access rights", | |
| "summary": "Access rights are granted, reviewed regularly and removed when no longer needed.", | |
| "auditor_looks_for": [ | |
| "Periodic review of who has administrator rights", | |
| "Removal of rights that are not justified" | |
| ], | |
| "endpoint_relevance": "Employee accounts that are local administrators without approval are a finding." | |
| }, | |
| { | |
| "id": "A.5.20", | |
| "framework": "ISO 27001:2022", | |
| "title": "Addressing information security within supplier agreements", | |
| "summary": "Agreements with suppliers set out the security requirements they must meet.", | |
| "auditor_looks_for": [ | |
| "Signed agreements with security and data protection clauses" | |
| ], | |
| "endpoint_relevance": "Cloud and AI services used from endpoints are suppliers that need agreements." | |
| }, | |
| { | |
| "id": "A.5.24", | |
| "framework": "ISO 27001:2022", | |
| "title": "Information security incident management planning and preparation", | |
| "summary": "Plan in advance how security incidents are reported, handled and communicated.", | |
| "auditor_looks_for": [ | |
| "A documented incident procedure with roles", | |
| "Contact points and escalation paths" | |
| ], | |
| "endpoint_relevance": "Endpoint logs and alerts feed the incident process." | |
| }, | |
| { | |
| "id": "A.5.26", | |
| "framework": "ISO 27001:2022", | |
| "title": "Response to information security incidents", | |
| "summary": "Respond to incidents according to the documented procedure.", | |
| "auditor_looks_for": [ | |
| "Records of past incidents and how they were handled" | |
| ], | |
| "endpoint_relevance": "Investigations depend on endpoint evidence being available and trustworthy." | |
| }, | |
| { | |
| "id": "A.5.34", | |
| "framework": "ISO 27001:2022", | |
| "title": "Privacy and protection of PII", | |
| "summary": "Meet the legal and contractual requirements for protecting personal data.", | |
| "auditor_looks_for": [ | |
| "Links between the ISMS and GDPR compliance", | |
| "Minimised collection and sharing of personal data" | |
| ], | |
| "endpoint_relevance": "Diagnostic data sharing and OS AI features can send personal data off the device." | |
| }, | |
| { | |
| "id": "A.6.3", | |
| "framework": "ISO 27001:2022", | |
| "title": "Information security awareness, education and training", | |
| "summary": "People receive awareness and training suited to their role, and it is kept current.", | |
| "auditor_looks_for": [ | |
| "Training records", | |
| "Topics that match the risks people face (including AI use)" | |
| ], | |
| "endpoint_relevance": "Users decide what they install and share; training reduces shadow IT and shadow AI." | |
| }, | |
| { | |
| "id": "A.6.7", | |
| "framework": "ISO 27001:2022", | |
| "title": "Remote working", | |
| "summary": "Protect information accessed, processed or stored outside the organisation's premises.", | |
| "auditor_looks_for": [ | |
| "Rules for remote access tools", | |
| "Only approved remote access services enabled" | |
| ], | |
| "endpoint_relevance": "Remote desktop and screen sharing services open the device to outside access." | |
| }, | |
| { | |
| "id": "A.7.7", | |
| "framework": "ISO 27001:2022", | |
| "title": "Clear desk and clear screen", | |
| "summary": "Unattended screens and papers must not expose information.", | |
| "auditor_looks_for": [ | |
| "Automatic screen lock after a short idle time", | |
| "A password needed to unlock" | |
| ], | |
| "endpoint_relevance": "The screen lock settings are the technical control for clear screen." | |
| }, | |
| { | |
| "id": "A.7.10", | |
| "framework": "ISO 27001:2022", | |
| "title": "Storage media", | |
| "summary": "Manage removable media through its life cycle according to the classification of the data on it.", | |
| "auditor_looks_for": [ | |
| "Rules for USB and external drives", | |
| "Encryption or blocking of removable media" | |
| ], | |
| "endpoint_relevance": "Unrestricted USB writing lets data leave the device unencrypted." | |
| }, | |
| { | |
| "id": "A.8.1", | |
| "framework": "ISO 27001:2022", | |
| "title": "User endpoint devices", | |
| "summary": "Protect information stored on, processed by or reachable from user devices.", | |
| "auditor_looks_for": [ | |
| "A baseline configuration for laptops and desktops", | |
| "Encryption, firewall, screen lock and malware protection enforced" | |
| ], | |
| "endpoint_relevance": "This is the main control the whole endpoint baseline supports." | |
| }, | |
| { | |
| "id": "A.8.2", | |
| "framework": "ISO 27001:2022", | |
| "title": "Privileged access rights", | |
| "summary": "Restrict and manage the allocation and use of administrator rights.", | |
| "auditor_looks_for": [ | |
| "Named, approved administrators", | |
| "No everyday user accounts with administrator rights" | |
| ], | |
| "endpoint_relevance": "Local administrator membership on each device shows whether this control works." | |
| }, | |
| { | |
| "id": "A.8.5", | |
| "framework": "ISO 27001:2022", | |
| "title": "Secure authentication", | |
| "summary": "Authentication methods and procedures resist guessing, brute force and misuse.", | |
| "auditor_looks_for": [ | |
| "Account lockout after repeated failures", | |
| "Strong password or multi-factor requirements" | |
| ], | |
| "endpoint_relevance": "Lockout, complexity and screen-unlock settings implement this on the device." | |
| }, | |
| { | |
| "id": "A.8.7", | |
| "framework": "ISO 27001:2022", | |
| "title": "Protection against malware", | |
| "summary": "Protect against malware with technical controls supported by user awareness.", | |
| "auditor_looks_for": [ | |
| "Anti-malware running with current signatures", | |
| "Protection that cannot easily be switched off" | |
| ], | |
| "endpoint_relevance": "Antivirus status, real-time scanning, tamper protection and signature age are checked on each device." | |
| }, | |
| { | |
| "id": "A.8.8", | |
| "framework": "ISO 27001:2022", | |
| "title": "Management of technical vulnerabilities", | |
| "summary": "Find technical weaknesses in time, judge the exposure and fix them.", | |
| "auditor_looks_for": [ | |
| "Timely patching", | |
| "Supported operating system versions" | |
| ], | |
| "endpoint_relevance": "Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed." | |
| }, | |
| { | |
| "id": "A.8.12", | |
| "framework": "ISO 27001:2022", | |
| "title": "Data leakage prevention", | |
| "summary": "Apply measures that stop sensitive information leaving through unauthorised channels.", | |
| "auditor_looks_for": [ | |
| "Controls on removable media and uploads", | |
| "Monitoring of data leaving the organisation" | |
| ], | |
| "endpoint_relevance": "USB storage write access is a common leakage channel." | |
| }, | |
| { | |
| "id": "A.8.13", | |
| "framework": "ISO 27001:2022", | |
| "title": "Information backup", | |
| "summary": "Keep backup copies of information and software and test that they can be restored.", | |
| "auditor_looks_for": [ | |
| "Backups configured and recent", | |
| "Recovery keys and restore procedures available" | |
| ], | |
| "endpoint_relevance": "Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware." | |
| }, | |
| { | |
| "id": "A.8.15", | |
| "framework": "ISO 27001:2022", | |
| "title": "Logging", | |
| "summary": "Produce, protect and review logs of activities, exceptions and security events.", | |
| "auditor_looks_for": [ | |
| "Logon and account changes recorded", | |
| "Logs kept long enough for investigation" | |
| ], | |
| "endpoint_relevance": "Without security event logs, a breach on the device cannot be reconstructed." | |
| }, | |
| { | |
| "id": "A.8.17", | |
| "framework": "ISO 27001:2022", | |
| "title": "Clock synchronization", | |
| "summary": "Synchronise system clocks to an approved time source.", | |
| "auditor_looks_for": [ | |
| "All devices using network time" | |
| ], | |
| "endpoint_relevance": "Correct timestamps are needed to correlate events across devices during an incident." | |
| }, | |
| { | |
| "id": "A.8.19", | |
| "framework": "ISO 27001:2022", | |
| "title": "Installation of software on operational systems", | |
| "summary": "Control which software users may install.", | |
| "auditor_looks_for": [ | |
| "An approved software list", | |
| "Restrictions on self-installed software" | |
| ], | |
| "endpoint_relevance": "Unapproved AI tools and remote access tools are signs this control is missing." | |
| }, | |
| { | |
| "id": "A.8.20", | |
| "framework": "ISO 27001:2022", | |
| "title": "Networks security", | |
| "summary": "Secure, manage and control networks and network devices to protect information.", | |
| "auditor_looks_for": [ | |
| "Host firewalls enabled", | |
| "Unsolicited inbound connections blocked" | |
| ], | |
| "endpoint_relevance": "The host firewall protects the laptop on untrusted networks such as hotels and cafés." | |
| }, | |
| { | |
| "id": "A.8.24", | |
| "framework": "ISO 27001:2022", | |
| "title": "Use of cryptography", | |
| "summary": "Define and apply rules for using cryptography, including key management.", | |
| "auditor_looks_for": [ | |
| "Full-disk encryption with strong algorithms", | |
| "Recovery keys stored safely" | |
| ], | |
| "endpoint_relevance": "Disk encryption protects data on lost or stolen devices." | |
| }, | |
| { | |
| "id": "Art. 5(1)(c)", | |
| "framework": "GDPR", | |
| "title": "Data minimisation", | |
| "summary": "Personal data must be adequate, relevant and limited to what is necessary for the purpose.", | |
| "auditor_looks_for": [ | |
| "Only necessary data collected or shared", | |
| "OS and app data sharing reduced to the minimum" | |
| ], | |
| "endpoint_relevance": "Optional diagnostic data and AI features that capture screen content collect more than needed." | |
| }, | |
| { | |
| "id": "Art. 5(1)(e)", | |
| "framework": "GDPR", | |
| "title": "Storage limitation", | |
| "summary": "Personal data must not be kept in identifiable form longer than necessary.", | |
| "auditor_looks_for": [ | |
| "Retention rules", | |
| "Old personal data deleted" | |
| ], | |
| "endpoint_relevance": "Copies of personal data left on laptops are often kept far longer than allowed." | |
| }, | |
| { | |
| "id": "Art. 5(1)(f)", | |
| "framework": "GDPR", | |
| "title": "Integrity and confidentiality", | |
| "summary": "Personal data must be protected against unauthorised access, loss and damage with appropriate measures.", | |
| "auditor_looks_for": [ | |
| "Technical security measures in place" | |
| ], | |
| "endpoint_relevance": "The endpoint security baseline is part of these measures." | |
| }, | |
| { | |
| "id": "Art. 25", | |
| "framework": "GDPR", | |
| "title": "Data protection by design and by default", | |
| "summary": "Build data protection into systems and use privacy-friendly settings by default.", | |
| "auditor_looks_for": [ | |
| "Privacy-protective default settings on devices and software" | |
| ], | |
| "endpoint_relevance": "Telemetry and AI data-collection features should be off unless needed." | |
| }, | |
| { | |
| "id": "Art. 28", | |
| "framework": "GDPR", | |
| "title": "Processor", | |
| "summary": "Use only processors that give sufficient guarantees, under a written contract with required terms.", | |
| "auditor_looks_for": [ | |
| "A data processing agreement with each processor" | |
| ], | |
| "endpoint_relevance": "Cloud AI tools used with work data are processors and need an agreement." | |
| }, | |
| { | |
| "id": "Art. 30", | |
| "framework": "GDPR", | |
| "title": "Records of processing activities", | |
| "summary": "Keep a written record of the processing activities you carry out.", | |
| "auditor_looks_for": [ | |
| "A current record of processing (RoPA)" | |
| ], | |
| "endpoint_relevance": "Processing done with endpoint tools, including AI tools, belongs in the record." | |
| }, | |
| { | |
| "id": "Art. 32(1)(a)", | |
| "framework": "GDPR", | |
| "title": "Security of processing: pseudonymisation and encryption", | |
| "summary": "Where appropriate, protect personal data with pseudonymisation and encryption.", | |
| "auditor_looks_for": [ | |
| "Encrypted devices and removable media" | |
| ], | |
| "endpoint_relevance": "Disk encryption is the standard measure for laptops holding personal data." | |
| }, | |
| { | |
| "id": "Art. 32(1)(b)", | |
| "framework": "GDPR", | |
| "title": "Security of processing: confidentiality, integrity, availability and resilience", | |
| "summary": "Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.", | |
| "auditor_looks_for": [ | |
| "Access control, malware protection, patching and network protection on devices" | |
| ], | |
| "endpoint_relevance": "Most endpoint baseline checks support this requirement." | |
| }, | |
| { | |
| "id": "Art. 32(1)(c)", | |
| "framework": "GDPR", | |
| "title": "Security of processing: restore availability and access after an incident", | |
| "summary": "Be able to restore access to personal data in time after a physical or technical incident.", | |
| "auditor_looks_for": [ | |
| "Working backups", | |
| "Recovery keys available" | |
| ], | |
| "endpoint_relevance": "Backups and disk-encryption recovery keys make restoration possible." | |
| }, | |
| { | |
| "id": "Art. 32(1)(d)", | |
| "framework": "GDPR", | |
| "title": "Security of processing: regular testing and evaluation", | |
| "summary": "Regularly test, assess and evaluate whether security measures work.", | |
| "auditor_looks_for": [ | |
| "Periodic audits such as this one", | |
| "Evidence that findings are followed up" | |
| ], | |
| "endpoint_relevance": "Weekly audits and logging provide this evidence." | |
| }, | |
| { | |
| "id": "Art. 33", | |
| "framework": "GDPR", | |
| "title": "Notification of a personal data breach to the supervisory authority", | |
| "summary": "Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.", | |
| "auditor_looks_for": [ | |
| "A breach procedure", | |
| "Logs and accurate time to establish what happened" | |
| ], | |
| "endpoint_relevance": "Security logs and time synchronisation make the 72-hour assessment possible." | |
| }, | |
| { | |
| "id": "Art. 34", | |
| "framework": "GDPR", | |
| "title": "Communication of a personal data breach to the data subject", | |
| "summary": "Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.", | |
| "auditor_looks_for": [ | |
| "Encryption that makes lost data unintelligible" | |
| ], | |
| "endpoint_relevance": "Encrypted devices and media can avoid the need to notify individuals." | |
| }, | |
| { | |
| "id": "Art. 35", | |
| "framework": "GDPR", | |
| "title": "Data protection impact assessment", | |
| "summary": "Assess the impact before processing that is likely to result in a high risk to people.", | |
| "auditor_looks_for": [ | |
| "DPIAs for high-risk processing" | |
| ], | |
| "endpoint_relevance": "New tools with high-risk processing, such as AI used on employees, may need a DPIA." | |
| }, | |
| { | |
| "id": "Art. 44", | |
| "framework": "GDPR", | |
| "title": "General principle for transfers", | |
| "summary": "Transfer personal data outside the EEA only under the conditions of Chapter V.", | |
| "auditor_looks_for": [ | |
| "A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services" | |
| ], | |
| "endpoint_relevance": "Cloud AI tools often process data outside the EEA." | |
| }, | |
| { | |
| "id": "Art. 4", | |
| "framework": "EU AI Act", | |
| "title": "AI literacy", | |
| "summary": "Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.", | |
| "auditor_looks_for": [ | |
| "AI training for staff who use AI tools" | |
| ], | |
| "endpoint_relevance": "AI tools found on endpoints show who needs AI literacy training." | |
| }, | |
| { | |
| "id": "Art. 5", | |
| "framework": "EU AI Act", | |
| "title": "Prohibited AI practices", | |
| "summary": "Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.", | |
| "auditor_looks_for": [ | |
| "No AI tools used for banned purposes" | |
| ], | |
| "endpoint_relevance": "The purpose of each detected AI tool must be checked against the banned list." | |
| }, | |
| { | |
| "id": "Art. 6", | |
| "framework": "EU AI Act", | |
| "title": "Classification rules for high-risk AI systems", | |
| "summary": "An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.", | |
| "auditor_looks_for": [ | |
| "A risk classification for each AI system in use" | |
| ], | |
| "endpoint_relevance": "Classification depends on what the tool is used for, not only on which tool it is." | |
| }, | |
| { | |
| "id": "Art. 14", | |
| "framework": "EU AI Act", | |
| "title": "Human oversight", | |
| "summary": "High-risk AI systems must be designed so that people can oversee them effectively.", | |
| "auditor_looks_for": [ | |
| "Named, trained people overseeing each high-risk AI system" | |
| ], | |
| "endpoint_relevance": "Applies only when a high-risk AI system is in use." | |
| }, | |
| { | |
| "id": "Art. 26", | |
| "framework": "EU AI Act", | |
| "title": "Obligations of deployers of high-risk AI systems", | |
| "summary": "Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.", | |
| "auditor_looks_for": [ | |
| "An AI register", | |
| "Use according to instructions", | |
| "Monitoring and log retention" | |
| ], | |
| "endpoint_relevance": "The AI software inventory is the starting point for these duties." | |
| }, | |
| { | |
| "id": "Art. 26(6)", | |
| "framework": "EU AI Act", | |
| "title": "Deployers: keep automatically generated logs for at least six months", | |
| "summary": "Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.", | |
| "auditor_looks_for": [ | |
| "Log retention of at least six months for high-risk AI systems" | |
| ], | |
| "endpoint_relevance": "Only applies if a detected AI tool is used in a high-risk way." | |
| }, | |
| { | |
| "id": "Art. 50", | |
| "framework": "EU AI Act", | |
| "title": "Transparency obligations for providers and deployers of certain AI systems", | |
| "summary": "People must be told when they interact with an AI system, and deepfakes and certain AI-generated text must be disclosed.", | |
| "auditor_looks_for": [ | |
| "Disclosure practices for chatbots and AI-generated content" | |
| ], | |
| "endpoint_relevance": "Staff publishing AI-generated content need clear rules." | |
| }, | |
| { | |
| "id": "Annex III", | |
| "framework": "EU AI Act", | |
| "title": "High-risk AI systems referred to in Article 6(2)", | |
| "summary": "Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.", | |
| "auditor_looks_for": [ | |
| "No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes" | |
| ], | |
| "endpoint_relevance": "A general AI assistant becomes high-risk if used, for example, to screen job applicants." | |
| }, | |
| { | |
| "id": "A.5.32", | |
| "framework": "ISO 27001:2022", | |
| "title": "Intellectual property rights", | |
| "summary": "Protect intellectual property rights and use only properly licensed software.", | |
| "auditor_looks_for": [ | |
| "A software licence register", | |
| "No pirated software, activation cracks or unlicensed copies on devices" | |
| ], | |
| "endpoint_relevance": "Torrent clients and activation cracks on a device point to unlicensed software and a weak software-installation control." | |
| } | |
| ] | |
| } | |