Annex A.8 Technological Controls: What an Auditor Tests
A.8 is the second largest theme, 34 controls covering endpoints, access, cryptography, logging, networks, development and change. Lead auditors approach it with unease, because the subject matter is technical and they are not. The unease is misplaced: the audit asks whether the organisation does what it determined it needed to do, which needs no knowledge of how it works.
A.8 is the second largest theme, 34 controls covering endpoints, access, cryptography, logging, networks, development and change. Lead auditors approach it with unease, because the subject matter is technical and they are not. The unease is misplaced: the audit asks whether the organisation does what it determined it needed to do, which needs no knowledge of how it works.
The organisation in the worked finding on this page is invented, and so is the finding.
The ISO 27001 Annex A.8 auditing problem, and the way out of it
Thirty-four technical controls, an auditee who works with them daily, and an auditor who does not. The instinct is either to avoid the theme with a few general questions, or to overreach and start assessing the technology. Both produce weak audits, and the second produces arguments you cannot win.
The way out is to remember what the criteria are. They are ISO/IEC 27001, the organisation’s own requirements for its ISMS, and its legal and contractual obligations. They are not your view of good technical practice. So the questions that work are not is this configuration sound? but:
What did you determine was needed here, and where is that written down?
Show me it operating on something specific and current.
Who checks, how often, and what happened the last time they did?
Those three questions work on any of the 34 controls, and none of them requires you to evaluate the technology. They require the auditee to demonstrate it — which is their job, not yours.
Remember where the control came from. Annex A is a reference set, and a control is on the audit’s agenda because the organisation selected it at Clause 6.1.3 and recorded that in the Statement of Applicability. What that document claims is the first thing to test. On a technical control that is the difference between an audit and an inspection: you are testing a claim the organisation made about itself, not the state of its estate.
And the two layers stay apart here as everywhere. A mechanism that is not working is an A.8 finding; a Statement of Applicability that says it is working when it is not is a Clause 6.1.3 d) one.
The six clusters inside ISO 27001 Annex A.8
| Cluster | Controls | The trail |
|---|---|---|
| Endpoints and access | 8.1 to 8.5 | Endpoint arrangements, privileged access, access restriction, source code access, authentication |
| Operations and resilience | 8.6, 8.7, 8.13, 8.14, 8.19 | Capacity, malware protection, backup, redundancy, what may be installed on operational systems |
| Data handling | 8.10, 8.11, 8.12, 8.33 | Deletion, masking, leakage prevention, test information |
| Vulnerability, configuration and change | 8.8, 8.9, 8.18, 8.32 | Technical vulnerabilities, configuration baselines, privileged utility programs, change management |
| Logging, monitoring, networks and cryptography | 8.15 to 8.17, 8.20 to 8.24 | Logging, monitoring, clock synchronisation, network security and services, segregation, web filtering, cryptography |
| Development, and audit testing | 8.25 to 8.31, 8.34 | Secure development lifecycle, requirements, architecture, coding, testing, outsourced development, environment separation, and protection of systems during audit testing |
ISO 27001 Annex A.8 endpoints and access: 8.1 to 8.5
A.8.1 covers user endpoint devices: information stored on, processed by or accessible via them is to be protected. It is the natural home for anything about laptops, phones and personally owned devices, and it is sometimes marked not applicable with a justification that does not survive a question about laptops.
A.8.2 restricts and manages the allocation and use of privileged access rights. A.8.3 restricts access to information and other associated assets in accordance with the established topic-specific policy on access control. A.8.4 governs who may read and who may alter source code, along with the development tools and software libraries around it. A.8.5 requires secure authentication technologies and procedures based on the information access restrictions and the topic-specific policy on access control.
The whole cluster is the technical enforcement of what A.5.15 to A.5.18 set out in policy, and findings can belong on either side. If the rule is wrong or absent, it is A.5. If the rule is right and the technology does not enforce it, it is A.8.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
ISO 27001 Annex A.8 operations and resilience
A.8.6 requires the use of resources to be monitored and adjusted in line with current and expected capacity requirements. A.8.7 requires protection against malware, supported by appropriate user awareness. A.8.13 requires backup copies of information, software and systems to be maintained and regularly tested in accordance with the agreed topic-specific policy on backup. A.8.14 requires information processing facilities to be implemented with redundancy sufficient to meet availability requirements. A.8.19 governs the installation of software on operational systems.
Two of these reward attention because they are so seldom asked about. A.8.14 redundancy is usually assumed rather than evidenced — ask what availability requirement the redundancy was built to meet, and whether anyone has confirmed it does. And A.8.19 is the control that asks who can put software on a production system and by what procedure; the answer is often more people than the organisation expects.
ISO 27001 Annex A.8 data handling: 8.10, 8.11, 8.12 and 8.33
A.8.10 requires information stored in information systems, devices or in any other storage media to be deleted when no longer required. A.8.11 requires data masking to be used in accordance with the topic-specific policy on access control and other related policies, and business requirements, taking applicable legislation into consideration. A.8.12 requires data leakage prevention measures to be applied to systems, networks and any other devices that process, store or transmit sensitive information. A.8.33 covers how information used for testing is chosen, protected and managed.
Three of the four were added by the 2022 revision, which means most organisations built their arrangements for them after certification rather than before it. That is worth knowing when you read a Statement of Applicability: a line marked implemented on a control that did not exist when the ISMS was designed has a shorter history behind it than the rest of the document.
ISO 27001 Annex A.8 vulnerability, configuration and change
A.8.8 requires information about technical vulnerabilities of information systems in use to be obtained, the organisation’s exposure to be evaluated, and appropriate measures taken. A.8.9, added by the 2022 revision, requires configurations — including security configurations — of hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. A.8.18 restricts and tightly controls the use of privileged utility programs capable of overriding system and application controls. A.8.32 requires changes to information processing facilities and information systems to be subject to change management procedures.
Read each of those four to the end, because they chain their verbs. A.8.8 asks for information about vulnerabilities to be obtained, exposure to be evaluated, and measures to be taken; A.8.9 asks for configurations to be established, documented, implemented, monitored and reviewed. A control with five verbs in it can be four-fifths performed, and a finding has to name the verb that failed.
Want structured preparation?One year of LMS access and HD recordings come with the course.
ISO 27001 Annex A.8 logging, monitoring, networks and cryptography
A.8.15 requires logs that record activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. A.8.16, added by the 2022 revision, requires networks, systems and applications to be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents. A.8.17, whose title ISO gives as Clock synchronization, requires the clocks of information processing systems used by the organisation to be synchronised to approved time sources.
A.8.17 is the quietest control in the annex and the one that undermines the most evidence. Logs from systems whose clocks disagree cannot be correlated, which means an incident cannot be reconstructed and A.8.15’s requirement that logs be analysed becomes difficult to satisfy in practice. It is rarely tested and almost never a headline finding, which is exactly why it is worth an auditor’s question.
Then the network group. A.8.20 covers the network and its devices, secured and managed so that the information in systems and applications is protected. A.8.21 covers network services: their security mechanisms, service levels and service requirements, identified, implemented and monitored. A.8.22 requires groups of information services, users and information systems to be segregated in the organisation’s networks. A.8.23 requires access to external websites to be managed. And A.8.24 asks for rules on the effective use of cryptography, including cryptographic key management.
A.8.21 is the neglected one here. Ask which network services the organisation obtains from a provider, what security mechanisms and service levels it identified for each, and what it does to monitor them. Organisations that can produce a contract for the service can rarely produce the identification, and almost never the monitoring.
A worked ISO 27001 finding on Annex A.8.17
Tarrant Analytics operates a logging platform that collects from all production systems, with alerting configured and reviewed daily by a named team.
| Statement | The clocks of four of eleven production systems examined are not synchronised to the approved time sources. |
|---|---|
| Objective evidence | The logging standard requires all systems in scope to synchronise to two named internal time servers, which in turn synchronise to a named external source, and requires the configuration to be verified at each quarterly platform review. Of eleven production systems examined with the platform engineer, seven synchronise to the named internal servers. Two application servers are configured against a public time source not named in the standard. Two database hosts have no time synchronisation configured, and their timestamps were observed during the audit to differ from the internal servers by more than four minutes in one case and by more than eleven in the other. The engineer confirmed that the two database hosts were rebuilt during the period and that time configuration is not part of the build standard used. |
| Requirement | ISO/IEC 27001 Annex A.8.17 requires the clocks of information processing systems used by the organisation to be synchronised to approved time sources. The organisation’s logging standard, section 3, names the two internal time servers as its approved sources and requires all systems in scope to synchronise to them. |
| Grade | Minor — the control operates for seven of the eleven systems examined, and the mechanism, the approved sources and the standard all exist, so what the evidence shows is a lapse in a working arrangement rather than the absence of one. A wider sample showing the same proportion across the whole estate would change the grade. |
A second finding was available on the same visit, and is deliberately not bundled into this one. The logging standard also requires the time configuration to be verified at each quarterly platform review, and the four review records for the period contain no such item. That is a failure of the organisation’s own checking rather than of synchronisation. It would be answered by a different person with a different corrective action, and the requirement it belongs to is A.5.36, compliance with the organisation’s own policies, rules and standards, rather than A.8.17. Two requirements, two findings, and the second is the more serious of the pair — a check that never ran in any quarter of the period says something about the organisation’s assurance that four hosts out of time does not.
Two further things to take from the finding beyond the grade.
The first is where the criteria came from. Nothing in it rests on a view about how far apart clocks may drift. The requirement cited is the control; the specific target is the organisation’s own standard, which named the sources and the verification. Without that standard the finding would be much weaker, and an auditor who supplied a tolerance from their own experience would have invented a requirement.
The second is the connection the evidence opens without asserting it. Four hosts out of time affects what can be done with their logs, which touches A.8.15’s requirement that logs be analysed. The finding does not claim that. It records what was found. If you want a finding on log analysis, go and get evidence about log analysis, because the auditee will ask you for it.
One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; do not write your own diagnosis of why it happened. Causes are the organisation’s to establish under Clause 10.2, and supplying one hands the auditee something to argue about instead of something to answer. The platform engineer’s account that time configuration is missing from the build standard is recorded because it establishes reach — it tells the reader that any host rebuilt since will be in the same position. It stops there.
Not sure about the course yet?One year of free retraining on the same exam version is included.
ISO 27001 Annex A.8 development, and the control everyone forgets
Eight controls. A.8.25 rules for the secure development of software and systems, established and applied. A.8.26 information security requirements identified, specified and approved when developing or acquiring applications. A.8.27 principles for engineering secure systems, established, documented, maintained and applied. A.8.28 secure coding principles applied to software development. A.8.29 security testing processes defined and implemented in the development life cycle. A.8.30 the organisation to direct, monitor and review the activities related to outsourced system development. A.8.31 development, test and production environments separated and secured.
And A.8.34, protection of information systems during audit testing, which is frequently omitted from a Statement of Applicability altogether and is the one control in the annex that governs the auditor’s own activity. Its subject is the assurance activity itself, and what has to happen before an assurance test touches a live system. It exists because audit activity can disturb production, and its absence from a Statement of Applicability is worth a question even where nothing has gone wrong.
A.8.30 is the other one to press where it applies. Outsourced development is common and rarely evidenced: ask what the organisation directs, what it monitors, and what it has reviewed — three verbs, and organisations that can answer the first often cannot answer the other two.
Major or minor in ISO 27001 Annex A.8
Major territory: a control the Statement of Applicability marks implemented with no mechanism behind it at all; a rule the organisation set that the technology does not enforce anywhere; an activity performed but never acted on across the whole period.
Minor territory: a mechanism operating with traceable exceptions; a review late in one cycle of several; a build standard missing a step that is otherwise applied.
Escalation: several technical controls failing in the same way — configured once, never verified since — is a case about verification, and often belongs at A.5.36 or in Clause 9 rather than as a run of A.8 minors.
A last word on what this page is not. Thirty-four controls is not thirty-four demonstrations. An auditor who asks to see each of them in turn will spend a day watching screens and will have tested nothing, because there will be no time to ask who checks. Choose a handful on risk and on what the Statement of Applicability claims, and take each all the way to the person who is supposed to be watching it.
ISO 27001 Annex A.8: which controls sit in each cluster?
Pick a cluster to see its controls and the audit trail to follow.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the table in this article. A.8 has 34 controls; the six clusters are a teaching convention, not the standard's own structure.
Frequently asked questions about ISO 27001 Annex A.8
How many controls are in ISO 27001 Annex A.8?
34, the second largest theme after A.5’s 37. A.6 has 8 and A.7 has 14, making 93 in total.
Which ISO 27001 Annex A.8 controls are new in the 2022 revision?
Seven: A.8.9 configuration management, A.8.10 information deletion, A.8.11 data masking, A.8.12 data leakage prevention, A.8.16 monitoring activities, A.8.23 web filtering and A.8.28 secure coding. That is more than any other theme, and it accounts for seven of the eleven new controls; the other four are A.5.7, A.5.23, A.5.30 and A.7.4.
Do I need technical expertise to audit ISO 27001 Annex A.8?
No, and treating it as a technical assessment is a common error. The criteria are the standard and the organisation’s own requirements, so the questions are what the organisation determined, whether it can demonstrate the arrangement operating, and who checks. Demonstrating the technology is the auditee’s job.
When is a weakness an Annex A.5 finding rather than an A.8 one in ISO 27001?
If the rule itself is wrong, missing or never decided, it belongs in the A.5 access and policy controls. If the rule is sound and the technology does not enforce it, it belongs in A.8. The same evidence sometimes supports both, and they answer to different people.
What is Annex A.8.34 and why does it matter to an ISO 27001 auditor?
It governs assurance activity that assesses operational systems, which makes it the one control in the annex constraining the auditor as much as the auditee. It matters because it is frequently omitted from a Statement of Applicability with no justification, and because an auditor proposing to touch a live system is the person most likely to engage it.
The other three ISO 27001 Annex A themes
the A.5 organizational controls
For the requirements behind these controls, the clause map for lead auditors sets out Clauses 4 to 10 with the failure that belongs at each sub-clause, and which record evidences which clause matches each one to the record that evidences it.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply