Organizational and People Controls (ISO/IEC 27002 Clauses 5 and 6)
Domain 3 covers the largest theme - 37 organizational controls in clause 5 - plus the 8 people controls in clause 6. Questions test which control addresses which situation and how organizational and people controls interlock with technological ones.
Organizational highlights
- A.5.1 policies for information security: one overarching policy plus topic-specific policies, reviewed at planned intervals.
- A.5.2 roles and responsibilities; A.5.3 segregation of duties.
- A.5.7 threat intelligence: collecting and analysing threat information relevant to the organization.
- A.5.9-5.13 asset inventory, acceptable use, return of assets, classification, labelling.
- A.5.15-5.18 access control, identity management, authentication information, access rights.
- A.5.19-5.23 supplier relationships, ICT supply chain, cloud services.
- A.5.24-5.28 incident management, including reporting, response and learning.
- A.5.29-5.30 continuity and ICT readiness.
- A.5.31-5.36 legal, regulatory and contractual compliance, independent review, compliance checking.
People highlights
A.6.1 screening, A.6.2 terms and conditions, A.6.3 awareness, education and training, A.6.4 disciplinary process, A.6.5 responsibilities after termination or change, A.6.6 confidentiality agreements, A.6.7 remote working, A.6.8 information security event reporting.
Worked example
A developer moves from the payments team to marketing analytics. Reasoning: this is a mover event, so A.5.18 requires access rights to be modified and legacy entitlements removed, A.6.5 addresses responsibilities and assets after a change of role, A.5.15 limits access on need-to-know, and A.6.6 obligations continue. Doing only a new-team induction leaves old access live - the classic finding.
Traps
Treating A.5.1 as a single document; confusing A.6.4 disciplinary process with incident response (A.5.24-5.28); reducing A.6.3 to annual e-learning; managing suppliers by contract alone rather than through A.5.22 monitoring and review; forgetting A.6.8 requires staff to report events, not just confirmed incidents.