1. 10. Improvement
   1. 10.1 Nonconformity and corrective action
   2. 10.2 Continual improvement
2. 9. Performance Evaluation
   1. 9.1 Monitoring, measurement, analysis and evaluation
   2. 9.2 Internal audit
   3. 9.3 Management review
3. 8. Operation
   1. 8.1 Operational planning and control
   2. 8.2 Information security risk assessment
   3. 8.3 Information security risk treatment
4. 7. Support
   1. 7.1 Resources
   2. 7.2 Competence
   3. 7.3 Awareness
   4. 7.4 Communication
   5. 7.5 Documented information
      1. 7.5.1 General
      2. 7.5.2 Creating and updating
      3. 7.5.3 Control of documented information
5. 6. Planning
   1. 6.1 Actions to address risks and opportunities
      1. 6.1.1 General
      2. 6.1.2 Information security risk assessment
      3. 6.1.3 Information security risk treatment
      4. 6.1.4 Information security objectives and plans to achieve them
6. 5. Leadership
   1. 5.1 Leadership and commitment
   2. 5.2 Policy
   3. 5.3 Organizational roles, responsibilities and authorities
7. 4. Context of the organization
   1. 4.1 Understanding the organization and its context
   2. 4.2 Understanding the needs and expectations of interested parties
   3. 4.3 Determining the scope of the Information Security Management System
   4. 4.4 Information Security Management System
8. 3. The Plan-Do-Check-Act cycle
9. 2. Process approach impact
10. 1. Process and process approach
11. Annex A – Reference control objectives and controls
    1. A.5. Information security policies
       1. The controls in this section aim to provide direction and support to the ISMS by the implementation, communication, and controlled review of information security policies.
    2. A.6. Organization of information security
       1. The controls in this section aim to provide the basic framework for the implementation and operation of information security by defining its internal organization (e.g., roles, responsibilities, etc.), and through the consideration of organizational aspects of information security, like project management, use of mobile devices, and teleworking.
    3. A.7. Human resource security
       1. The controls in this section aim to ensure that those people who are under the organization’s control and can affect information security are fit for working and know their responsibilities, and that any changes in employment conditions will not affect information security.
    4. A.8. Asset management
       1. The controls in this section aim to ensure information security assets (e.g., information, processing devices, storage devices, etc.) are identified, that responsibilities for their security are designated, and that people know how to handle them according to predefined classification levels.
    5. A.9. Access control
       1. The controls in this section aim to limit access to information and information assets considering business needs, by means of formal processes to grant or revoke access rights. The controls consider either physical or logical access, as well as access made by people and by information systems.
    6. A.10. Cryptography
       1. The controls in this section aim to provide the basis for proper use of cryptographic solutions to protect the confidentiality, authenticity, and/or integrity of information.
    7. A.11. Physical and environmental security
       1. The controls in this section aim to prevent unauthorized access to physical areas, as well as to protect equipment and facilities that if compromised, by human or natural intervention, could affect information assets or business operations.
    8. A.12. Operations security
       1. The controls in this section aim to ensure that the operation of information processing facilities, including operating systems, are secure and protected against malware and data loss. Additionally, controls in this section require the means to record events and generate evidence, periodic verification of vulnerabilities, and the establishment of precautions to prevent audit activities from affecting operations.
    9. A.13. Communications security
       1. The controls in this section aim to protect the network infrastructure and services, as well as the information that travels on them.
    10. A.14. System acquisition, development and maintenance
        1. The controls in this section aim to ensure that information security is considered in the system development life cycle.
    11. A.15. Supplier relationships
        1. The controls in this section aim to ensure that outsourced activities performed by suppliers also consider information security controls, and that they are properly managed by the organization.
    12. A.16. Information security incident management
        1. The controls in this section aim to provide a framework to ensure the proper communication and handling of security events and incidents, so that they can be resolved in a timely manner an consider the preservation of evidence as required, as well as the improvement of processes to avoid recurrence.
    13. A.17. Information security aspects of business continuity management
        1. The controls in this section aim to ensure the continuity of information security management during adverse situations, as well as the availability of information systems.
    14. A.18. Compliance
        1. The controls in this section aim to provide a framework to prevent legal, statutory, regulatory, and contractual breaches, and to ensure independent confirmation that information security is implemented and is effective according to the defined policies, procedures, and requirements of the ISO 27001 standard.