![Adoptech-logo-GreyWithoutStrapline-1.png]](https://knowledge.adoptech.co.uk/hs-fs/hubfs/Adoptech-logo-GreyWithoutStrapline-1.png?height=39&name=Adoptech-logo-GreyWithoutStrapline-1.png){kind=logo}
Frameworks & Certifications
Resources to help you understand certification requirements, timelines, and how Adoptech supports audits.
ISO 27001
- ISO/IEC 27001:2022 – An Overview
- Introducing ISO 27001 to staff
- Which ISO 27001 controls can I put out of scope if I do not have an office?
- What is the agenda for our ISO management review meeting?
- Communicating Information Security Objectives
- Leavers Confidentiality Reminder
- How do I log a Corrective Action?
- Clarifying Roles and Responsibilities
- What items should I add to the Communication Matrix in my Manual?
- What are good information security objectives?
- What Information Security KPIs should I set?
- ISO 27001: 2022 A.5.1 Policies for information security
- ISO 27001: 2022 A.5.2 Information security roles and responsibilities
- ISO 27001: 2022 A.5.3 Segregation of duties
- ISO 27001: 2022 A.5.4 Management responsibilities
- ISO 27001: 2022 A.5.5 Contact with authorities
- ISO 27001: 2022 A.5.6 Contact with special interest groups
- ISO 27001: 2022 A.5.7 Threat intelligence
- ISO 27001: 2022 A.5.8 Information security in project management
- ISO 27001: 2022 A.5.9 Inventory of information and other associated assets
- ISO 27001: 2022 A.5.10 Acceptable use of information and other associated asset
- ISO 27001: 2022 A.5.11 Return of assets
- ISO 27001: 2022 A.5.12 Classification of information
- ISO 27001: 2022 A.5.13 Labelling of information
- ISO 27001: 2022 A.5.14 Information transfer
- ISO 27001: 2022 A.5.15 Access control
- ISO 27001: 2022 A.5.16 Identity management
- ISO 27001: 2022 A.5.17 Authentication information
- ISO 27001: 2022 A.5.18 Access rights
- ISO 27001: 2022 A.5.19 Information security in supplier relationships
- ISO 27001: 2022 A.5.20 Addressing information security within supplier agreements
- ISO 27001: 2022 A.5.21 Managing information security in the ICT supply chain
- ISO 27001: 2022 A.5.22 Monitoring, review and change management of supplier services
- ISO 27001: 2022 A.5.23 Information security for use of cloud services
- ISO 27001: 2022 A.5.24 Information security incident management planning and preparation
- ISO 27001: 2022 A.5.25 Assessment and decision on information security events
- ISO 27001: 2022 A.5.26 Response to information security incidents
- ISO 27001: 2022 A.5.27 Learning from information security incidents
- ISO 27001: 2022 A.5.28 Collection of evidence
- ISO 27001: 2022 A.5.29 Information security during disruption
- ISO 27001: 2022 A.5.30 ICT readiness for business continuity
- ISO 27001: 2022 A.5.31 Legal, statutory, regulatory and contractual requirements
- ISO 27001: 2022 A.5.32 Intellectual property rights
- ISO 27001: 2022 A.5.33 Protection of records
- ISO 27001: 2022 A.5.34 Privacy and protection of PII
- ISO 27001: 2022 A.5.35 Independent review of information security
- ISO 27001: 2022 A.5.36 Compliance with policies, rules and standards for information security
- ISO 27001: 2022 A.5.37 Documented operating procedures
- ISO 27001: 2022 A.6.1 Screening
- ISO 27001: 2022 A.6.2 Terms and conditions of employment
- ISO 27001: 2022 A.6.3 Information security awareness, education and training
- ISO 27001: 2022 A.6.4 Disciplinary process
- ISO 27001: 2022 A.6.5 Responsibilities after termination or change of employment
- ISO 27001: 2022 A.6.6 Confidentiality or non-disclosure agreements
- ISO 27001: 2022 A.6.7 Remote working
- ISO 27001: 2022 A.6.8 Information security event reporting
- ISO 27001: 2022 A.7.1 Physical security perimeters
- ISO 27001: 2022 A.7.2 Physical entry
- ISO 27001: 2022 A.7.3 Securing offices, rooms and facilities
- ISO 27001: 2022 A.7.4 Physical security monitoring
- ISO 27001: 2022 A.7.5 Protecting against physical and environmental threats
- ISO 27001: 2022 A.7.6 Working in secure areas
- ISO 27001: 2022 A.7.7 Clear desk and clear screen
- ISO 27001: 2022 A.7.8 Equipment siting and protection
- ISO 27001: 2022 A.7.9 Security of assets off-premises
- ISO 27001: 2022 A.7.10 Storage media
- ISO 27001: 2022 A.7.11 Supporting utilities
- ISO 27001: 2022 A.7.12 Cabling security
- ISO 27001: 2022 A.7.13 Equipment maintenance
- ISO 27001: 2022 A.7.14 Secure disposal or re-use of equipment
- ISO 27001: 2022 A.8.1 User endpoint devices
- ISO 27001: 2022 A.8.2 Privileged access rights
- ISO 27001: 2022 A.8.3 Information access restriction
- ISO 27001: 2022 A.8.4 Access to source code
- ISO 27001: 2022 A.8.5 Secure authentication
- ISO 27001: 2022 A.8.6 Capacity management
- ISO 27001: 2022 A.8.7 Protection against malware
- ISO 27001: 2022 A.8.8 Management of technical vulnerabilities
- ISO 27001: 2022 A.8.9 Configuration management
- ISO 27001: 2022 A.8.10 Information deletion
- ISO 27001: 2022 A.8.11 Data masking
- ISO 27001: 2022 A.8.12 Data leakage prevention
- ISO 27001: 2022 A.8.13 Information backup
- ISO 27001: 2022 A.8.14 Redundancy of information processing facilities
- ISO 27001: 2022 A.8.15 Logging
- ISO 27001: 2022 A.8.16 Monitoring activities
- ISO 27001: 2022 A.8.17 Clock synchronization
- ISO 27001: 2022 A.8.18 Use of privileged utility programs
- ISO 27001: 2022 A.8.19 Installation of software on operational systems
- ISO 27001: 2022 A.8.20 Networks security
- ISO 27001: 2022 A.8.21 Security of network services
- ISO 27001: 2022 A.8.22 Segregation of networks
- ISO 27001: 2022 A.8.23 Web filtering
- ISO 27001: 2022 A.8.24 Use of cryptography
- ISO 27001: 2022 A.8.25 Secure development life cycle
- ISO 27001: 2022 A.8.26 Application security requirements
- ISO 27001: 2022 A.8.27 Secure system architecture and engineering principles
- ISO 27001: 2022 A.8.28 Secure coding
- ISO 27001: 2022 A.8.29 Security testing in development and acceptance
- ISO 27001: 2022 A.8.30 Outsourced development
- ISO 27001: 2022 A.8.31 Separation of development, test and production environments
- ISO 27001: 2022 A.8.32 Change management
- ISO 27001: 2022 A.8.33 Test information
- ISO 27001: 2022 A.8.34 Protection of information systems during audit testing
ISO 42001
- What are good Artificial Intelligence objectives?
- What AI KPIs should I set?
- What AI Records should I add to Appendix A in my Records and Information Management Policy?
- How to complete your AI Register
- ISO/IEC 42001 – AI Management System Requirements Explained
- ISO 42001: 2023 - A.2.2 AI Policy
- ISO 42001: 2023 - A.2.3 Alignment with Other Organisational Policies
- ISO 42001: 2023 - A.2.4 Review of the AI Policy
- ISO 42001: 2023 - A.3.2 AI Roles and Responsibilities
- ISO 42001: 2023 - A.3.3 Reporting of Concerns
- ISO 42001: 2023 - A.4.2 Resource Documentation
- ISO 42001: 2023 - A.4.3 Data Resources
- ISO 42001: 2023 - A.4.4 Tooling Resources
- ISO 42001: 2023 - A.4.5 System and Computing Resources
- ISO 42001: 2023 - A.4.6 Human Resources
- ISO 42001: 2023 - A.5.2 AI System Impact Assessment Process
- ISO 42001: 2023 - A.5.3 Documentation of AI System Impact Assessments
- ISO 42001: 2023 - A.5.4 Assessing AI System Impact on Individuals and Groups of Individuals
- ISO 42001: 2023 - A.5.5 Assessing Societal Impacts of AI Systems
- ISO 42001: 2023 - A.6.1.2 Objectives for Responsible Development of AI System
- ISO 42001: 2023 - A.6.1.3 Processes for Responsible AI System Design and Development
- ISO 42001: 2023 - A.6.2.2 AI System Requirements and Specification
- ISO 42001: 2023 - A.6.2.3 Data for Development and Testing of AI Systems
- ISO 42001: 2023 - A.6.2.4 AI System Design
- ISO 42001: 2023 - A.6.2.5 AI System Implementation
- ISO 42001: 2023 - A.6.2.6 AI System Verification and Validation
- ISO 42001: 2023 - A.6.2.7 AI System Deployment
- ISO 42001: 2023 - A.6.2.8 AI System Documentation
- ISO 42001: 2023 - A.7.2 Establishing Processes, Functions and Tools for AI Operation
- ISO 42001: 2023 - A.7.3 AI System Operational Procedures
- ISO 42001: 2023 - A.7.4 AI System Availability and Continuity
- ISO 42001: 2023 - A.7.5 AI System Monitoring
- ISO 42001: 2023 - A.7.6 AI System Change Management
- ISO 42001: 2023 - A.8.2 AI System Incident Management
- ISO 42001: 2023 - A.8.3 Documenting AI System Performance During Operation
- ISO 42001: 2023 - A.8.4 Feedback and Improvement
- ISO 42001: 2023 - A.8.5 AI System Decommissioning
- ISO 42001: 2023 - A.9.2 Processes for Responsible Use of AI Systems
- ISO 42001: 2023 - A.9.3 Objectives for Responsible Use of AI Systems
- ISO 42001: 2023 - A.9.4 Intended Use of AI Systems
- ISO 42001: 2023 - A.10.2 Allocating Responsibilities for AI Systems
- ISO 42001: 2023 - A.10.3 Supplier Requirements for AI Systems
- ISO 42001: 2023 - A.10.4 Customers and AI Systems
Cyber Essentials
CAF
- Cyber Assessment Framework (CAF) – UK Cyber Security & Resilience Requirements Explained
- CAF - A1.a Board direction
- CAF - A1.b Roles and Responsibilities
- CAF - A2.a Risk management process
- CAF - A2.b Understanding Threat
- CAF - A1.c Decision-making and approval
- CAF - A2.c Assurance
- CAF - A3.a Asset Management
- CAF - A4.a Supply Chain (third-party) risk management
- CAF - A4.b Secure Software Development and Support
- CAF - B1.a Policies, processes, and procedure development
- CAF - B1.b Policy, Process and Procedure Implementation
- CAF - B2.a Identity verification, authentication and authorisation
- CAF - B2.b Device Management
- CAF – B2.c Privileged User Management
- CAF – B2.d Identity and Access Management (IdAM)
- CAF – B3.a Understanding Data
- CAF – B3.b Data in Transit
- CAF – B3.d Mobile Data
- CAF – B3.c Stored Data
- CAF – B3.e Media / Equipment Sanitisation
- CAF – B4.a Secure by Design
- CAF – B4.b Secure Configuration
- CAF – B4.c Secure Management
- CAF – B4.d Vulnerability Management
- CAF – B5.a Resilience Preparation
- CAF – B5.b Design for Resilience
- CAF - B5.c Backups
- CAF - B6.a Culture
- CAF - B6.b Training
- CAF – C1.a Sources and Tools for Logging and Monitoring
- CAF – C1.b Securing Logs
- CAF – C1.c Generating Alerts
- CAF – C1.d Triage of Security Alerts
- CAF – C1.e Personnel Skills for Monitoring and Detection
- CAF – C1.f Interpreting User, System and Threat Intelligence
- CAF – C2.a Threat Hunting
- CAF – D1.a Response Plan
- CAF – D1.b Response and Recovery Capability
- CAF – D1.c Testing and Exercising
- CAF – D2.a Post-Incident Analysis
- CAF – D2.b Using Incidents to Drive Improvements