| ISO/IEC 27001:2013 | ISO/IEC 27001:2005 | |||||||||||
| A.5 Security Policy | A.6 Organization | A.7 Asset Management | A.8 Human Resources | A.9 Physical | A.10 Communications | A.11 Access Control | A.12 Acquisition | A.13 Incident | A.14 Business Continuity | A.15 Compliance | ||
| A.5.1 | Management direction for information security | X | ||||||||||
| A.6.1 | Internal organization | X | X | X | ||||||||
| A.6.2 | Mobile devices and teleworking | X | ||||||||||
| A.7.1 | Prior to employment | X | ||||||||||
| A.7.2 | During employment | X | ||||||||||
| A.7.3 | Termination and change of employment | X | ||||||||||
| A.8.1 | Responsibility for assets | X | X | |||||||||
| A.8.2 | Information classification | X | X | |||||||||
| A.8.3 | Media handling | X | ||||||||||
| A.9.1 | Business requirements of access control | X | ||||||||||
| A.9.2 | User access management | X | X | |||||||||
| A.9.3 | User responsibilities | X | ||||||||||
| A.9.4 | System and application access control | X | X | |||||||||
| A.10.1 | Cryptographic controls | X | ||||||||||
| A.11.1 | Secure areas | X | ||||||||||
| A.11.2 | Equipment | X | X | |||||||||
| A.12.1 | Operational procedures and responsibilities | X | ||||||||||
| A.12.2 | Protection from malware | X | ||||||||||
| A.12.3 | Backup | X | ||||||||||
| A.12.4 | Logging and monitoring | X | ||||||||||
| A.12.5 | Control of operational software | X | ||||||||||
| A.12.6 | Technical vulnerability management | X | ||||||||||
| A.12.7 | Information systems audit considerations | X | ||||||||||
| A.13.1 | Network security management | X | X | |||||||||
| A.13.2 | Information transfer | X | X | |||||||||
| A.14.1 | Security requirements of information systems | X | X | |||||||||
| A.14.2 | Security in development and support processes | X | X | |||||||||
| A.14.3 | Test data | X | ||||||||||
| A.15.1 | Information security in supplier relationships | X | ||||||||||
| A.15.2 | Supplier service delivery management | X | ||||||||||
| A.16.1 | Management of information security incidents and improvements | X | ||||||||||
| A.17.1 | Information security continuity | X | ||||||||||
| A.17.2 | Redundancies | |||||||||||
| A.18.1 | Compliance with legal and contractual requirements | X | ||||||||||
| A.18.2 | Information security reviews | X | X | |||||||||