The digital world is changing rapidly. As a result, the requirements for handling information assets - and securing them - are also changing. Protecting sensitive data is more important today than ever before. Technology, in particular, is the focus of constant innovation. This is why Annex A of ISO 27001 contains a series of measures that have been specially developed for securing and handling technology and digital security in organisations.

ISO 27001 is an international standard for information security. It defines requirements for implementing, realising and maintaining an information security management system (ISMS) to protect the confidentiality, integrity and availability of information.

An information security management system certified by ISO 27001 is a globally recognised way of adequately protecting an organisation's information. An ISMS consists of a series of measures that help to ensure information security.

Technological controls are an important component of an ISMS. The measures in this category ensure that data is also adequately secured digitally and that access and networks are controlled.  

ISO 27001: New technological controls

Compared to its predecessor, ISO 27001:2022 includes new technological measures that respond to the current challenges of information security:

The new technological controls include:

• 8.1: Data masking
  
  
• 8.9: Configuration management
  
  
• 8.10: Information deletion
  
  
• 8.12: Data leakage prevention
  
  
• 8.16: Monitoring activities
  
  
• 8.23: Web filtering
  
  
• 8.28: Secure coding.

What technological controls are there?  

Technological controls are an important part of a comprehensive information security strategy, which focuses in particular on the appropriate security of technology, data, access and storage of information.

This area comprises 34 measures that you can implement. We have compiled a list with a comprehensive overview of all technological controls from Annex A of ISO 27001:

How are technological controls implemented? 

The implementation of technological controls should be based on a risk assessment. The organisation should identify the potential threats to its information and information systems from technological attacks and then implement the appropriate controls to mitigate these threats.

The process of implementing technological controls can be broken down into the following steps:

Risk identification

The first stage is to identify the potential threats to the organisation's information and information systems from technological attacks. The following factors can be considered:

External threats: Cyberattacks, malware, phishing

Internal threats: Employee error, fraud, espionage

Control selection

After the risk assessment, the organisation can select the appropriate controls within the risk treatment to mitigate the identified threats. It is important to weigh up the costs and benefits of the controls.

Control design

In the third phase, the design of the controls is determined. This includes the specification of the technical and organisational measures required to implement the controls.

Control implementation

In the fourth phase, the controls are implemented. This includes the procurement and installation of the necessary hardware and software as well as the training of employees.

Control monitoring

The controls must be monitored regularly to ensure that they function properly and achieve the desired results. This includes regular audits and tests of the controls.

Technological controls to strengthen your information security

Technological controls are measures that improve the security of information and information systems. They help to protect information and information systems against unauthorised access, manipulation, destruction and loss.

The 2022 version of ISO 27001 considers the current challenges of information security and offers ways to establish an appropriate approach to current conditions.

Find the right controls for your organisation and use our ISO 27001 checklist to find out what you need to do to comply with ISO 27001.