What are ISO 27001 information security controls?
ISO 27001 is the leading global standard for information security management. While achieving compliance can be complex, NordPass is designed to support your efforts by enhancing data security.
Key organizational and technological information security controls in ISO 27001
Disclaimer: The following controls represent a selected subset of the ISO 27001 requirements that NordPass can assist businesses in meeting. For the complete list of controls, please refer to the official standard.
Segregation of duties
Separate conflicting duties and responsibilities to reduce risks. Ensure no single individual has excessive control, enhancing accountability and operational security.
Inventory of assets
Develop and maintain a comprehensive inventory of information assets. Assign ownership and ensure clear accountability for managing and protecting each asset.
Return of assets
Establish procedures to recover all organizational assets, including digital credentials, when an employee leaves or changes roles, ensuring no unauthorized access remains.
Access control
Define and implement rules for physical and logical access to sensitive information based on security requirements, ensuring only authorized personnel have access.
Authentication information
Manage and allocate authentication credentials securely, ensuring they meet complexity standards, are stored safely, and are only accessible to authorized users.
Access rights
Regularly provision, review, modify, and revoke access rights according to policies. Ensure users only access the information required for their roles.
Collection of evidence
Create procedures to collect, preserve, and secure evidence related to information security incidents for investigation and compliance purposes.
Information access restriction
Limit access to sensitive systems and data according to business needs and access policies, ensuring only authorized individuals can view or edit information.
Secure authentication
Implement secure authentication procedures, such as multi-factor authentication (MFA), to verify human and non-human users before granting access to ICT resources.
Protection against malware
Implement measures and user training to detect and prevent malware threats. Ensure secure access and minimize the risk of phishing or malicious attacks.
Data leakage prevention
Apply controls to prevent unauthorized data transfers or disclosure. Protect sensitive information across systems, networks, and devices.
Monitoring activities
Continuously monitor systems, networks, and applications for anomalies. Evaluate potential incidents and take appropriate action to address security risks.
How NordPass helps adhere to ISO 27001 requirements
NordPass offers a variety of advanced features to help businesses meet and maintain some of the requirements set out by ISO 27001.
In NordPass, you can define roles like Owner, Admin, and User to help align with the principle of segregation of duties. This ensures distinct privileges to support secure and compliant management, thereby reducing risk.
Quickly review, assign, or revoke access rights using NordPass’ intuitive Admin Panel. IT admins can easily segment users into groups based on department, project, or job role, ensuring employees only receive credentials relevant to their specific responsibilities.
NordPass is a trusted choice for organizations prioritizing security and compliance. With ISO/IEC 27001:2022 certification, SOC 2 Type 2 audit, and an independent audit by Cure53, NordPass Business demonstrates an in-depth understanding of the compliance journey.
Teams
Efficient data protection for small teams
10 users pack only
Feature includedSecure password generation
Feature includedSafe password sharing
Feature includedOffline credential access
Feature includedUser activity monitoring
Feature includedSecurity settings applied to all users
Feature includedMFA protection
Feature includedSSO login with Google Workspace
Business
Secure company password management
5 users minimum
Everything from Teams, plus:
Feature includedGroup-based credential sharing
Feature includedCredential sharing by folder
Feature includedPassword strength monitoring
Feature includedData breach monitoring
Feature includedCompliance integration with Vanta
Enterprise
Advanced support and provisioning
5 users minimum
Everything from Business, plus:
Feature includedCentralized control and tracking of shared credentials
Feature includedSSO log in with Entra ID, MS ADFS, and Okta
Feature includedAutomatic user access management via Entra ID and Okta
Feature includedIntegrations with Microsoft Sentinel and Splunk®
Payments are charged in USD.
Discount terms and conditions apply. Displayed prices do not include VAT.
Frequently asked questions
Disclaimer. This content is provided for informational purposes only and should not be considered as legal or other professional advice. It is intended to offer general guidance on ISO/IEC 27001:2022 Information Security Controls and potential support solutions but does not cover the full scope of the law or specific legal circumstances. While every effort is made to ensure that the information is accurate and up-to-date, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, or suitability of the content, products, services, or related graphics for any purpose. Reliance on this information is strictly at your own risk. Our solutions are designed to support compliance with cybersecurity regulations; however, their effectiveness depends on various factors, including specific circumstances, evolving regulations, and technological advancements. For advice tailored to your particular situation and the use of our solutions to assist with ISO/IEC 27001:2022 compliance, consult a qualified legal or cybersecurity professional. In no event will we be liable for any loss or damage, including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this article. This article does not establish a client-professional relationship between Nord Security Inc. and the reader.