This page lists the different clauses, sections and control objectives which are present in the IS0 27001:2005 standard.

Clause	Section	Control Objective/Control
Security Policy	5.1	Information Security Policy
	5.1.1	Information Security Policy Document
	5.1.2	Review of Information Security Policy
Organization of Information security	6.1	Internal Organization
	6.1.1	Management Commitment to information security
	6.1.2	Information security Co-ordination
	6.1.3	Allocation of information security Responsibilities
	6.1.4	Authorization process for Information Processing facilities
	6.1.5	Confidentiality agreements
	6.1.6	Contact with authorities
	6.1.7	Contact with special interest groups
	6.1.8	Independent review of information security
	6.2	External Parties
	6.2.1	Identification of risk related to external parties
	6.2.2	Addressing security when dealing with customers
	6.2.3	Addressing security in third party agreements
Asset Management	7.1	Responsibility for Assets
	7.1.1	Inventory of assets
	7.1.2	Ownership of Assets
	7.1.3	Acceptable use of assets
	7.2	Information classification
	7.2.1	Classification Guidelines
	7.2.2	Information Labeling and Handling
Human Resource Security	8.1	Prior to Employment
	8.1.1	Roles and Responsibilities
	8.1.2	Screening
	8.1.3	Terms and conditions of employment
	8.2	During Employment
	8.2.1	Management Responsibility
	8.2.2	Information security awareness, education and training
	8.2.3	Disciplinary process
	8.3	Termination or change of employment
	8.3.1	Termination responsibility
	8.3.2	Return of assets
	8.3.3	Removal of access rights
Physical and Environmental Security	9.1	Secure Areas
	9.1.1	Physical security Perimeter
	9.1.2	Physical entry controls
	9.1.3	Securing offices, rooms and facilities
	9.1.4	Protecting against external and environmental threats
	9.1.5	Working in secure areas
	9.1.6	Public access, delivery and loading areas
	9.2	Equipment security
	9.2.1	Equipment sitting and protection
	9.2.2	Support utilities
	9.2.3	Cabling security
	9.2.4	Equipment Maintenance
	9.2.5	Security of equipment off-premises
	9.2.6	Secure disposal or reuse of equipment
	9.2.7	Removal of Property
Communications and Operations Management	10.1	Operational Procedures and responsibilities
	10.1.1	Documented operating Procedures
	10.1.2	Change Management
	10.1.3	Segregation of Duties
	10.1.4	Separation of development and Operations facilities
	10.2	Third Party Service Delivery Management
	10.2.1	Service Delivery
	10.2.2	Monitoring and review of third party services
	10.2.3	Manage changes to the third party services
	10.3	System Planning and Acceptance
	10.3.1	Capacity management
	10.3.2	System acceptance
	10.4	Protection against Malicious and Mobile Code
	10.4.1	Controls against malicious code
	10.4.2	Controls against Mobile code
	10.5	Back-Up
	10.5.1	Information Backup
	10.6	Network Security Management
	10.6.1	Network controls
	10.6.2	Security of Network services
	10.7	Media Handling
	10.7.1	Management of removable media
	10.7.2	Disposal of Media
	10.7.3	Information handling procedures
	10.7.4	Security of system documentation
	10.8	Exchange of Information
	10.8.1	Information exchange policies and procedures
	10.8.2	Exchange agreements
	10.8.3	Physical media in transit
	10.8.4	Electronic Messaging
	10.8.5	Business Information systems
	10.9	Electronic Commerce Services
	10.9.1	Electronic Commerce
	10.9.2	On-Line transactions
	10.9.3	Publicly available information
	10.10	Monitoring
	10.10.1	Audit logging
	10.10.2	Monitoring system use
	10.10.3	Protection of log information
	10.10.4	Administrator and operator logs
	10.10.5	Fault logging
	10.10.6	Clock synchronization
Access control	11.1	Business Requirement for Access Control
	11.1.1	Access control Policy
	11.2	User Access Management
	11.2.1	User Registration
	11.2.2	Privilege Measurement
	11.2.3	User password management
	11.2.4	Review of user access rights
	11.3	User Responsibilities
	11.3.1	Password Use
	11.3.2	Unattended user equipment
	11.3.3	Clear Desk and Clear Screen Policy
	11.4	Network Access control
	11.4.1	Policy on use of network services
	11.4.2	User authentication for external connections
	11.4.3	Equipment identification in networks
	11.4.4	Remote diagnostic and configuration port protection
	11.4.5	Segregation in networks
	11.4.6	Network connection control
	11.4.7	Network Routing control
	11.5	Operating System Access Control
	11.5.1	Secure Log-on procedures
	11.5.2	User identification and authentication
	11.5.3	Password Management system
	11.5.4	Use of system utilities
	11.5.5	Session Time-out
	11.5.6	Limitation of connection time
	11.6	Application access control
	11.6.1	Information access restriction
	11.6.2	Sensitive system isolation
	11.7	Mobile Computing and Teleworking
	11.7.1	Mobile computing and communication
	11.7.2	Teleworking
Information Systems Acquisition Development and Maintenance	12.1	Security Requirements of Information Systems
	12.1.1	Security requirement analysis and specifications
	12.2	Correct Processing in Applications
	12.2.1	Input data validation
	12.2.2	Control of internal processing
	12.2.3	Message integrity
	12.2.4	Output data validation
	12.3	Cryptographic controls
	12.3.1	Policy on the use of cryptographic controls
	12.3.2	Key Management
	12.4	Security of System Files
	12.4.1	Control of Operational software
	12.4.2	Protection of system test data
	12.4.3	Access control to program source library
	12.5	Security in Development & Support Processes
	12.5.1	Change Control Procedures
	12.5.2	Technical review of applications after Operating system changes
	12.5.3	Restrictions on changes to software packages
	12.5.4	Information Leakage
	12.5.5	Outsourced Software Development
	12.6	Technical Vulnerability Management
	12.6.1	Control of technical vulnerabilities
Information Security Incident Management	13.1	Reporting Information Security Events and Weaknesses
	13.1.1	Reporting Information security events
	13.1.2	Reporting security weaknesses
	13.2	Management of Information Security Incidents and Improvements
	13.2.1	Responsibilities and Procedures
	13.2.2	Learning for Information security incidents
	13.2.3	Collection of evidence
Business Continuity Management	14.1	Information Security Aspects of Business Continuity Management
	14.1.1	Including Information Security in Business continuity management process
	14.1.2	Business continuity and Risk Assessment
	14.1.3	developing and implementing continuity plans including information security
	14.1.4	Business continuity planning framework
	14.1.5	Testing, maintaining and re-assessing business continuity plans
Compliance	15.1	Compliance with Legal Requirements
	15.1.1	Identification of applicable legislations
	15.1.2	Intellectual Property Rights ( IPR)
	15.1.3	Protection of organizational records
	15.1.4	Data Protection and privacy of personal information
	15.1.5	Prevention of misuse of information processing facilities
	15.1.6	Regulation of cryptographic controls
	15.2	Compliance with Security Policies and Standards and Technical compliance
	15.2.1	Compliance with security policy
	15.2.2	Technical compliance checking
	15.3	Information System Audit Considerations
	15.3.1	Information System Audit controls
	15.3.2	Protection of information system audit tools