ISO/IEC 27001
Information security management systems - Requirements
Overview
Specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Provides a systematic approach to managing sensitive company information.
Applicability
Organizational security management and governance
Relevance to Cyber Resilience Act (CRA)
Foundation for organizational security practices supporting CRA compliance
Key Coverage Areas
Standard Sections & Chapters
Organizational controls
People controls
Physical controls
Technological controls
Policies for information security
Threat intelligence
Information security for use of cloud services
User endpoint devices
Privileged access rights
Information access restriction
Management of technical vulnerabilities
Related Cyber Resilience Act (CRA) Articles
Article 14: Reporting obligations of manufacturers
View Article →Information security policies and vulnerability management
Implementation Guidance:
Establish ISMS with policies for security and vulnerability management
Mapped Obligations:
- Report severe security incidents within 24 hours
- Submit incident notification within 72 hours with nature and impact assessment
- Provide final incident report within 1 month
- Inform affected users about vulnerabilities and incidents with mitigation guidance
Article 15: Voluntary reporting
View Article →Documentation of security policies and procedures
Implementation Guidance:
Maintain documented information for security management
Mapped Obligations:
- CSIRTs must inform manufacturers when others report actively exploited vulnerabilities or severe incidents about their products
Article 16: Establishment of a single reporting platform
View Article →Threat intelligence and vulnerability management
Implementation Guidance:
Integrate vulnerability management into overall security management system
Mapped Obligations:
- ENISA must establish and maintain a single reporting platform for vulnerability and incident notifications
- CSIRTs must notify market surveillance authorities of actively exploited vulnerabilities and severe incidents
- ENISA must implement security measures to protect the platform and notify any security incidents
Article 18: Authorised representatives
View Article →Incident reporting and information security event management
Implementation Guidance:
Implement incident detection, assessment, and reporting procedures
Mapped Obligations:
- Keep EU declaration of conformity and technical documentation available for at least 10 years after product launch or throughout support period (whichever is longer)
- Provide all necessary information and documentation to authorities when requested to prove product compliance
Article 21: Cases in which obligations of manufacturers apply to importers and distributors
View Article →Supplier relationships and supply chain security
Implementation Guidance:
Address security in supplier agreements and monitor supplier security
Article 24: Obligations of open-source software stewards
View Article →Risk assessment and organizational controls
Implementation Guidance:
Conduct risk assessments and implement appropriate security controls
Mapped Obligations:
- Further to a reasoned request from a market surveillance authority, open-source software stewards shall provide that authority, in a language which can be easily understood by that authority, with the documentation referred to in paragraph 1, in paper or electronic form
Quick Information
- Organization
- ISO/IEC
- Category
- Information Security Management
- Certification
- ✓ Available