1. What is ISO27001?
ISO 27001, the Information Security Management System (ISMS) standard developed by the International Organization for Standardization, provides a systematic framework for enterprises to establish, implement, maintain, and continuously improve their information security management systems.
This standard addresses three core objectives: confidentiality, integrity, and availability of information. Through risk assessment, risk management, internal audits, and management reviews, it helps organizations control information security risks and protect sensitive data from leaks, tampering, or destruction. It is applicable to organizations of all industries and sizes.

2. Core Control Domain List of ISO 27001:

The ISO 27001 Core Control Domain (comprising 4 major control categories and 39 control items)

(1) Organizational Information Security ◦ Covers information security policies, organizational roles and responsibilities, information security committees, outsourcing controls, and supply chain security, establishing a clear organizational-level information security governance framework.
(2) Human Resource Security ◦ Comprehensive risk management throughout the employee lifecycle, including background checks, safety awareness training, position-specific safety responsibilities, and revocation of access rights for departing personnel.
(3) Asset Management ◦ Requires establishing asset inventories, implementing information classification and grading, developing asset protection strategies, and standardizing equipment lifecycle management (procurement, operation, and decommissioning).
(4) Access Control◦ Covers user access permission management, account lifecycle management, principle of least privilege, multi-factor authentication, privileged account management, and access permission audit.
(5) Cryptography ◦ Standardize the selection of encryption algorithms, key management (including generation, storage, distribution, and destruction), and application scenarios of encryption technologies to ensure information confidentiality during transmission and storage.
(6) Physical and Environmental Security ◦ This includes data center site selection and construction, access control, security surveillance, physical protection of equipment, environmental monitoring (temperature/humidity, fire safety), and disaster recovery facility management.
(7) Operational Security ◦ Involves change management, vulnerability management, malicious code protection, backup and recovery, log management and auditing, system monitoring, and patch management.
(8) Communication security ◦ Covers network partitioning and isolation, network access control, remote access security, communication encryption, wireless network security, and email security.
(9) System acquisition, development, and maintenance ◦ It requires embedding security requirements throughout the entire development process, conducting security testing, establishing security baselines, and standardizing the management of third-party developers.
(10) Supplier Relations ◦ Includes supplier security assessment, contract security clauses, continuous supplier service management, and security incident response.
(11) Information Security Incident Management ◦ Define requirements for incident classification, reporting procedures, emergency response plans, post-incident review and improvement, as well as incident documentation and analysis.
(12) Business continuity management◦ Covers business impact analysis, risk assessment, business continuity planning, contingency drill and review, and disaster recovery strategy design.
(13) Compliance ◦ Includes compliance assessment with laws and regulations, adherence to industry standards, internal policy compliance, security audits, and intellectual property protection.