Implement ISO 27001 Security Controls

This skill covers ISO 27001 information security controls implementation, assessment, and management, grounded in ISO 27001:2022 and its Annex A controls, with practical ISMS (Information Security Management System) design and implementation experience. Control-category structure: organizational controls (A.5, 37 controls covering policies/procedures/organizational measures), people controls (A.6, 8 controls on HR security), physical controls (A.7, 14 controls for physical/environmental security), and technological controls (A.8, 34 controls covering technical security measures). Risk-based approach: controls are selected based on risk-assessment outcomes; a Statement of Applicability (SoA) documents the selection rationale; controls can be implemented, not applicable, or excluded with justification; and the cycle is one of continuous monitoring and improvement.

It provides a control-assessment template (objective, category, implementation status, current implementation across policies/procedures/technical measures/responsibilities, a gap analysis with missing elements/weaknesses/risk level, and an implementation plan with actions/resources/timeline/success metrics) and a Statement of Applicability table format (control ID, title, applicable yes/no, implementation status, justification).

Key control categories are illustrated with concrete configuration, including an Access Control (A.9) policy template:

### Access Control Policy Template
Access_Control_Policy:
  principle: "least_privilege"
  authentication:
    - multi_factor_required: true
    - password_policy:
        min_length: 12
        complexity: "high"
        rotation_days: 90
  authorization:
    - role_based: true
    - segregation_of_duties: true
    - regular_review_period: "quarterly"
  monitoring:
    - failed_attempts_threshold: 5
    - privileged_access_logging: true
    - session_timeout_minutes: 30

Also covered: a Cryptography (A.10) standards dict in Python (AES-256 at rest, TLS 1.3 in transit, 256-bit minimum key length, HSM-based key generation, dedicated key-vault storage, 12-month rotation, escrow required, and a prohibited-algorithms list of DES/3DES/MD5/SHA1/RC4) and Operations Security (A.12) bash automation for centralized rsyslog logging with a 365-day logrotate retention policy, plus a cron-scheduled weekly vulnerability scan.

Compliance monitoring is shown via a control-effectiveness-metrics JSON structure tracking named controls (A.8.2 privileged access MFA percentage, A.12.4 logging completeness, A.14.2 security testing coverage) against target/current/trend. Audit-evidence collection is organized per control (A.5.1 policy documents/distribution records/review docs/version history; A.8.8 vulnerability scan reports/patch logs/risk assessments/remediation tracking; A.12.1 documented procedures/training records/incident logs/change records).

Best practices cover control integration (map to business processes not just systems, assign clear control ownership, defense-in-depth with overlapping controls, regular testing schedules), documentation standards (consistent A.X.X referencing, evidence trails, version control, documented review cycles), and an implementation-priority order (foundation controls A.5.1/A.6.1/A.7.1, then access controls A.9.1-A.9.4, then technical controls A.13.1/A.8.1, then monitoring controls A.12.4/A.16.1). Common pitfalls: treating ISO 27001 as purely technical rather than business-integrated, over-implementing controls without risk-based justification, insufficient audit evidence, static implementation without continuous improvement, and inadequate staff training.

Use it when implementing, assessing, or documenting ISO 27001 Annex A controls - drafting a Statement of Applicability, writing control-assessment gap analyses, or building audit-evidence structure for a specific control. It is also useful early in a certification project for sequencing work: the priority order starts with foundation controls (policies, screening, physical perimeters) before moving to access, technical, and monitoring controls. It is not a general security-framework guide (NIST, SOC 2, CIS) - it is scoped specifically to the ISO 27001:2022 Annex A control set and ISMS practice.

Given a control ID or category, it produces a control-assessment document (implementation status, gap analysis, implementation plan), an SoA row, or the relevant configuration/automation template - access-control policy YAML, cryptography standards, or logging/vulnerability-scan automation - for that control.

Configuration examples span YAML (access-control policy), Python (cryptographic standards dict), Bash (rsyslog/logrotate/cron automation), and JSON (control-effectiveness metrics).

A CISO or ISMS manager building a Statement of Applicability and evidence trail ahead of a certification audit, and the GRC and compliance teams supporting that effort.