What does the Gambling Commission Security Requirements Consultancy service include?
IT Governance will perform a gap analysis against the selected ISO 27001 controls and provide you with a detailed project plan enabling you to address the gaps. We will also guide you through the process of complying with the security requirements using a mentor and coach approach –all in a time-efficient and cost-effective manner.
As part of our service we will cover the following selected ISO 27001 controls as mandated by the Gambling Commission:
A.5 Information security policies
- Objective A.5.1 Information security policy
- Requirement A.5.1.1 Policies for information security
- Requirement A.5.1.2 Review of the information security policy
A.6 Organisation of information security
- Objective A.6.2 Mobile devices and teleworking
- Requirement A.6.2.1 Mobile device policy
- Requirement A.6.2.2 Teleworking
A.7 Human resources security
- Objective A.7.2 During employment
- Requirement A.7.2.2 Information security awareness, education and training
- Objective A.7.3 Termination or change of employment
- Requirement 7.3.1 Termination or change of employment responsibilities
A.8 Asset management
- Objective A.8.2 Information classification
- Requirement A.8.2.3 Handling of assets
- Objective A.8.3 Media Handling
- Requirement A.8.3.1 Management of removable media
- Requirement A.8.3.2 Disposal of media
A.9 Access control
- Objective A.9.1 Business requirements of access control
- Requirement A.9.1.1 Access control policy
- Requirement A.9.1.2 Access to network and network services
- Objective A.9.2 User access management
- Requirement A.9.2.1 User registration and de-registration
- Requirement A.9.2.2 User access provisioning
- Requirement A.9.2.3 Management of privileged access rights
- Requirement A.9.2.4 Management of secret authentication information of users
- Requirement A.9.2.5 Review of user access rights
- Requirement A.9.2.6 Removal or adjustment of access rights
- Objective A.9.3 User responsibilities
- Requirement A.9.3.1 Use of secret authentication information
- Objective A.9.4 System and application access control
- Requirement 9.4.1 Information access restriction
- Requirement A.9.4.2 Secure log-on procedure
- Requirement A.9.4.3 Password management system
- Requirement A 9.4.4 Use of privileged utility programs
A.10 Cryptography
- Objective A.10.1 Cryptographic controls
- Requirement A.10.1.1 Policy on use of cryptographic controls
- Requirement A.10.1.2 Key management
A.11 Physical and environmental security
- Objective A 11.2 Equipment
- Requirement A.11.2.1 Equipment siting and protection
- Requirement A.11.2.7 Secure disposal or re-use of equipment
- Requirement A.11.2.8 Unattended user equipment
A.12 Operations security
- Objective A.12.1 Operational procedures and responsibilities
- Requirement A.12.1.4 Separation of development, testing and operational environments.
- Objective A.12.2 Protection from malware
- Requirement A.12.2.1 Controls against malware
- Objective A.12.3 Protect against loss of data
- Requirement A.12.3.1 Information backup
- Objective A.12.4 Logging and monitoring
- Requirement A.12.4.1 Event logging
- Requirement A.12.4.2 Protection of log information
- Requirement A.12.4.3 Administrator and operator logs
- Requirement A.12.4.4 Clock synchronisation
A.13 Communications security
- Objective A.13.1 Network security management
- Requirement A.13.1.1 Network controls
- Requirement A.13.1.2 Security of network services
- Requirement A.13.1.3 Segregation in networks
A.14 System acquisition, development and maintenance
- Objective A.14.1 Security requirements of information systems
- Requirement A.14.1.2 Securing application services on public networks
- Requirement A.14.1.3 Protecting application service transactions
A.15 Supplier relationships
- Objective A.15.1 Information security in supplier relationships
- Requirement A.15.1.1 Information security policy for supplier relationships
- Requirement A.15.1.2 Addressing security within supplier agreements
- Requirement A.15.1.3 Information and communication technology supply chain
- Objective A.15.2 Supplier service delivery management
- Requirement A.15.2.1 Monitoring and review of supplier services
- Requirement A 15.2.2 Managing changes to supplier services
A.18 Compliance
- Objective A.18.2 Information security review
- Requirement A.18.2.1 Independent review of security policy
