Implement the ISO/IEC
27001 information
security standard

This category caters to controls that do not fall under the other three categories of people, physical, and technological. It contains 37 controls.

Some of these are process and policy oriented (e.g., 5.1 Policies for information security, 5.4 Management responsibilities). Others are technology-linked controls or a mix of both (e.g., 5.7 Threat intelligence, 5.15 Access control, 5.34 Privacy and protection of PII).

Meet these controls with ManageEngine by:

• Detecting anomalies and security incidents in real time using AI- and ML-driven threat detection and easy integrations with third-party threat intelligence feeds.
• Enforcing least privilege access and securing, managing, and monitoring access to data, networks, devices, and other assets as needed.
• Discovering and maintaining an inventory of all software and hardware assets across the organization.
• Creating and maintaining an accurate inventory of your entire network.
• Discovering, labeling, and protecting sensitive data at rest, in use, and in transit.
• Ensuring compliance with IT-related regulatory requirements through regular reporting and enforcement of access, security, and other controls.
• Carrying out regular backups of network, directory, and endpoint data to ensure quick disaster recovery.

This category has eight controls focusing on ensuring the people who access organizational data have been thoroughly vetted and trained on the organization's information security practices and policies.

The controls are mostly process and policy oriented (e.g., 6.1 Screening, 6.4 Disciplinary process) with a few technological controls (e.g., 6.7 Remote working).

Meet these controls with ManageEngine by:

• Implementing solutions to enable, govern, and monitor secure remote access sessions for remote employees.
• Encrypt endpoints AES 256-bit encryption and run them on FIPS 140-2 compliant mode to ensure safe and secure remote operations.
• Enabling employees to report incidents via multiple channels using our unified service management suite and its integration with chat, email, and other solutions.
• Leveraging integrations with IT and collaboration tools to ensure omni-channel incident logging.
• Triaging and resolving all incidents using end-to-end workflow automations and AI assistance.

This category contains 14 controls related to securing the organization's physical environment.

These controls include best practices like clear desk policies and various physical and technological measures. The goal is to restrict and monitor access to areas and assets containing sensitive information and protect them against physical threats, including natural disasters.

Meet these controls with ManageEngine by:

• Classifying, managing, and monitoring storage devices and endpoints throughout their life cycle.
• Blocking or restricting usage of peripheral devices in accordance with your organization's information security policies.
• Ensuring all licensed software and corporate data is wiped from endpoints and storage devices before disposal using the UEMS site.

This category contains 34 controls focused on securing various technological elements of an organization.

These controls cover every aspect of an organization's IT infrastructure, including access management and authentication, endpoint management, data loss prevention, network monitoring, IT security, and more.

Meet these controls with ManageEngine by:

• Managing and securing user identities, privileges, and access to critical hardware and software resources.
• Monitoring, managing, and securing all organizational endpoints, including laptops, servers, smartphones, and rugged devices.
• Implementing proactive, real-time security with AI-powered threat hunting and anomaly detection using tools like Next-Gen Antivirus and UEBA.
• Ensuring 24/7 monitoring of the entire network stack, from storage to applications.
• Predicting future requirements for assets, licenses, and network capacity with predictive analytics.
• Detecting and securing sensitive information like PII and patents, endpoint data, and privileged credentials across the organization.
• Creating and implementing robust change management, incident management, and configuration management workflows.