Governance. Risk. Compliance. Cybersecurity.
MAST Consulting Group - Governance, Risk, Compliance and Cybersecurity Logo
Controls & Requirements

Controls & Requirements — ISO/IEC 27001

ISO/IEC 27001 requires a defined, evidenced and continuously monitored control set. MAST maintains a unified control catalogue that maps each requirement to your existing controls — eliminating duplication.

  • ISO/IEC 27001 Certified
  • ISO/IEC 27701 Certified
  • ISO 9001 Certified

Delivered by an ISO/IEC 27001, 27701 & 9001 certified organisation

Control domains

  • A.5 Organisational controls
  • A.6 People controls
  • A.7 Physical controls
  • A.8 Technological controls
  • Clauses 4–10: leadership, planning, support, operation, performance evaluation and improvement
ISO/IEC 27001 control coverage by domain

Horizontal bar chart titled "ISO/IEC 27001 control coverage by domain". Values: A.5 Organisational controls 70%, A.6 People controls 83%, A.7 Physical controls 96%, A.8 Technological controls 79%, Clauses 4–10 92%.

  • A.5 Organisational controls
    70%
  • A.6 People controls
    83%
  • A.7 Physical controls
    96%
  • A.8 Technological controls
    79%
  • Clauses 4–10
    92%

How we document each control

  • Statement of control and intent
  • Owner, executor and reviewer (RACI)
  • Frequency, trigger and operating window
  • Evidence type, location and retention
  • Linked risks and KRIs
  • Audit history and last test result
Control record fields

Checklist titled "Control record fields" with 6 items, every item marked complete: Statement of control and intent; Owner, executor and reviewer (RACI); Frequency, trigger and operating window; Evidence type, location and retention; Linked risks and KRIs; Audit history and last test result.

  • Statement of control and intent
  • Owner, executor and reviewer (RACI)
  • Frequency, trigger and operating window
  • Evidence type, location and retention
  • Linked risks and KRIs
  • Audit history and last test result

Mapping to adjacent frameworks

Our catalogue maps each control to ISO 27001, ISO 27701, SOC 2, NIST CSF, PCI DSS, CBUAE, SAMA, NCA ECC and ADHICS v2. One implementation, many audits.

Next: Implementation Roadmap