SUPPORT COMMUNITY SERVICES 1-877-292-8767 SEARCH SOLUTIONS PLATFORM COMPANY RESOURCES PARTNERS SEE A QUICK DEMO Varonis and ISO 27001 Learn how to use Varonis to streamline and automate ISO 27001 compliance. Introduction International Standards Organization (ISO) 27000 series is an internationally recognized framework for best practices in information security management. Developed and published by the International Organization for Standardization and the International Electrotechnical Commission, the primary pillar of the ISO 27000 series is ISO 27001 which outlines best practices, methodologies, and implementation of information security management in an organization. The hallmark focus of ISO 27001 is to protect the confidentiality, integrity and availability of an organization’s data. Most often, companies start by discovering and identifying potential security problems through an exercise such as a risk assessment, and then define what needs to be done to prevent and remediate existing problems. Ultimately, the core philosophy of ISO 27001 is based on managing risks: identify the risks and then systematically treat them. Varonis helps meet ISO 27001 standards and regulations as a fully integrated solution focused on protecting enterprise data wherever it lives: on-premises and in the cloud. A.6: Organization of Information Security DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. VARONIS EDGE Perimeter Telemetry Varonis Edge analyzes perimeter devices like DNS, VPN, and Web Proxy - applying blended context to activity and alerts in your core data stores. DATAPRIVILEGE Data Access Governance DataPrivilege gives business users the power to review and manage permissions, groups, and access certification, while automatically enforcing business rules. 6.1.1 Information security roles and responsibilities. Control. All information security responsibilities shall be defined & allocated. Varonis significantly reduces the risk of data loss and misuse by enabling organizations to manage access to data, empower data owners to grant and revoke access directly, and automatically repair and maintain file system permissions so that organizations are less vulnerable to internal and external threats, more compliant, and consistently following a least privilege model. 6.1.2 Segregation of duties. Control. Conflicting duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets. 6.1.4 Contact with special interest groups. Control. Appropriate contacts with special interest groups or other specialist security forums and professional associations shall be maintained. 6.2.1 Mobile device policy. Control. A policy and supporting security measures shall be adopted to manage the risks introduced by using mobile devices. 6.2.2 Teleworking. Control. A policy and supporting measures shall be implemented to protect information accessed, processed or stored at teleworking sites. A.7: Human Resource Security DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATAPRIVILEGE Data Access Governance DataPrivilege gives business users the power to review and manage permissions, groups, and access certification, while automatically enforcing business rules. 7.2.1 Management responsibilities. Control. Management shall require all employees and contractors to apply information security in accordance with the established policies and procedures of the organisation. Varonis DataPrivilege enables you to enforce a least privilege model across your primary data stores and establish a workflow for data owners to grant temporary access to employees and contractors. 7.2.3 Disciplinary process. Control. There shall be a formal and communicated disciplinary process in place to take action against employees who have committed an information security breach. 7.3.1 Termination or change of employment responsibilities. Control. Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, communicated to the employee or contractor and enforced. A.8: Asset Management DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. DATAPRIVILEGE Data Access Governance DataPrivilege gives business users the power to review and manage permissions, groups, and access certification, while automatically enforcing business rules. DATA CLASSIFICATION ENGINE Sensitive Content Discovery The Data Classification Engine discovers and identifies sensitive, regulated, & stale data with built-in patterns, predefined categories, customizable regexes and dictionaries. DATA TRANSPORT ENGINE Data Retention and Migration Data Transport Engine automatically finds, moves, archives, quarantines, or deletes data based on content type, age, access activity, and more. DATA CLASSIFICATION LABELS Automated Classification Tags Data Classification Labels automatically applies classification labels and encryption based on existing labelling policy and reports on mislabeled files. 8.1.1 Inventory of assets. Control. Assets associated with information and information processing facilities shall be identified and an inventory of these assets shall be drawn up and maintained. Varonis DatAdvantage maps and monitors your information storage and email systems, and updates the ACLs and file structures of your monitored resources daily to ensure the most current information about your data is available. 8.1.2 Ownership of assets. Control. Assets maintained in the inventory shall be owned. 8.1.3 Acceptable use of assets. Control. Rules for the acceptable use of information and of assets associated with information and information processing facilities shall be identified, documented and implemented. 8.2.1 Classification of information. Control. Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification. 8.2.2 Labeling of information. Control. An appropriate set of procedures for information labeling shall be developed and implemented in accordance with the information classification scheme adopted by the organization. 8.2.3 Handling of assets. Control. Procedures for handling assets shall be developed and implemented in accordance with the information classification scheme adopted by the organization. A.9: Access Control DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATAPRIVILEGE Data Access Governance DataPrivilege gives business users the power to review and manage permissions, groups, and access certification, while automatically enforcing business rules. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. AUTOMATION ENGINE Automated Remediation The Automation Engine discovers undetected security gaps and automatically repairs them: fixing hidden security vulnerabilities like inconsistent ACLs and global access to sensitive data. 9.1.1 Access control policy. Control. An access control policy shall be established, documented and reviewed based on business and information security requirements. Varonis DataPrivilege implements a workflow for your access control policy: users request access in the DataPrivilege console and data owners approve or deny requests in the console or by email. The workflow removes the strain of access management from the IT staff and puts it into the hands of the data owners, who can make better decisions on users access requests. 9.1.2 Access to networks and network services. Control. Users shall only be provided with access to the network and network services that they have been specifically authorized to use. 9.2.1 User registration and deregistration. Control. A formal user registration and de-registration process shall be implemented to enable assignment of access rights. 9.2.2 User access provisioning. Control. A formal user access provisioning process shall be implemented to assign or revoke access rights for all user types to all systems and services. 9.2.3 Management of privileged access rights. Control. The allocation and use of privileged access rights shall be restricted and controlled. 9.2.5 Review of user access rights. Control. Asset owners shall review users’ access rights at regular intervals. 9.2.6 Removal or adjustment of access rights. Control. The access rights of all employees and external party users to information and information processing facilities shall be removed upon termination of their employment, contract or agreement, or adjusted upon change. 9.4.1 Information access restriction. Control. Access to information and application system functions by users shall be restricted in accordance with the access control policy. 9.4.2 Secure Log-on procedures. Control. Where required by the access control policy, access to systems and applications shall be controlled by a secure log-on procedure. 9.4.4 Use of privileged utility programs. Control. The use of utility programs that might be capable of overriding system and application controls shall be restricted and tightly controlled. A.12: Operations Security DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. VARONIS EDGE Perimeter Telemetry Varonis Edge analyzes perimeter devices like DNS, VPN, and Web Proxy - applying blended context to activity and alerts in your core data stores. DATA TRANSPORT ENGINE Data Retention and Migration Data Transport Engine automatically finds, moves, archives, quarantines, or deletes data based on content type, age, access activity, and more. 12.1.2 Change management. Control. Changes to the organization, business processes, information processing facilities and systems that affect information security shall be controlled. Varonis DatAdvantage monitors data stores, email, and domain controllers for changes to configuration files or GPOs. DatAlert flags activity where these critical resources are changed for verification that the changes are within policy. 12.1.3 Capacity management. Control. The use of resources shall be monitored, tuned and projections made of future capacity requirements to ensure the required system performance. 12.2.1 Controls against malware. Control. Detection, prevention and recovery controls to protect against malware shall be implemented, combined with appropriate user awareness. 12.3.1 Information backup. Control. Backup copies of information, software and system images shall be taken and tested regularly in accordance with an agreed backup policy. 12.4.1 Event logging. Control. Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. 12.4.2 Protection of log information. Control. Logging facilities and log information shall be protected against tampering and unauthorized access. 12.4.3 Administrator and operator logs. Control. System administrator and system operator activities shall be logged and the logs protected and regularly reviewed. A.16: Information Security Incident Management DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. 16.1.1 Responsibilities and procedures. Control. Management of responsibilities and procedures shall be established to ensure a quick, effective and orderly response to information security incidents. Varonis provides both the initial alert and auditing data to investigate security incidents: visualize security threats with an intuitive dashboard, investigate security incidents - even track alerts and assign them to team members for closure. 16.1.2 Reporting information security events. Control. Information security events shall be reported through appropriate management channels as quickly as possible. 16.1.3 Reporting information security weaknesses. Control. Employees and contractors using the organization’s information systems and services shall be required to note and report any observed or suspected information security weaknesses in systems or services. 16.1.4 Assessment of and decision on information security events. Control. Information security events shall be assessed and it shall be decided if they are to be classified as information security incidents. 16.1.5 Response to information security incidents. Control. Information security incidents shall be responded to in accordance with the documented procedures. 16.1.6 Learning from information security incidents. Control. Knowledge gained from analyzing and resolving information security incidents shall be used to reduce the likelihood or impact of future incidents. 16.1.7 Collection of evidence. Control. The organization shall define and apply procedures for the identification, collection, acquisition and preservation of information, which can serve as evidence. A.17: Information Security Aspect of Business Continuity Management DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. 17.1.1 Planning information security continuity. Control. The organization shall determine its requirements for information security and the continuity of information security management in adverse situations, e.g. during a crisis or disaster. Varonis helps execute a layered security strategy, with a fully integrated solution focused on protecting enterprise data stored on-premises and in the cloud. Varonis enables organizations to detect and prevent security incidents, investigate unusual activity and user behavior, even roll back and restore changes to an earlier state. 17.1.2 Implementing information security continuity. Control. The organization shall establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during an adverse situation. 17.1.3 Verify, review and evaluate information security continuity. Control. The organization shall verify the established and implemented information security continuity controls at regular intervals in order to ensure that they are valid and effective during adverse situations. A.18: Compliance with Internal Requirements, such as Policies, and with External Requirements, such as Laws DATADVANTAGE Data Audit and Protection DatAdvantage maps who can (and who does) access data across file and email systems, shows where users have too much access, and safely automates changes to access control lists and groups. Visualize risk, lock down sensitive data, and get full visibility and control across your on-premises and cloud-based data stores on a unified platform. DATALERT Security Analytics DatAlert detects suspicious activity and prevents data breaches across platforms, visualizes risk, and prioritizes investigation. DATAPRIVILEGE Data Access Governance DataPrivilege gives business users the power to review and manage permissions, groups, and access certification, while automatically enforcing business rules. DATA TRANSPORT ENGINE Data Retention and Migration The Data Classification Engine discovers and identifies sensitive, regulated, & stale data with built-in patterns, predefined categories, customizable regexes and dictionaries. 18.1.1 Identification of applicable legislation and contractual requirements. Control. All relevant legislative statutory, regulatory, contractual requirements and the organization’s approach to meet these requirements shall be explicitly identified, documented and kept up to date for each information system and the organization. Varonis Data Classification Engine can help identify and classify applicable legislation and contractual requirements, based on keyword, pattern matching, category, and more. 18.1.2 Intellectual property rights. Control. Appropriate procedures shall be implemented to ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products. 18.1.3 Protection of records. Control. Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with legislatory, regulatory, contractual and business requirements. 18.1.4 Privacy and protection of personally identifiable information. Control. Privacy and protection of personally identifiable information shall be ensured as required in relevant legislation and regulation where applicable. 18.2.2 Compliance with security policies and standards. Control. Managers shall regularly review the compliance of information processing and procedures within their area of responsibility with the appropriate security policies, standards and any other security requirements. 18.2.3 Technical compliance review. Control. Information systems shall be regularly reviewed for compliance with the organization’s information security policies and standards. Interested in seeing Varonis in action? Request a demo or contact sales at 877-292-8767 REQUEST A DEMO VARONIS Français Deutsch 日本語 Pусский Español Português SOLUTIONS Data Protection Threat Detection & Response Compliance Data Classification Ransomware Insider Threats External Threats PLATFORM How It Works How to Buy How to Use It Real Results ROI Integrations COMPANY About Varonis Careers Customers Investor Relations Corporate Responsibility Brand Contact Us RESOURCES Free Security Training Get Varonis Certified Analyst Reports Whitepapers Guides Videos Events PARTNERS Technology Partners Channel Partners Partner Portal © 2021 Varonis | Policies | Certifications     This site uses cookies to provide you with a better browsing experience. Further information may be found in the Varonis Site Privacy Policy Accept