This document provides a reference set of generic information security controls including implementation guidance. This document is designed to be used by organizations:
a) within the context of an information security management system (ISMS) based on ISO/ IEC27001
b) for implementing information security controls based on internationally recognized best practices
c) for developing organization-specific information security management guidelines.