| Control ID | Applicable | Category | Control Name | Status | Justification |
|---|
| A.8.1 | Yes | A.8 Technological | User endpoint devices | Implemented | BYOD endpoint management — key control |
| A.8.13 | Yes | A.8 Technological | Information backup | Implemented | Information backup |
| A.8.20 | Yes | A.8 Technological | Networks security | Implemented | Network security |
| A.5.11 | Partial | A.5 Organisational | Return of assets | Implemented | BYOD environment — no physical asset return required. Selective Wipe removes corporate data only |
| A.8.19 | Partial | A.8 Technological | Installation of software on operational systems | In Progress | BYOD environment — cannot fully block software installation. Work apps managed via MAM |
| A.8.24 | Yes | A.8 Technological | Use of cryptography | Implemented | Use of cryptography |
| A.5.24 | Yes | A.5 Organisational | Information security incident management planning and preparation | Implemented | Security incident response planning |
| A.7.14 | Partial | A.7 Physical | Secure disposal or re-use of equipment | Implemented | Corporate data wipe required on BYOD device disposal |
| A.5.14 | Yes | A.5 Organisational | Information transfer | Implemented | SEC-POL-COM-001 §5 (public disclosure controls) + §7 (email-based information transfer controls). SEC-PROC-M365-001 §4 (Confidential External Sharing 5-step procedure). SEC-POL-M365-001 §3.3 (SPO external sharing restriction). |
| A.5.30 | Yes | A.5 Organisational | ICT readiness for business continuity | In Progress | ICT business continuity readiness |
| A.5.6 | Yes | A.5 Organisational | Contact with special interest groups | In Progress | Participation in security communities and threat intelligence groups |
| A.5.29 | Yes | A.5 Organisational | Information security during disruption | In Progress | Maintaining security during disruption |
| A.5.18 | Yes | A.5 Organisational | Access rights | Implemented | Access rights provisioning, review, and revocation |
| A.5.35 | Yes | A.5 Organisational | Independent review of information security | Not Started | Independent security review (internal/external audit) |
| A.7.4 | No | A.7 Physical | Physical security monitoring | Implemented | No physical facilities to monitor |
| A.5.19 | Yes | A.5 Organisational | Information security in supplier relationships | Implemented | Supplier and third-party security management |
| A.5.17 | Yes | A.5 Organisational | Authentication information | Implemented | Authentication information (password, MFA) management |
| A.5.26 | Yes | A.5 Organisational | Response to information security incidents | Implemented | Security incident response procedures |
| A.6.3 | Yes | A.6 People | Information security awareness, education and training | Implemented | Security awareness training |
| A.8.25 | Yes | A.8 Technological | Secure development life cycle | In Progress | Secure development lifecycle (TT/HVT development) |
| A.5.10 | Yes | A.5 Organisational | Acceptable use of information and other associated assets | Implemented | Acceptable use policy for information assets |
| A.7.11 | No | A.7 Physical | Supporting utilities | Implemented | No on-premises servers, UPS, or power facilities |
| A.5.31 | Yes | A.5 Organisational | Legal, statutory, regulatory and contractual requirements | In Progress | Identification of legal, regulatory, and contractual requirements |
| A.5.37 | Yes | A.5 Organisational | Documented operating procedures | In Progress | Documented operating procedures |
| A.7.6 | No | A.7 Physical | Working in secure areas | Implemented | No secure areas. 100% WFA environment |
| A.5.7 | Yes | A.5 Organisational | Threat intelligence | In Progress | Threat intelligence collection and analysis required |
| A.8.33 | Yes | A.8 Technological | Test information | In Progress | Test data protection |
| A.7.13 | Partial | A.7 Physical | Equipment maintenance | Implemented | BYOD device maintenance is user responsibility. Updatest weekly evidence as compensating control |
| A.8.27 | Yes | A.8 Technological | Secure system architecture and engineering principles | Implemented | Secure architecture principles |
| A.7.10 | Partial | A.7 Physical | Storage media | Implemented | Cloud-first, physical media minimised. Only CA100 Redkey USB applicable |
| A.8.9 | Yes | A.8 Technological | Configuration management | Implemented | Configuration management |
| A.5.22 | Yes | A.5 Organisational | Monitoring, review and change management of supplier services | In Progress | Monitoring of supplier service changes |
| A.6.1 | Yes | A.6 People | Screening | Implemented | Pre-employment background screening |
| A.5.5 | Yes | A.5 Organisational | Contact with authorities | In Progress | Contact framework with regulators and law enforcement required |
| A.6.8 | Yes | A.6 People | Information security event reporting | Implemented | Security event reporting framework |
| A.7.8 | No | A.7 Physical | Equipment siting and protection | Implemented | No company-owned equipment or server rooms. BYOD personal devices used |
| A.7.2 | No | A.7 Physical | Physical entry | Implemented | No office space. Physical entry controls not required |
| A.6.4 | Yes | A.6 People | Disciplinary process | Implemented | Disciplinary process for security violations |
| A.8.26 | Yes | A.8 Technological | Application security requirements | In Progress | Application security requirements |
| A.5.2 | Yes | A.5 Organisational | Information security roles and responsibilities | Implemented | Roles defined in L1 §4 Governance Structure: CEO, CISO, Security Director |
| A.8.7 | Yes | A.8 Technological | Protection against malware | Implemented | Malware protection |
| A.7.7 | Partial | A.7 Physical | Clear desk and clear screen | Implemented | Physical Clear Desk N/A. Clear Screen applies in remote work environment |
| A.8.31 | Yes | A.8 Technological | Separation of development, test and production environments | In Progress | Separation of development, test, and production environments |
| A.7.3 | No | A.7 Physical | Securing offices, rooms and facilities | Implemented | No offices or facilities |
| A.5.34 | Yes | A.5 Organisational | Privacy and protection of PII | In Progress | Privacy and PII protection (NZ/AU Privacy Act) |
| A.5.16 | Yes | A.5 Organisational | Identity management | Implemented | User identity lifecycle management |
| A.5.25 | Yes | A.5 Organisational | Assessment and decision on information security events | Implemented | Security event assessment and incident determination |
| A.5.20 | Yes | A.5 Organisational | Addressing information security within supplier agreements | In Progress | Security clauses required in supplier agreements |
| A.8.12 | Yes | A.8 Technological | Data leakage prevention | Implemented | Data leakage prevention |
| A.5.13 | Partial | A.5 Organisational | Labelling of information | Implemented | Purview labelling not used at SMB scale. Substituted with Teams channel structure |
| A.8.29 | Yes | A.8 Technological | Security testing in development and acceptance | In Progress | Security testing in development and acceptance |
| A.5.4 | Yes | A.5 Organisational | Management responsibilities | Implemented | Management responsibility for security policy compliance and resource allocation |
| A.6.6 | Yes | A.6 People | Confidentiality or non-disclosure agreements | Implemented | Confidentiality / non-disclosure agreements |
| A.7.9 | Yes | A.7 Physical | Security of assets off-premises | Implemented | All assets effectively off-premises (BYOD + WFA). Key control |
| A.7.1 | No | A.7 Physical | Physical security perimeters | Implemented | No office space or data centre. 100% WFA, Cloud-only environment |
| A.8.6 | Yes | A.8 Technological | Capacity management | Implemented | Capacity management (Cloud resources) |
| A.5.3 | Partial | A.5 Organisational | Segregation of duties | In Progress | Full segregation of duties difficult at 3–5 person SMB scale. Proportionate controls applied |
| A.8.3 | Yes | A.8 Technological | Information access restriction | Implemented | SEC-POL-M365-001 §5 (Teams team type model — 4 team types with channel guardrails). §6 CA 3-policy architecture (CA-Require-AllApps-CompliantOrAPP, CA-Restrict-SPO-Unmanaged, CA-Permit-Guest-MFA). Teams membership = SPO site permission scope. |
| A.8.34 | Yes | A.8 Technological | Protection of information systems during audit testing | In Progress | Protection of information systems during audit testing |
| A.5.28 | Yes | A.5 Organisational | Collection of evidence | Implemented | Security incident evidence collection procedures |
| A.8.8 | Yes | A.8 Technological | Management of technical vulnerabilities | Implemented | Technical vulnerability management |
| A.7.12 | No | A.7 Physical | Cabling security | Implemented | No network cabling facilities. Cloud/SaaS only |
| A.5.1 | Yes | A.5 Organisational | Policies for information security | Implemented | L1 Master Policy + L2 P1–P9 policy framework in operation. P8/P9 pages created, content drafting pending |
| A.5.32 | Yes | A.5 Organisational | Intellectual property rights | In Progress | Intellectual property protection |
| A.8.5 | Yes | A.8 Technological | Secure authentication | Implemented | Secure authentication mechanisms |
| A.5.12 | Yes | A.5 Organisational | Classification of information | Implemented | SEC-POL-M365-001 §3 (data classification: General / Confidential). §5.2-5.3 (Teams channel structure maps classification to access scope). SEC-POL-ADG-001 §3 (Data Context Isolation — Corporate vs Personal). SEC-POL-ASM-001 (Information Asset Classification). |
| A.6.5 | Yes | A.6 People | Responsibilities after termination or change of employment | Implemented | Security obligations after termination or role change |
| A.5.33 | Yes | A.5 Organisational | Protection of records | In Progress | Protection of records (legal/regulatory requirements) |
| A.6.7 | Yes | A.6 People | Remote working | Implemented | 100% WFA environment — key control. All work is remote |
| A.8.30 | Yes | A.8 Technological | Outsourced development | In Progress | Outsourced development security (TT and other external development) |
| A.7.5 | No | A.7 Physical | Protecting against physical and environmental threats | Implemented | No physical servers or facilities. Covered by Cloud SLA |
| A.5.23 | Yes | A.5 Organisational | Information security for use of cloud services | Implemented | 100% Cloud/SaaS infrastructure — key control |
| A.8.18 | Partial | A.8 Technological | Use of privileged utility programs | Implemented | Limited direct control in BYOD environment |
| A.6.2 | Yes | A.6 People | Terms and conditions of employment | Implemented | Security obligations included in terms of employment |
| A.5.15 | Yes | A.5 Organisational | Access control | Implemented | Access control policy required |
| A.8.4 | Yes | A.8 Technological | Access to source code | In Progress | Source code access control (TT/HVT development activities) |
| A.8.2 | Yes | A.8 Technological | Privileged access rights | Implemented | Privileged access rights management required |
| A.5.8 | Yes | A.5 Organisational | Information security in project management | In Progress | Integration of security requirements into project management |
| A.8.22 | Partial | A.8 Technological | Segregation of networks | Implemented | Physical network segregation N/A. Logical segregation via Zero Trust |
| A.5.27 | Yes | A.5 Organisational | Learning from information security incidents | Implemented | Post-incident lessons learned and improvement |
| A.8.28 | Yes | A.8 Technological | Secure coding | In Progress | Secure coding (TT/HVT development) |
| A.8.23 | Partial | A.8 Technological | Web filtering | In Progress | Limited direct web filtering in BYOD environment. Defender web protection used |
| A.8.32 | Yes | A.8 Technological | Change management | In Progress | Change management |
| A.8.14 | Partial | A.8 Technological | Redundancy of information processing facilities | Implemented | No on-premises facilities. Reliant on Cloud SLA |
| A.8.17 | Yes | A.8 Technological | Clock synchronization | Implemented | Clock synchronisation |
| A.5.21 | Yes | A.5 Organisational | Managing information security in the ICT supply chain | In Progress | ICT supply chain security management (high SaaS/Cloud dependency) |
| A.8.15 | Yes | A.8 Technological | Logging | Implemented | Logging and audit trails |
| A.5.36 | Yes | A.5 Organisational | Compliance with policies, rules and standards for information security | In Progress | Security policy compliance verification |
| A.5.9 | Yes | A.5 Organisational | Inventory of information and other associated assets | Implemented | Information asset identification and inventory management required |
| A.8.11 | Partial | A.8 Technological | Data masking | In Progress | Limited data masking scope at SMB scale |
| A.8.21 | Yes | A.8 Technological | Security of network services | Implemented | Network services security |
| A.8.16 | Yes | A.8 Technological | Monitoring activities | Implemented | Monitoring activities |
| A.8.10 | Yes | A.8 Technological | Information deletion | Implemented | Information deletion (retention expiry, termination, etc.) |