The ISO 27001 security management standard compliance pack provides recommended compliance checks that are based on the security management standards in Annex A of ISO/IEC 27001:2013. The checks detect and govern cloud resource risks so that your organization can implement, maintain, and continuously improve its information security management.
How to read the rule tables
The following sections list the default rules of the ISO 27001 security management standard compliance pack. Each section covers one Annex A clause. A rule appears in the section of the lowest-numbered Annex A control that it maps to, and rules are sorted by control number within each section.
Each rule table contains the following columns:
Rule name — Links to the rule creation page in the Cloud Config console, with the corresponding managed rule preselected.
Rule description — States the condition under which a resource is evaluated as Compliant, and the resources that the rule applies to.
Annex A controls — Lists the Annex A control numbers that the rule provides evidence for. A rule can map to controls outside the clause of the section that it appears in. For the name of each control, see the Annex A control names table in this topic.
Note the following before you use the tables as compliance evidence:
Evaluation results — Cloud Config evaluates each resource as Compliant or Non-compliant. A resource that is outside the scope of a rule is evaluated as Not Applicable.
Mapping relationship — A rule can map to several Annex A controls, and one Annex A control can be covered by several rules.
Parameters — Some rules evaluate resources against parameters that you specify when you create the rule. In the rule descriptions, these parameters appear as wording such as "the specified value", "the specified number of days", or "the specified time ranges". When a rule has a default parameter value, the rule description states it.
Note
A rule evaluation result is technical evidence for the Annex A controls that the rule maps to. A Compliant result for a single rule does not by itself prove that a control is fully implemented.
Annex A control names
The following table lists the names of the Annex A controls that are referenced in the rule tables. The control numbers and names are defined in Annex A of ISO/IEC 27001:2013.
| Annex A control | Control name |
| A.6.1.2 | Segregation of duties |
| A.8.1.1 | Inventory of assets |
| A.8.1.2 | Ownership of assets |
| A.9.1.1 | Access control policy |
| A.9.1.2 | Access to networks and network services |
| A.9.2.1 | User registration and de-registration |
| A.9.2.2 | User access provisioning |
| A.9.2.3 | Management of privileged access rights |
| A.9.4.1 | Information access restriction |
| A.9.4.4 | Use of privileged utility programs |
| A.9.4.5 | Access control to program source code |
| A.10.1.1 | Policy on the use of cryptographic controls |
| A.10.1.2 | Key management |
| A.12.1.2 | Change management |
| A.12.1.3 | Capacity management |
| A.12.2.1 | Controls against malware |
| A.12.3.1 | Information backup |
| A.12.4.1 | Event logging |
| A.12.4.2 | Protection of log information |
| A.12.4.3 | Administrator and operator logs |
| A.12.5.1 | Installation of software on operational systems |
| A.12.6.1 | Management of technical vulnerabilities |
| A.13.1.1 | Network controls |
| A.13.1.3 | Segregation in networks |
| A.13.2.1 | Information transfer policies and procedures |
| A.13.2.3 | Electronic messaging |
| A.14.1.1 | Information security requirements analysis and specification |
| A.14.1.2 | Securing application services on public networks |
| A.14.2.1 | Secure development policy |
| A.14.2.3 | Technical review of applications after operating platform changes |
| A.16.1.1 | Responsibilities and procedures |
| A.16.1.2 | Reporting information security events |
| A.16.1.7 | Collection of evidence |
| A.17.1.2 | Implementing information security continuity |
| A.17.2.1 | Availability of information processing facilities |
| A.18.1.3 | Protection of records |
| A.18.1.4 | Privacy and protection of personally identifiable information |
| A.18.1.5 | Regulation of cryptographic controls |
Rules mapped to A.6 controls
The following rules provide evidence for the A.6 controls of Annex A, starting with A.6.1.2 Segregation of duties.
| Rule name | Rule description | Annex A controls |
| Separate personnel and programmatic access for RAM users | A Resource Access Management (RAM) user is compliant if console access and API call access are not enabled simultaneously. | A.6.1.2 |
| Do not grant permissions directly to RAM users | A RAM user is compliant if no access policies are directly attached. Permissions should be inherited from a RAM user group or RAM role. | A.6.1.2 |
| No idle RAM user groups exist | A RAM user group is compliant if it contains at least one RAM user and has at least one RAM access policy attached. | A.6.1.2, A.9.1.1, A.9.2.1, A.9.2.2, A.9.2.3 |
| RAM user groups are not empty | A RAM user group is compliant if it contains at least one RAM user. | A.6.1.2, A.9.1.1, A.9.2.1, A.9.2.2, A.9.2.3 |
| No super administrators exist | A resource is compliant if no RAM users, RAM user groups, or RAM roles have super administrator permissions, where Resource is * and Action is *. | A.6.1.2, A.9.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.4.1, A.9.4.5, A.18.1.3 |
| No idle RAM access policies exist | A RAM access policy is compliant if it is attached to at least one RAM user group, RAM role, or RAM user. | A.6.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.4.5 |
| Do not grant permissions directly to RAM users | A RAM user is compliant if no access policies are directly attached. Permissions should be inherited from a RAM user group or RAM role. | A.6.1.2, A.9.1.1 |
Rules mapped to A.8 controls
The following rules provide evidence for the A.8 controls of Annex A, which cover asset inventory and asset ownership.
| Rule name | Rule description | Annex A controls |
| Security Center protection is enabled for running ECS instances | An ECS instance is compliant if the Security Center agent is installed to provide host security protection. This rule applies only to instances in the Running state. | A.8.1.1, A.8.1.2, A.12.1.2, A.12.5.1, A.12.6.1, A.14.1.1, A.14.2.1, A.16.1.2 |
| All specified tags exist | A resource is compliant if it has all the specified tags. You can define up to 10 tag groups, and you must enter only one value for each group. Tag input is case-sensitive. | A.8.1.1, A.8.1.2 |
| The resource group of an ECS associated resource is inherited from the ECS instance | This rule checks whether a resource associated with an ECS instance inherits the resource group of the instance. The resource is compliant if it is attached to an ECS instance and they share the same resource group. This rule applies only to resources that are attached to an ECS instance. | A.8.1.1, A.8.1.2 |
| The resource group associated with a resource is not the default resource group | A resource is compliant if its associated resource group is not the default resource group. This rule applies only to resources that are associated with a resource group. | A.8.1.1, A.8.1.2 |
Rules mapped to A.9 controls
The following rules provide evidence for the A.9 controls of Annex A, which cover access control policies, network access, and privileged access management.
| Rule name | Rule description | Annex A controls |
| The Alibaba Cloud account does not have an AccessKey | An Alibaba Cloud account is compliant if it does not have an AccessKey in any state. | A.9.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, A.18.1.3 |
| Public network access is disabled for Elasticsearch instances | An Elasticsearch instance is compliant if public network access is disabled. | A.9.1.2, A.9.4.1, A.9.4.4, A.13.1.1, A.13.1.3, A.18.1.3, A.18.1.4 |
| Public-read-write is disabled for the ACL of the OSS bucket | An OSS bucket is compliant if its access control list (ACL) policy prohibits public-read-write access. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Public network access is disabled for the Function Compute service | A Function Compute service is compliant if public network access is disabled. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Running ECS instances are in a VPC | We recommend that you deploy ECS instances in a virtual private cloud (VPC). An ECS instance is compliant if it is in a VPC. If parameters are specified, the rule also checks whether the VPC of the instance is within the specified range. This rule applies only to instances in the Running state. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Public network access is disabled for ADB clusters | An ADB cluster is compliant if public network access is disabled. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Public endpoints are not configured for RDS instances | An RDS instance is compliant if no public endpoint is configured. Configuring Direct Internet Access for RDS instances in a production environment makes them vulnerable to cyberattacks. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Public endpoints are not configured for ACK clusters | An ACK cluster is compliant if no public endpoint is configured. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Enforced mode is used to access ECS instance metadata | An ECS instance is compliant if enforced mode is used to access its instance metadata. | A.9.1.2, A.9.4.4 |
| The Function Compute service is configured to allow calls only from specified VPCs | A Function Compute service is compliant if it is configured to allow calls only from specified VPCs. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Public-read is disabled for the ACL of the OSS bucket | An OSS bucket is compliant if its ACL policy prohibits public-read access. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Running ECS instances are not associated with public IP addresses | A running ECS instance is compliant if it is not directly associated with an IPv4 public IP address or an Elastic IP Address. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| Public network access is disabled for all endpoints of a PolarDB cluster | A PolarDB cluster is compliant if public network access is disabled for all its endpoints. | A.9.1.2, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.1, A.13.2.3, A.18.1.3, A.18.1.4 |
| MFA is enabled for the Alibaba Cloud account | An Alibaba Cloud account is compliant if multi-factor authentication (MFA) is enabled. | A.9.2.1, A.9.2.2, A.9.2.3 |
| MFA is enabled for RAM users | A RAM user with console access enabled is compliant if MFA is enabled in the logon settings. | A.9.2.1, A.9.2.2, A.9.2.3 |
| Automatic rotation is configured for credentials in KMS | A credential in Key Management Service (KMS) is compliant if automatic rotation is configured. This rule does not apply to generic secrets. | A.9.2.1, A.9.2.2, A.9.2.3, A.18.1.5 |
| KMS credentials are rotated successfully | A KMS credential is compliant if automatic rotation is enabled and the credential has been successfully rotated within the configured rotation period. This rule does not apply to generic secrets, because you cannot directly configure periodic rotation for them in KMS. | A.9.2.1, A.9.2.2, A.9.2.3, A.18.1.5 |
| The password policy for RAM users meets requirements | A password policy is compliant if all its configurations meet the specified parameter values. | A.9.2.1, A.9.2.2, A.9.2.3 |
| The AccessKeys of RAM users are rotated within the specified period | An AccessKey of a RAM user is compliant if its age does not exceed the specified number of days. Default value: 90 days. | A.9.2.1, A.9.2.2, A.9.2.3 |
| Full log tracking is enabled for ActionTrail | A trail in ActionTrail is compliant if it is enabled and tracks all regions and all event types. For a member account in a resource directory, the account is compliant if the administrator of the resource directory has created a trail that applies to all member accounts. | A.9.2.1, A.9.2.2, A.9.2.3, A.12.4.1, A.12.4.2, A.12.4.3, A.14.1.1, A.14.2.3, A.16.1.2, A.16.1.7 |
Rules mapped to A.10 controls
The following rules provide evidence for the A.10 controls of Annex A, which cover cryptographic controls and key management.
| Rule name | Rule description | Annex A controls |
| TDE is enabled for RDS instances | An RDS instance is compliant if transparent data encryption (TDE) is enabled in the data security settings. This rule does not apply to instance types or versions that do not support TDE. | A.10.1.1 |
| Secure access is configured in the access policy of the OSS bucket | An OSS bucket is compliant if its access policy requires HTTPS for read and write operations, or denies access over HTTP. This rule does not apply to OSS buckets with empty access policies. | A.10.1.1, A.13.2.1, A.14.1.2 |
| Server-side encryption is enabled for the OSS bucket | An OSS bucket is compliant if server-side encryption with fully managed OSS keys is enabled. | A.10.1.1, A.12.4.3, A.16.1.7 |
| The certificate used by SLB is issued by Alibaba Cloud | An SLB instance is compliant if the certificate it uses is issued by Alibaba Cloud. | A.10.1.1, A.13.2.1, A.14.1.2 |
| Encryption is configured for the NAS file system | A NAS file system is compliant if encryption is configured. | A.10.1.1 |
| Encryption is enabled for ECS data disks | An ECS data disk is compliant if encryption is enabled. | A.10.1.1 |
| Disk encryption is enabled for data nodes of the Elasticsearch instance | An Elasticsearch instance is compliant if disk encryption is enabled for its data nodes. | A.10.1.1 |
| TDE is enabled for the PolarDB cluster | A PolarDB cluster is compliant if TDE is enabled. | A.10.1.1 |
| Encryption is configured for all data tables in the Tablestore instance | A Tablestore instance is compliant if encryption is configured for all its data tables. | A.10.1.1 |
| Encryption is enabled for the MaxCompute project | A MaxCompute project is compliant if encryption is enabled. This rule does not apply to projects that are frozen. | A.10.1.1 |
| Automatic rotation is configured for master keys in KMS | A customer master key (CMK) in KMS is compliant if automatic rotation is configured. This rule does not apply to service keys or keys from Bring Your Own Key (BYOK). | A.10.1.2, A.18.1.5 |
| KMS master keys are not pending deletion | A KMS master key is compliant if it is not in the pending deletion state. | A.10.1.2, A.18.1.5 |
| SSL certificate expiration check | An SSL certificate is compliant if it expires in more than the specified number of days. Default value: 30 days. | A.10.1.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.14.1.2, A.18.1.4 |
Rules mapped to A.12 controls
The following rules provide evidence for the A.12 controls of Annex A, which cover change management, capacity, malware protection, backup, logging, and vulnerability management.
| Rule name | Rule description | Annex A controls |
| A reasonable maintenance window is set for the PolarDB cluster | A PolarDB cluster is compliant if its maintenance window is within one of the specified time ranges. If the maintenance window overlaps with business peak hours, your services may be affected. | A.12.1.2 |
| A reasonable maintenance window is set for the RDS instance | An RDS instance is compliant if its maintenance window is within one of the specified time ranges. If the maintenance window overlaps with business peak hours, your services may be affected. | A.12.1.2 |
| A reasonable creation time is set for the automatic snapshot policy | An automatic snapshot policy is compliant if the snapshot creation time is within the specified time range. Creating a snapshot temporarily reduces the I/O performance of block storage, typically by less than 10%, which causes a brief slowdown. We recommend that you schedule snapshots outside of business peak hours. | A.12.1.2 |
| Function settings in Function Compute meet specified parameter requirements | A function in Function Compute 2.0 is compliant if its settings meet the specified parameter requirements. | A.12.1.3 |
| The number of available IP addresses for the VPC vSwitch is greater than the specified value | A VPC vSwitch is compliant if its number of available IP addresses is greater than the specified value. | A.12.1.3 |
| Security Center Enterprise Edition is used | An account is compliant if it uses Security Center Enterprise Edition or a later version. | A.12.2.1, A.12.4.1, A.12.6.1, A.16.1.1, A.16.1.2 |
| An automatic snapshot policy is configured for the ECS disk | An ECS disk is compliant if an automatic snapshot policy is configured. | A.12.3.1 |
| A backup plan is created for the NAS file system | A NAS file system is compliant if a backup plan is created for it. | A.12.3.1 |
| Log backup is enabled for the ADB cluster | An ADB cluster is compliant if log backup is enabled. | A.12.3.1 |
| Log backup is enabled for the RDS instance | An RDS instance is compliant if log backup is enabled. | A.12.3.1 |
| Incremental backup is enabled for the Redis instance | A Redis instance is compliant if incremental backup is enabled. This rule applies only to Tair or Enterprise Edition instances. | A.12.3.1 |
| Zone-redundant storage is enabled for the OSS bucket | An OSS bucket is compliant if zone-redundant storage is enabled. If zone-redundant storage is not enabled, OSS cannot ensure service continuity when a data center becomes unavailable, which affects data restoration objectives. | A.12.3.1, A.17.1.2, A.17.2.1 |
| The retention period for level-1 backups of the PolarDB cluster meets specified requirements | A PolarDB cluster is compliant if its level-1 backup retention period is greater than or equal to the specified number of days. Default value: 7 days. | A.12.3.1 |
| Versioning is enabled for the OSS bucket | An OSS bucket is compliant if versioning is enabled. If versioning is not enabled, data that is overwritten or deleted cannot be recovered. | A.12.4.1, A.12.4.2, A.17.1.2 |
| Access logging is enabled for the SLB instance | An SLB (Classic Load Balancer) instance is compliant if access logging is enabled. This rule applies only to instances that have Layer 7 listeners, because access logging is not supported for other instances. | A.12.4.1, A.14.1.1, A.14.2.3, A.16.1.7 |
| Flow log recording is enabled for the VPC | A VPC is compliant if the flow log recording feature is enabled. | A.12.4.1, A.14.1.1, A.14.2.3, A.16.1.7 |
| Log storage is configured for API group calls | An API group in API Gateway is compliant if log storage is configured for its calls. | A.12.4.1 |
| Log storage is enabled for the OSS bucket | An OSS bucket is compliant if log storage is enabled in Log Management. | A.12.4.1 |
| SQL Audit is enabled for the PolarDB cluster | A PolarDB cluster is compliant if its SQL Audit status is enabled. | A.12.4.1, A.14.2.3, A.16.1.1, A.16.1.7 |
| The log backup retention period for the PolarDB cluster meets specified requirements | A PolarDB cluster is compliant if its log backup retention period is greater than or equal to the specified number of days. Default value: 30 days. The cluster is not compliant if log backup is disabled or if the retention period is less than the specified number of days. | A.12.4.2 |
| The CloudMonitor agent is installed on running ECS instances | An ECS instance is compliant if the CloudMonitor agent is installed and the agent is in the Running state. This rule applies only to instances in the Running state. | A.12.5.1, A.14.2.1, A.16.1.1, A.16.1.2 |
| Running ECS instances have no vulnerabilities to be fixed | An ECS instance is compliant if it has no unpatched vulnerabilities of the specified type and severity in Security Center. This rule applies only to instances in the Running state. | A.12.6.1 |
Rules mapped to A.13 controls
The following rules provide evidence for the A.13 controls of Annex A, which cover network controls and secure information transfer.
| Rule name | Rule description | Annex A controls |
| The specified protocol in the security group does not allow high-risk ports to be open to all CIDR blocks | A security group is compliant if its inbound rules for the specified protocol do not expose the specified high-risk ports to the 0.0.0.0/0 CIDR block. The security group is also compliant if the inbound CIDR block is not 0.0.0.0/0, even if the port range includes high-risk ports, or if a higher-priority authorization policy denies access to a detected high-risk port. This rule does not apply to security groups used by cloud products or virtual businesses. | A.13.1.1, A.13.1.3, A.13.2.3, A.18.1.4 |
| The IP address whitelist of the PolarDB instance is not set to all CIDR blocks | A PolarDB instance is compliant if its IP address whitelist is not set to 0.0.0.0/0. | A.13.1.1, A.13.1.3, A.18.1.3, A.18.1.4 |
| SSL encryption is configured for the PolarDB cluster | A PolarDB cluster is compliant if Secure Sockets Layer (SSL) encryption is configured. | A.13.2.1, A.14.1.2 |
| TLS 1.3 version check is enabled for the CDN accelerated domain name | A CDN accelerated domain name is compliant if TLS 1.3 is enabled. | A.13.2.1, A.14.1.2 |
| The source and destination databases of a DTS sync task use secure SSL connections | A DTS instance is compliant if both the source and destination databases of its sync task use secure SSL connections. This rule applies only to DTS instances whose task type is sync. | A.13.2.1 |
| The Function Compute function is bound to a custom domain name and a specified TLS version is enabled | A Function Compute function is compliant if it is bound to a custom domain name and the specified TLS version is enabled. | A.13.2.1, A.14.1.2 |
| HTTPS listener is enabled for SLB | An SLB instance is compliant if an HTTPS listener is enabled on the specified port. This rule does not apply to SLB instances that have only TCP or UDP listeners enabled. | A.13.2.1, A.14.1.2 |
Rules mapped to A.14 controls
The following rule provides evidence for the A.14 controls of Annex A, which cover secure development and application review.
| Rule name | Rule description | Annex A controls |
| The CloudMonitor agent is installed on ACK cluster nodes | An ACK cluster is compliant if the CloudMonitor agent is installed on all its nodes and the agent is running properly. | A.14.2.1, A.16.1.1, A.16.1.2 |
Rules mapped to A.16 controls
The following rule provides evidence for the A.16 controls of Annex A, which cover information security incident management.
| Rule name | Rule description | Annex A controls |
| A notification method is configured for notification items in Security Center | An account is compliant if a notification method is configured for all notification items in Security Center. | A.16.1.2 |
Rules mapped to A.17 controls
The following rules provide evidence for the A.17 controls of Annex A, which cover information security continuity and the availability of information processing facilities.
| Rule name | Rule description | Annex A controls |
| The IPsec VPN connection is established | An IPsec VPN connection is compliant if its status is Established. | A.17.1.2 |
| Release protection is enabled for the SLB instance | An SLB instance is compliant if release protection is enabled. | A.17.1.2 |
| ECS instance health check is enabled for the Auto Scaling group | An Auto Scaling group is compliant if health checks are enabled for its ECS instances. | A.17.1.2, A.17.2.1 |
| Multi-zone RDS instances are used | An RDS instance is compliant if it is a multi-zone instance. | A.17.1.2, A.17.2.1 |
| Deletion protection is enabled for the PolarDB cluster | A PolarDB cluster is compliant if deletion protection is enabled. This rule does not apply to subscription clusters. | A.17.1.2 |
| Deletion protection is enabled for ACK clusters | An ACK cluster is compliant if deletion protection is enabled. | A.17.1.2 |
| A hot standby cluster is enabled for the PolarDB cluster | A PolarDB cluster is compliant if a hot standby storage cluster is enabled and data is distributed across multiple zones. | A.17.1.2, A.17.2.1 |
| The Auto Scaling group is associated with at least two vSwitches | An Auto Scaling group is compliant if it is associated with at least two vSwitches. | A.17.2.1 |
| Multi-zone ALB instances are used | An ALB instance is compliant if it is a multi-zone instance. If only one zone is selected, a failure in that zone can affect the ALB instance and impact service stability. | A.17.2.1 |
| Regional multi-zone clusters are used | An ACK cluster is compliant if it is a regional cluster with nodes distributed across three or more zones. | A.17.2.1 |
| Health checks are configured for all listeners and forwarding rules of the ALB instance | An ALB instance is compliant if health checks are configured for all its listeners and forwarding rules. | A.17.2.1 |