Cyber Resilience

← ISO 27001 Annex A

A.5.10 Organizational

Acceptable use of information and other associated assets

AttributesPreventive C·I·A Protect Asset management Information protection Governance and Ecosystem Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (18)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-2←P →P AC-3←P AC-8←M →P AU-6←P CM-10←P MP-7←P →P PS-6←P →P AT-2gov PL-4gov

Why these map — AI rationale (under review)

AC-2partialaligns with — Both controls require maintaining an authoritative record of who is authorized to access specific information and associated assets.
AC-8partialaligns with — Both controls ensure users receive a clear statement of expected conduct and monitoring before or during system interaction.
MP-7partialaligns with — Both controls restrict how storage media and associated assets may be used throughout their lifecycle based on classification and risk.
MP-7partialcovers — A.5.10's broad acceptable-use rules for information and assets address a slice of MP-7's media-use restrictions and prohibitions (especially the portable-device owner rule), but leave the bulk of MP-7's specific media-type, system, and procedural controls uncovered.
PS-6partialaligns with — Both controls establish binding agreements that define user responsibilities for protecting and properly handling organizational information assets.
PS-6partialcovers — A.5.10's broad requirement to ensure assets are appropriately used and handled accounts for the slice of PS-6 that concerns acceptable-use content within access agreements, but leaves the bulk of PS-6 (developing, documenting, reviewing, signing, and re-signing formal access agreements) uncovered.
PL-4noneimplements — Both controls require an organization-defined set of rules that explicitly state permitted and prohibited behaviors for users handling organizational assets.

Aligned NIST CSF 2.0 outcomes (20)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

DE.CM-03gov GV.PO-01gov GV.PO-02gov GV.RR-02gov GV.SC-02gov ID.AM-05gov ID.AM-08gov PR.AA-05gov PR.AT-01gov

Why these map — AI rationale (under review)

PR.AA-05mostlyaligns with — By requiring the policy to define permitted and prohibited uses of assets and to enforce access restrictions aligned with classification, the ISO control supports the CSF outcome of defining, managing, and enforcing access permissions and authorizations.
PR.AT-01mostlyaligns with — The ISO control mandates that personnel and external users be made aware of information-security requirements and their responsibilities for protecting assets, fulfilling the CSF outcome of providing awareness and training so personnel can perform tasks securely.
GV.PO-02partialaligns with — The ISO control requires the acceptable-use policy to be communicated and enforced, which aligns with the CSF outcome of reviewing, updating, communicating, and enforcing policy to reflect changing requirements.
ID.AM-05partialaligns with — The ISO control ties acceptable-use procedures to asset classification and risk, thereby supporting the CSF outcome of prioritizing assets based on classification, criticality, and mission impact.
GV.PO-01noneimplements — The ISO control requires creation and communication of a topic-specific acceptable-use policy that defines expected behaviors and permitted uses, directly satisfying the CSF outcome of establishing policy for managing cybersecurity risks based on organizational context and priorities.
GV.PO-02implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.AM-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-05implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AT-01implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (4)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V14.1.2←M V16.1.1←P V2.1.3←P V8.1.1←M

Related weaknesses / CWE (3)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-200→P CWE-522→P

Why these map — AI rationale (under review)

CWE-284nonemitigates — By defining and communicating explicit permitted versus prohibited uses of information assets, the control reduces the chance that users will exercise access rights outside intended boundaries.
CWE-200prevents — Clear rules on handling copies, storage, and disposal of classified information lower the likelihood that sensitive data will be left accessible to unauthorized actors.
CWE-522prevents — Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.

Mitigated MITRE ATT&CK techniques (332)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.001←M T1001.002←M T1001.003←M T1003.003→P T1003.005→P T1003.008→P T1005→P T1006←M T1011←M T1021→P T1021.004→P T1027.001←M T1027.002←M T1027.003←M T1027.006←M T1027.008←M T1027.009←M T1027.010←M T1027.011←M T1027.013←M T1027.014←M T1027.017←M →P T1027.018←M T1036←M T1036.002←M →P T1036.003←M T1036.005←M T1036.006→P T1036.007←M →P T1036.008←M →P T1036.009←M T1036.012←M T1037.002→P T1037.004→P T1040←M T1048→P T1048.003←M T1052←M →P T1052.001←M →P T1055←M T1055.001←M T1055.002←M T1055.003←M T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1059.002→P T1059.007→P T1059.009→P T1068←M T1070←M T1070.003←M T1070.004←M T1070.006←M T1070.007←M T1070.008←M T1070.010←M T1071←M T1071.001←M T1071.004←M T1078→P T1078.001→P T1078.002→P T1078.004←M →P T1080→P T1083→P T1087.003→P T1090←M T1090.002←M T1090.003←M T1091→P T1092→P T1098←M T1098.001→P T1098.002→P T1098.003→P T1098.004→P T1098.005←M T1098.006→P T1102←M T1110→P T1110.001→M T1110.002→P T1110.003→P T1110.004→P T1112←P T1114.001→P T1114.002→P T1114.003→P T1127←M T1127.001←M T1127.002→P T1127.003←M T1133←M T1134←M T1134.001←M T1134.002←P T1134.003←M T1134.004←M T1134.005←M T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1176→P T1176.001→P T1185←M T1187→P T1189→P T1199→P T1202←M T1204←M →P T1204.001←M →P T1204.002←M →P T1204.004←M →P T1204.005→P T1207←M T1211←M T1213→P T1213.001→P T1213.002→P T1213.003→P T1213.004→P T1213.005→P T1216←M T1218←M T1218.001→P T1218.005←M →P T1218.007←M T1218.008←M T1218.010←M T1218.011←M T1218.012←M T1218.013←M T1219.003←M T1221←M T1222←M T1222.001←M →P T1222.002←M T1480.001←M T1484←M T1484.002←M T1485←P →P T1486→M T1490←M T1496←M T1499←F T1528→P T1530→P T1534→P T1535←M T1537←M →P T1538→P T1539←F →P T1542←M T1542.002←M T1543.002→P T1546.001→P T1546.004→P T1546.013→P T1546.016→P T1547.001→P T1547.009→P T1547.015→P T1548.002←M T1548.003←P →P T1548.005→P T1548.006←M T1550←M T1550.001←F T1550.002←F T1550.003←F T1550.004←F T1552←P →P T1552.001→P T1552.003→P T1552.006→P T1552.008→P T1553.001←M T1553.002←P T1553.003←M T1553.004←P T1553.005←M T1553.006←M T1555→P T1555.004→P T1555.005→P T1556←M T1556.003←P T1556.005→P T1556.006←M T1556.007←M T1556.009←M T1557.004→P T1561←M T1564←M T1564.001←M T1564.004←M T1564.008→P T1565.001→P T1566→P T1566.001→P T1566.002→P T1566.003←M →P T1566.004→P T1567.002←P T1567.003→P T1571←M T1572←M T1574←M T1574.001←M →P T1574.009→P T1574.011→P T1574.013←M T1578←M T1578.001←M T1578.002←M T1578.003←M T1578.004←M T1578.005←M T1589.001→P T1593.003→P T1598→P T1598.001→P T1598.002→P T1598.003←M →P T1598.004→P T1599←M T1599.001←M T1600←P T1601.001←P T1601.002←M T1602.002→P T1606←M T1606.001←F T1608.005→P T1610←P T1612←P T1620←M T1621←M T1647←P T1649→P T1657→P T1665←P T1666←M T1671→P T1677→P T1678←P T1684←M →P T1684.001→P T1684.002←M T1685←M T1685.001←M T1685.002←M →P T1685.003←M T1685.004←M T1685.005←M T1685.006←M T1686←F T1686.002←M T1686.003←M T1688←M T1690←M

Why these map — AI rationale (under review)

T1003.003prevents — A.5.10's acceptable-use policy and procedures explicitly require access restrictions, authorized-user records, protection of copies, and authorized disposal across the information lifecycle, which directly constrains the T1003.003 technique of accessing/copying NTDS.dit or its backups on Windows domain controllers.
T1003.005prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors around handling and accessing cached credential assets (including extraction tools and storage locations), which can prevent the technique when followed; however, it is governance-only with no technical enforcement, leaving most SYSTEM/sudo-based extraction paths untouched.
T1003.008prevents — A.5.10's acceptable-use policy, expected behaviours, access restrictions by classification, and monitoring directly constrain non-root users from reading /etc/shadow (and related dumping), but the technique remains fully available to any privileged or compromised root-level process or user, which is the dominant vector.
T1005prevents — A.5.10's acceptable-use policy, expected/prohibited behaviours, access restrictions by classification and handling rules for copies/storage/disposal constrain legitimate users from freely searching or exfiltrating sensitive local data, but do not stop an adversary who has already obtained initial access or who bypasses policy via technical means such as interpreters or automated collection.
T1021prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited remote-service behaviors (e.g., restricting which accounts, protocols, or tools may be used and requiring monitoring), which stops many legitimate-account-abuse paths before the technique can run; it leaves the core credential-theft vector and technical enforcement gaps untouched.
T1021.004prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors and permitted/prohibited asset use (including remote login via valid accounts), which can prevent the technique when followed; however, it is governance only and does not technically enforce restrictions on SSH usage or valid-account abuse.
T1027.017prevents — A.5.10's acceptable-use policy, awareness, and procedures for handling/protecting assets per classification and risks can constrain user behaviors that open or interact with smuggled SVG payloads (e.g. via permitted/prohibited use and monitoring), but does not stop the underlying technique of embedding malicious content in SVGs that bypasses filters.
T1036.002prevents — A.5.10's acceptable-use policy, awareness, and procedures for the information life cycle (including permitted/prohibited behaviors, access restrictions by classification, and marking of media) can constrain user execution of disguised files and handling of untrusted attachments, but this is only a slice of the social-engineering vector that also reaches defenders, automated tools, and registry abuse.
T1036.006prevents — A.5.10's acceptable-use policy, awareness, and procedures (including permitted/prohibited behaviors, access restrictions by classification, and handling rules across the information lifecycle) can constrain user actions that would otherwise allow or enable double-clicking disguised files, but this is only a minority slice of the technique's attack surface (policy does not stop the OS-level filename-processing behavior itself, nor does it reach non-user vectors or all execution paths).
T1036.007prevents — A.5.10's acceptable-use policy and awareness directly address expected/unacceptable behaviors and permitted/prohibited uses of assets (including file handling and email attachments), which constrains user execution of disguised executables; this is a genuine but minority slice of the technique because the control is governance-only and does not reach OS-level filename display, hiding mechanisms, or technical enforcement.
T1036.008prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours around handling, marking, storing, and validating files per classification, which stops many (but not all) masquerading attempts that rely on users treating disguised files as benign.
T1037.002prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors and asset handling (including plist modifications and script execution on login), which can prevent the technique when followed; however, it is governance-only with no technical enforcement, and the technique requires admin privileges that policy alone does not block.
T1037.004prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors and access restrictions over the information life cycle (including startup scripts as assets), which can prevent unauthorized modification of RC files when followed; however, it is governance-only with no technical enforcement and leaves the root-privilege modification vector largely untouched on the named platforms.
T1048prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors and access restrictions over the information life cycle, which can stop many forms of unauthorized exfiltration (especially policy-violating use of utilities, cloud consoles, or alternate channels), but leaves a real remainder for technical bypasses, insider misuse that evades the policy, and non-policy-enforced platforms.
T1052prevents — A.5.10's acceptable-use policy, awareness, permitted/prohibited behaviors, access restrictions, monitoring, and handling rules (including removable media) directly constrain user-introduced physical media as an exfiltration vector, but cannot stop all insider misuse or air-gapped scenarios where the policy is ignored.
T1052.001prevents — A.5.10's acceptable-use policy, awareness, and procedures (including access restrictions, monitoring, permitted/prohibited behaviors, and handling rules for removable media) constrain user-introduced USB devices for exfiltration in many policy-enforced environments, but cannot stop all air-gapped or insider cases where the technique still runs.
T1059.002prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses and monitoring directly constrain AppleScript abuse by users (e.g. prohibiting osascript, fake dialogs or launching reverse shells), but cannot stop adversary-controlled binaries or remote AppleEvents that bypass user-level policy.
T1059.007prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors and permitted/prohibited uses of information assets, which reaches the abuse of JS interpreters for execution on endpoints where policy is enforced and monitored; the remainder is the web-hosted/drive-by and obfuscated-payload slices that sit outside endpoint-use policy.
T1059.009prevents — A.5.10's acceptable-use policy and awareness directly constrain expected vs. prohibited behaviors around use of cloud APIs and associated assets, preventing the technique when followed; this reaches only a minority slice because the technique can still be executed by compromised credentials, external parties, or non-policy-abiding actors without altering the underlying API availability.
T1078prevents — A.5.10's acceptable-use policy, expected behaviours, permitted/prohibited uses, access restrictions by classification, authorized-user records and disposal rules constrain legitimate account use and can reduce inactive-account residue that adversaries abuse, but do not stop credential compromise, theft or the subsequent abuse that defines T1078.
T1078.001prevents — A.5.10's acceptable-use policy and procedures explicitly require clear direction on permitted/prohibited behaviors, access restrictions by classification, authorized-user records, and proper handling/disposal across the information lifecycle, which directly constrains abuse of default accounts when they are treated as information assets; however, it is governance-only, silent on technical enforcement or default-account removal, and leaves the dominant technical slice (unchanged factory defaults on appliances, cloud roots, service accounts) untouched.
T1078.002prevents — A.5.10's acceptable-use policy, expected behaviors, permitted/prohibited uses, access restrictions by classification, and monitoring directly constrain legitimate but risky use (and therefore abuse) of domain accounts by personnel and external parties, but do not stop credential theft, dumping, or reuse that bypasses policy.
T1078.004prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses and monitoring directly constrain misuse of valid cloud accounts (e.g. prohibiting credential sharing, over-privileged actions or persistence via additional credentials), but cannot stop initial compromise vectors such as phishing, brute force or misconfigurations that grant the account in the first place.
T1080prevents — A.5.10's acceptable-use policy, awareness, and procedures for handling/protecting shared assets (incl. access restrictions, marking, authorized users, and disposal per classification) constrain user behaviors that would open or propagate tainted shared content, but do not stop an adversary from adding the malicious content to the share in the first place.
T1083prevents — A.5.10's acceptable-use policy and procedures can explicitly prohibit or restrict discovery-oriented commands/behaviors (via permitted/prohibited use, access restrictions, and monitoring), which prevents the technique on assets where those rules are enforced; this is only a slice of the technique's surface (e.g., does not stop all native-API or permission-elevated discovery, nor remove the capability from all platforms).
T1087.003prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted behaviors and access to information assets (including email directories), so the technique cannot run for users who obey it; the remainder is that authenticated insiders or external parties who violate policy (or are not covered) can still execute it.
T1091prevents — A.5.10's acceptable-use policy, awareness, and procedures for handling/classification/marking/disposal of removable media directly constrain user behaviors that would otherwise copy malware onto or execute from such media, but cannot stop adversary firmware modification, pre-infected manufacturer steps, or non-user-mediated Autorun vectors.
T1092prevents — A.5.10's acceptable-use policy, awareness, and procedures for handling/classified removable media (access restrictions, marking, authorized users, secure storage/disposal) constrain the adversary's ability to introduce or exfiltrate commands via USB in many policy-enforced environments, but do not stop the technique when users violate policy or on unmanaged/compromised hosts.
T1098.001prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors around credential and asset handling (including access restrictions, authorized-user records, and disposal), which can stop many forms of unauthorized credential addition when followed; it does not reach the technical execution paths (API calls, permission checks) that enable the technique once an adversary has initial access.
T1098.002prevents — A.5.10's acceptable-use policy and awareness directly constrain the permitted/prohibited behaviors around granting mailbox permissions or delegations, making the technique harder for legitimate users to perform unwittingly or maliciously, but it does not stop an already-compromised account from executing the Add-MailboxPermission action.
T1098.003prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors around IAM changes and asset handling, preventing the technique when performed by authorized insiders or external parties who follow the policy; it does not stop an already-compromised external adversary account that bypasses the policy.
T1098.004prevents — A.5.10's acceptable-use policy, expected behaviors, permitted/prohibited uses, access restrictions by classification, and authorization of disposal directly constrain unauthorized modification of authorized_keys files as an unacceptable behavior on information assets, but this is governance only and leaves technical enforcement (file permissions, monitoring, etc.) to other controls.
T1098.006prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors around permission management and asset handling, which can stop the technique when performed by authorized insiders; it does not reach external adversaries who already hold sufficient permissions or compromise accounts.
T1110prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviors around credential handling, storage, and sharing that enable brute-force (e.g., weak/reused passwords, exfiltration of hashes), but do not stop the technique itself when run by an external adversary or against acquired hashes.
T1110.001prevents — A.5.10's acceptable-use policy and associated procedures explicitly require stating expected/unacceptable behaviours, permitted/prohibited uses of assets (including authentication mechanisms), monitoring, access restrictions by classification, and account lockout considerations, which directly constrain or block password guessing techniques when enforced.
T1110.002prevents — A.5.10's acceptable-use policy and awareness directly constrain behaviors around credential handling, storage, and disclosure that can prevent hashes from being obtained in the first place (the prerequisite step for T1110.002), but do not stop offline cracking once hashes are already exfiltrated.
T1110.003prevents — A.5.10's acceptable-use policy and awareness directly constrain the human behaviours (e.g. weak/reused passwords, sharing, or lax credential hygiene) that enable password spraying; the control does not reach technical spraying mechanics, service-specific throttling, or non-human vectors, leaving a large remainder.
T1110.004prevents — A.5.10's acceptable-use policy and awareness directly constrain the personal/business password-reuse behaviour that makes credential stuffing succeed, but cannot stop adversaries from obtaining breach dumps or attempting the technique against accounts that still share passwords.
T1114.001prevents — A.5.10's acceptable-use policy, expected behaviors, access restrictions by classification, and handling rules (including copies and storage) can constrain local collection of email files when they are treated as protected assets, but this is governance that does not technically block the technique on a compromised endpoint.
T1114.002prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted behaviors and monitoring around handling email assets, which can stop credentialed collection when it violates the policy, but leaves the dominant technical path (valid creds + direct Exchange/365 interaction) intact.
T1114.003prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviors, permitted/prohibited uses, monitoring disclosure, and life-cycle procedures (including access restrictions and authorization of actions) can explicitly prohibit and thereby stop legitimate users from creating forwarding rules, but cannot stop an adversary with valid credentials who already bypassed authentication.
T1127.002prevents — A.5.10's acceptable-use policy, awareness, and procedures on permitted/prohibited behaviors, access restrictions, and monitoring can constrain user-driven ClickOnce abuse vectors (e.g. visiting malicious sites or installing disguised apps), but cannot stop all proxy-execution paths such as direct rundll32 abuse of dfshim.dll or placement in startup folders by already-compromised processes.
T1137prevents — A.5.10's acceptable-use policy and awareness directly constrain prohibited behaviours and permitted uses of Office assets (including macros, add-ins, rules), which stops the adversary technique from being introduced or activated in many cases, but leaves a remainder where technically capable users can still enable the mechanisms.
T1137.001prevents — A.5.10's acceptable-use policy and awareness directly constrain macro-enabled templates as prohibited behaviours or uses of Office assets, and can require enabling restrictions on macros, but this is governance that does not technically stop the template modification or search-order hijack on a compromised system.
T1137.002prevents — A.5.10's acceptable-use policy and awareness directly constrain the prohibited behaviour of adding/modifying the Office Test registry key or loading unauthorized DLLs, but only for users who are subject to and follow the policy; it does not technically block the technique itself.
T1137.003prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours around permitted/prohibited use of Outlook and mailbox assets, which can stop the initial addition of malicious forms (the root of the persistence technique); it does not reach the technical loading/execution mechanics once forms are present.
T1137.004prevents — A.5.10's acceptable-use policy and awareness directly constrain the prohibited behaviours and asset handling (including Outlook customizations) that enable this persistence technique, but only for users who comply; it does not technically block the addition or execution of a malicious Home Page.
T1137.005prevents — A.5.10's acceptable-use policy and awareness directly constrain the permitted/prohibited behaviors and monitoring that would stop an authorized user (or external party) from creating the malicious Outlook rule, but the control reaches only the human-behavior slice of the technique and leaves the technical persistence mechanism itself untouched.
T1137.006prevents — A.5.10's acceptable-use policy and procedures can explicitly prohibit unauthorized add-ins (as unacceptable behaviour and prohibited use of assets), with monitoring to deter the technique, but this is governance that does not technically block add-in registration or execution at startup.
T1176prevents — A.5.10's acceptable-use policy, awareness, and procedures for the information life cycle (including access restrictions, authorized-user records, and handling per classification) can constrain user-driven or social-engineering installation of malicious extensions on the organization's assets, but leaves adversary-installed extensions, marketplace compromises, benign-extension abuse, and non-user vectors untouched.
T1176.001prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, and awareness requirements can constrain user-driven or social-engineering installation of malicious browser extensions, but do not stop file-based, registry, or post-compromise silent installation techniques described in the TTP.
T1187prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours around untrusted resources, attachments, external links and public shares that trigger forced SMB/WebDAV auth, but cannot eliminate the automatic client behaviour or all vectors such as EfsRpcOpenFileRaw or privileged .LNK/.SCF placement.
T1189prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours that enable drive-by (enabling scripting/notifications, ignoring warnings, visiting risky community sites), which is a named slice of the technique's success path, but cannot stop the initial web compromise, malicious content delivery, or automatic exploitation steps.
T1199prevents — A.5.10's topic-specific acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, access restrictions by classification, and monitoring directly constrain how third-party users may employ granted access, thereby stopping many (but not all) abuse vectors of a trusted-relationship technique.
T1204prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, monitoring, and life-cycle procedures (access restrictions, copies, disposal) directly constrain the user actions that T1204 relies on, but social-engineering delivery vectors (phishing, vishing, shared drops) sit outside the clause's scope and remain unaddressed.
T1204.001prevents — A.5.10's acceptable-use policy, awareness, and expected/unacceptable-behaviour rules directly constrain the user action of clicking untrusted/malicious links, reducing the chance the technique ever runs; it is only a slice because policy and training do not stop all social-engineering successes or remove the underlying delivery vector.
T1204.002prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviors, permitted/prohibited uses, and awareness directly constrain the user action of opening untrusted/malicious files, reducing the likelihood the technique runs; it does not stop social engineering, masquerading, or placement of the file itself.
T1204.004prevents — A.5.10's acceptable-use policy and awareness directly address expected/unacceptable behaviors and permitted/prohibited uses of information assets (including executing pasted commands), which constrains the social-engineering vector of T1204.004; it is only partial because the technique can still succeed via well-crafted deception that does not obviously violate the policy, and the control does not reach technical enforcement.
T1204.005prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours around installing/using third-party libraries and assets (permitted/prohibited use, access restrictions, classification-driven handling), which stops many malicious-library installs before they occur, but cannot reach supply-chain compromise of popular libraries, typosquatting that evades policy, or installs outside user awareness.
T1213prevents — A.5.10's acceptable-use policy, awareness, access restrictions by classification, and handling rules (including copies, marking, storage, and disposal) constrain user behaviors that would expose repository contents, directly addressing the overly-broad access and external-sharing vectors named in the T1213 description and examples.
T1213.001prevents — A.5.10's acceptable-use policy, awareness, and procedures (including access restrictions, monitoring, and handling rules across the information lifecycle) constrain how authorized users may interact with Confluence-stored assets and thereby reduce the likelihood that the repository becomes an easily mineable target for adversaries.
T1213.002prevents — A.5.10's acceptable-use policy and awareness directly constrain the permitted behaviors around sensitive SharePoint content (marking, access restrictions, copies, disposal), which can stop the technique from succeeding when followed; it is only a slice because the control is governance/awareness and does not technically block repository access or exfiltration.
T1213.003prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, access restrictions by classification, and monitoring directly constrain insider or credentialed misuse of code repositories, but do not stop an external adversary who has already gained access to the network or repository.
T1213.004prevents — A.5.10's acceptable-use policy, awareness, and procedures (access restrictions, monitoring, classification-based handling, and disposal) constrain insider or post-access misuse of CRM data by authorized users, but do not stop an adversary who has already gained access from mining the software.
T1213.005prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors around sharing sensitive data (e.g. credentials, source, proprietary info, IR discussions) in messaging apps, so the technique cannot run when followed; partial because the control is governance-only and does not technically block exfiltration or mining when users violate policy.
T1218.001prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors and permitted/prohibited asset use (including how CHM files may be opened or triggered), which stops the technique for users who comply; the remainder is technical bypasses, unpatched hh.exe, and users who violate policy.
T1218.005prevents — A.5.10's acceptable-use policy and awareness directly constrain the permitted/prohibited behaviors and asset handling (including execution of unapproved files or scripts), which stops the mshta abuse technique for users who comply; it does not stop the technique for non-compliant insiders, external parties outside policy reach, or fully automated/scripted abuse.
T1222.001prevents — A.5.10's acceptable-use policy and procedures explicitly require access restrictions, authorized-user records, and classification-driven handling that constrain who may legitimately modify ACLs/permissions, thereby preventing the technique for non-privileged users; it does not stop an already-privileged adversary from using icacls/takeown/etc.
T1485prevents — A.5.10's acceptable-use policy, expected behaviors, access restrictions by classification, authorized-user records, and disposal authorization constrain legitimate users from destructive acts and limit who can reach high-impact assets, but do not stop an adversary who has already obtained privileged access or uses worm-like propagation.
T1486recovers — A.5.10 requires acceptable-use procedures covering the full information life cycle including protection of copies, storage per specs, marking, and especially authorization of disposal plus supported deletion method(s); this directly enables (and in practice supplies the policy vehicle for) backup-and-restore regimes that recover data after ransomware encryption, matching the cp-9 / A.8.13 recovers-mostly anchors.
T1528prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours around handling tokens (e.g. not granting OAuth consent to malicious apps, not exposing service-account tokens, proper storage/disposal), which stops several social-engineering and post-compromise theft paths in the T1528 prose, but leaves the technical container/VM compromise, IMDS token-request, and CI/CD pipeline compromise vectors untouched.
T1530prevents — A.5.10's acceptable-use policy, expected behaviors, permitted/prohibited uses, access restrictions by classification, and authorization of disposal directly constrain user actions that could expose cloud storage (e.g., overly-broad permissions or public access), but do not address misconfigurations, leaked credentials, or technical enforcement of storage protections.
T1534prevents — A.5.10's acceptable-use policy, awareness, and procedures (expected behaviors, permitted/prohibited uses, monitoring, access restrictions, and handling rules) can constrain users from engaging in or falling for internal spearphishing behaviors such as opening attachments/links or sharing credentials, but this is only a minority slice of the multi-staged technique that also relies on prior compromise, impersonation, technical delivery, and non-user vectors.
T1537prevents — A.5.10's acceptable-use policy and procedures explicitly require defining permitted/prohibited behaviors for information assets (including access restrictions, authorized-user records, and disposal rules) and communicating them to all users; this constrains insider or credentialed abuse of cloud accounts for exfiltration to another account, but leaves the dominant external-adversary vector (post-compromise API abuse without violating policy) untouched.
T1538prevents — A.5.10's acceptable-use policy, expected behaviors, permitted/prohibited uses, monitoring clause, and access restrictions (tied to classification) can constrain or prohibit use of stolen-credential dashboard access for reconnaissance, but cannot stop the technique when credentials are already valid and the dashboard is a permitted interface.
T1539prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours that enable local cookie theft (e.g. running untrusted JS, installing malware, improper storage/handling of session data), but cannot stop remote MITM/proxy, malicious JS injection into trusted sites, or post-theft use of a stolen cookie.
T1543.002prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors and permitted/prohibited uses of assets (including systemd service files and generators), which can prevent the technique when followed; however, it is governance-only with no enforcement mechanism, leaving most technical execution paths untouched.
T1546.001prevents — A.5.10's acceptable-use policy and procedures explicitly require stating permitted/prohibited behaviors for assets, access restrictions by classification, and authorization of changes throughout the information life cycle, which constrains users from arbitrarily modifying file associations to plant malicious handlers; this is a genuine but minority slice of the technique because the control is governance-only, does not technically block Registry writes, and leaves admin-level or application-driven changes largely unreached.
T1546.004prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors and access restrictions over the information life cycle, which can stop insertion of malicious commands into shell config files when those files are treated as protected assets; however, it is governance-only and does not technically block the modification itself.
T1546.013prevents — A.5.10's acceptable-use policy and awareness directly constrain the modification and use of PowerShell profiles as an asset, stating expected/unacceptable behaviors and permitted/prohibited uses, which prevents the technique in policy-enforced environments but leaves technical execution possible when the policy is violated.
T1546.016prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, and life-cycle procedures (including access restrictions, authorized-user records, and disposal) can constrain users from deliberately or negligently installing modified malicious packages, but cannot stop supply-chain or automated installer abuse that does not rely on user violation of the policy.
T1547.001prevents — A.5.10's acceptable-use policy and procedures explicitly require stating permitted/prohibited behaviors for assets (including registry and startup locations), access restrictions by classification, and authorized-user records; this constrains misuse for persistence when followed but does not stop an adversary (or insider) from adding a run-key entry.
T1547.009prevents — A.5.10's acceptable-use policy and awareness directly constrain the permitted/prohibited behaviors around creating or modifying shortcuts (especially in startup folders or for persistence), which stops the technique from being performed by authorized users; it reaches only a minority slice because it has no technical enforcement against malware, external actors, or violations once access exists.
T1547.015prevents — A.5.10's acceptable-use policy, awareness, and procedures (including access restrictions, authorized-user records, and handling rules across the information life cycle) can constrain or prohibit adding unauthorized login items on macOS, but this is a governance slice that does not technically block the AppleScript/Native API technique itself.
T1548.003prevents — A.5.10's acceptable-use policy and awareness directly constrain expected behaviors around sudo/sudoers configuration and use (permitted/prohibited actions, access restrictions, monitoring), which can stop many poor-configuration abuses that enable the technique, but cannot prevent all instances (e.g., admin misconfiguration of NOPASSWD or timestamp_timeout, or privileged malware that already has edit rights).
T1548.005prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, access restrictions by classification, and monitoring directly constrain misuse of temporary elevation, JIT requests, impersonation, and role-passing when performed by personnel or external parties, but cannot stop the underlying misconfiguration of permission structures that creates the escalation path.
T1552prevents — A.5.10's acceptable-use policy, expected behaviors, access restrictions by classification, copy protection, and disposal rules constrain where and how credentials may be stored, reducing the chance they are left unsecured and searchable, but do not stop all forms of insecure storage or the post-compromise search itself.
T1552.001prevents — A.5.10's acceptable-use policy, awareness, and procedures (including access restrictions, classification-driven handling, and prohibitions on insecure storage) can constrain user behaviors that create credential files, but do not stop the technique when credentials are already present in files, configs, backups, or logs created by applications or the platform itself.
T1552.003prevents — A.5.10's acceptable-use policy and procedures can explicitly prohibit typing credentials on the command line (permitted/prohibited behaviours and full-lifecycle handling rules), which stops the insecure-storage pattern that enables the technique; the remainder is that policy does not technically block history-file creation or searching once the prohibited behaviour occurs.
T1552.006prevents — A.5.10's acceptable-use policy and procedures can explicitly prohibit (and monitor for) unauthorized enumeration or extraction of credentials from SYSVOL/GPP XML files, constraining the technique for authorized users; this is only a slice because the core flaw (publicly decryptable credentials left readable to any domain user) is an insecure configuration that policy alone does not eliminate.
T1552.008prevents — A.5.10's acceptable-use policy, awareness, and procedures (including permitted/prohibited behaviors, access restrictions by classification, and handling rules across the information lifecycle) constrain users from sharing credentials in chat services, which directly stops the human behavior that seeds the unsecured credentials the technique collects.
T1555prevents — A.5.10's acceptable-use policy, expected behaviours, permitted/prohibited uses, access restrictions by classification, and handling rules (including storage and copies) can constrain where and how password stores are used or left accessible, preventing the technique in policy-enforced environments, but this is only a minority slice of the technical search locations and credential-manager protections named in T1555.
T1555.004prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors around credential access, storage, and extraction tools (e.g., vaultcmd, CredEnumerate, password recovery utilities), preventing the technique when followed; partial because it is governance-only and does not technically block the APIs, file reads, or lockers themselves.
T1555.005prevents — A.5.10's acceptable-use policy and procedures can explicitly prohibit unauthorized extraction or brute-forcing of password-manager master passwords/credentials (via expected behaviors, permitted-use rules, and monitoring), constraining the technique on managed assets; this is only a slice because the control is governance-only and cannot stop an adversary who already has a foothold or bypasses policy.
T1556.005prevents — A.5.10's acceptable-use policy and awareness directly constrain the permitted/prohibited behaviors around enabling reversible encryption (an explicit information-security risk in the guidance on classification, access restrictions, and handling), so the technique is prevented when followed; the remainder is that the control is purely governance/awareness and does not technically block the AD/PowerShell/GP changes themselves.
T1557.004prevents — A.5.10's acceptable-use policy and awareness of expected behaviors, permitted/prohibited uses, and monitoring can constrain user decisions to connect to untrusted or evil-twin Wi-Fi (especially in public settings), but does not stop the adversary from hosting the AP, spoofing SSIDs/PNLs, or coercing connections via signal strength.
T1564.008prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/unacceptable behaviors around email rules and information handling, preventing many user-level abuses that rely on valid credentials, but does not stop an administrator or fully-privileged adversary from creating organization-wide transport rules.
T1565.001prevents — A.5.10's acceptable-use policy, expected behaviors, access restrictions by classification, authorized-user records, and disposal rules constrain some insider or authorized-user manipulation of stored data but do not stop an adversary who has already obtained the necessary access or privileges.
T1566prevents — A.5.10's acceptable-use policy and awareness directly constrain user behaviours that enable phishing success (e.g., clicking links/attachments, violating permitted-use rules), lowering the chance the technique completes, but cannot stop delivery, spoofing, or evasive social-engineering vectors that do not rely on user violation of the policy.
T1566.001prevents — A.5.10's acceptable-use policy, awareness, and procedures (expected behaviors, permitted/prohibited uses, monitoring, access restrictions, marking, and handling per classification) constrain user opening of suspicious attachments and reduce the social-engineering success rate that T1566.001 relies on, but do not stop determined targeted delivery or all user execution.
T1566.002prevents — A.5.10's acceptable-use policy, awareness, and procedures for permitted/prohibited behaviors and monitoring directly constrain user interaction with malicious links (the social-engineering and User Execution core of T1566.002), but cannot stop the email from arriving or block all technical variants such as OAuth consent phishing or IDN homographs that do not rely on prohibited user action.
T1566.003prevents — A.5.10's acceptable-use policy, awareness, and procedures (including permitted/prohibited behaviors, monitoring, and handling rules across the information life cycle) constrain user actions that enable spearphishing success via third-party services, but do not stop adversaries from sending the messages or eliminate the social-engineering vector itself.
T1566.004prevents — A.5.10's acceptable-use policy, awareness, and expected-behavior rules directly constrain user actions that enable vishing (e.g., divulging credentials or following voice instructions), lowering the chance the social-engineering technique succeeds, but do not stop the adversary from placing the call or remove the human-factors root cause.
T1567.003prevents — A.5.10's acceptable-use policy, awareness, and procedures (including permitted/prohibited uses, access restrictions, and monitoring) can constrain or prohibit exfiltration to unapproved external text storage sites for many users, but this is only a minority slice of the technique because the control is governance-only, does not block the actual outbound action or network flow, and leaves technical bypasses (e.g. by malware, privileged insiders, or unsanctioned tools) intact.
T1574.001prevents — A.5.10's acceptable-use policy, awareness, and procedures for the information life cycle (including access restrictions, authorized-user records, copy protection, storage, marking, and authorized disposal) can constrain some user behaviors that enable DLL sideloading or search-order hijacking via unauthorized planting/substitution of files, but leaves the majority of the technique (technical hijacking mechanics, phantom DLLs, redirection, remote shares, and non-user-driven execution) untouched.
T1574.009prevents — A.5.10's acceptable-use policy and procedures explicitly require access restrictions, authorized-user records, and handling rules across the information life cycle that can constrain unquoted-path configurations and related behaviors on Windows assets, but this is only a minority slice of the technique's root causes (e.g., registry/service configs, developer quoting errors).
T1574.011prevents — A.5.10's acceptable-use policy and awareness directly address expected behaviors, permitted/prohibited uses, access restrictions, and monitoring for information/assets (including Registry keys per classification), which constrains the improper-permission slice that enables the hijack; it does not itself set or enforce the ACLs.
T1589.001prevents — A.5.10's acceptable-use policy, awareness, and handling rules (including access restrictions, monitoring, and disposal) constrain user behaviors that commonly lead to credential exposure via reuse, phishing elicitation, or leaks, but do not stop adversary collection methods such as purchasing from dark-web markets, compromising external sites, or exploiting infostealer logs.
T1593.003prevents — A.5.10's acceptable-use policy, awareness, and procedures for the information life cycle (classification-based access restrictions, authorized-user records, copy protection, secure storage, marking, and authorized disposal) can constrain what sensitive data is ever pushed to public repositories, thereby preventing the technique from having anything useful to find.
T1598prevents — A.5.10's acceptable-use policy, awareness of handling rules, and expected/unacceptable behaviours directly constrain the human side of responding to phishing-for-info lures (e.g. not divulging credentials), but do not stop the adversary from sending the messages or using technical evasion/spoofing, leaving the bulk of the PRE technique untouched.
T1598.001prevents — A.5.10's acceptable-use policy, awareness, and behavioral rules (including monitoring and permitted/prohibited actions) constrain how personnel interact with third-party services and respond to lures, reducing the chance the social-engineering technique succeeds in eliciting information; it does not stop the adversary from sending the messages.
T1598.002prevents — A.5.10's acceptable-use policy, awareness, and procedures on expected behaviors, permitted use, monitoring, and handling of assets (including attachments and information requests) constrain user actions that would otherwise complete the social-engineering technique, but do not stop the adversary from sending the message or guarantee the recipient will not still fall for it.
T1598.003prevents — A.5.10's acceptable-use policy, awareness, and behavioral rules directly constrain user actions that would otherwise complete the social-engineering click or credential entry step of T1598.003, but the technique's reconnaissance, link crafting, email delivery, and technical spoofing elements remain untouched.
T1598.004prevents — A.5.10's acceptable-use policy, awareness, and expected-behavior rules directly constrain vishing by defining unacceptable social-engineering requests for credentials or sensitive data and by requiring monitoring that deters or stops compliant personnel from divulging it; the slice left unreached is non-compliant insiders or external parties who ignore the policy.
T1602.002prevents — A.5.10's acceptable-use policy, expected behaviors, permitted/prohibited uses, access restrictions by classification, and authorization of disposal directly constrain insider or authorized-user extraction of network device configs, but do not stop external adversaries using SNMP/SMI or other protocol-based access on network devices.
T1608.005prevents — A.5.10's acceptable-use policy and awareness of expected behaviors, permitted/prohibited uses, monitoring, and handling rules (including access restrictions and marking) can constrain some user-side actions that enable or follow link-target setup in phishing, but does not stop adversaries from acquiring infrastructure, cloning sites, uploading malware, or hosting on external services/IPFS.
T1649prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted behaviors around handling, storage, marking, access, and disposal of certificate assets, which can prevent some theft vectors (e.g., unsecured copies or misuse of enrollment rights) but does not address forging, CA key compromise, or most technical extraction methods.
T1657prevents — A.5.10's acceptable-use policy, awareness, and handling rules (including access restrictions, monitoring, and authorized behaviors) can prevent some social-engineering and insider-enabled slices of financial theft such as BEC fraud or unauthorized transfers, but do not stop technical theft, ransomware extortion, cryptocurrency exploits, or most adversary-driven paths described in the technique.
T1671prevents — A.5.10's acceptable-use policy and awareness directly constrain the 'permitted and prohibited use' of SaaS integrations and OAuth consents (especially from high-privileged accounts), which stops the technique at the consent step for users who follow the policy; it does not reach adversary-created service principals, co-opted integrations, or technical token persistence that survive account disablement.
T1677prevents — A.5.10's acceptable-use policy and awareness directly constrain expected/prohibited behaviors around handling CI/CD assets and configs (e.g. no unauthorized modification of pipelines or build files), which stops the Direct and some Indirect scenarios when followed; it does not reach Public Pipeline Execution from external forks or technical enforcement gaps in self-hosted runners.
T1684prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, and awareness requirements directly constrain user actions that would otherwise authorize the social-engineering requests described in T1684, but cannot stop the adversary's persuasion attempts or all user compliance.
T1684.001prevents — A.5.10's acceptable-use policy, expected/unacceptable behaviours, permitted/prohibited uses, and awareness requirements directly constrain the social-engineering slice of impersonation (e.g. prohibiting acting on urgent or spoofed requests), but do not stop reconnaissance, infrastructure acquisition, or technical delivery vectors that precede or enable the technique.
T1685.002prevents — A.5.10's acceptable-use policy and awareness directly constrain permitted/prohibited behaviors around logging assets and monitoring activities (explicitly listed), so it prevents the technique when the actor is a compliant insider; it does not stop an adversary who already has sufficient privileges or who is external.

Prevented OWASP Web Top 10 (2025) risks (1)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.