ISO 27001 Control Mapping

ISO/IEC 27001:2022 specifies an information security management system (ISMS). The platform supports ISO 27001 by providing technical controls aligned with Annex A. Achieving certification is your administrator's responsibility; the platform supplies the building blocks.

This mapping is grouped by Annex A theme. For each control, we note Platform (built into the platform), Administrator (configured by your team), or Out of scope (e.g. organisational policies).

Organisational controls (Annex A.5)

Control	Coverage	Notes
A.5.7 Threat intelligence	Administrator	Subscribe to relevant threat feeds.
A.5.10 Acceptable use	Administrator	Document in your AUP.
A.5.15 Access control	Platform	Role-based access enforced on every protected route.
A.5.16 Identity management	Platform + Administrator	Identity-provider driven; administrator manages user lifecycle.
A.5.17 Authentication information	Platform	Token-based, no plaintext credentials in the application layer.
A.5.18 Access rights	Platform + Administrator	Administrator assigns roles; platform enforces them.
A.5.23 Cloud services	Administrator	Administrator decides on cloud usage and supplier vetting.

People controls (Annex A.6)

These are organisational. The platform plays no direct role; document your training, awareness, and disciplinary processes.

Physical controls (Annex A.7)

Physical security is your administrator's responsibility (data centre or cloud provider vetting). The platform does not impose physical constraints.

Technological controls (Annex A.8)

Control	Coverage	Notes
A.8.1 User endpoint devices	Out of scope	Endpoint posture is your organisation's policy.
A.8.2 Privileged access rights	Platform + Administrator	The Developer role is the platform's privileged tier; administrator restricts assignment.
A.8.3 Information access restriction	Platform	Role-based access plus ownership checks on every API path.
A.8.5 Secure authentication	Platform	Single sign-on with refresh-token rotation.
A.8.6 Capacity management	Administrator	Dashboards via your monitoring tooling; alerts administrator-defined.
A.8.8 Vulnerability management	Administrator	Track CVEs in dependencies and base images.
A.8.9 Configuration management	Platform + Administrator	Configuration is code; configured values are administrator-owned.
A.8.10 Information deletion	Platform	Cascading deletion on user, workflow, knowledge source.
A.8.11 Data masking	Administrator	Applied at the data-source level if required (e.g. mask PII before upload).
A.8.12 Data leakage prevention	Administrator	Local-first model inference reduces exposure; DLP tooling is administrator-deployed.
A.8.13 Information backup	Administrator	Backup of platform data stores.
A.8.15 Logging	Platform	API logs, run history, audit traces.
A.8.16 Monitoring activities	Administrator	Configure alerts on the metrics that matter.
A.8.17 Clock synchronisation	Administrator	NTP at the host level.
A.8.18 Use of privileged utility programs	Administrator	Restrict CLI access to the cluster.
A.8.19 Installation of software on operational systems	Platform	Application code shipped via signed images; image vetting is administrator-owned.
A.8.20 Network security	Administrator	Secure gateway plus private network; administrator decides firewall and segmentation.
A.8.21 Network services security	Administrator	TLS configuration on the gateway.
A.8.22 Segregation of networks	Administrator	The deployment topology supports per-tier segmentation.
A.8.23 Web filtering	Administrator	Outside platform.
A.8.24 Use of cryptography	Platform + Administrator	TLS at perimeter; encryption at rest is administrator-configured.
A.8.25 Secure development life cycle	Platform	Code reviews, type checks, automated tests.
A.8.26 Application security requirements	Platform	Role-based access, input validation, parameterised queries.
A.8.27 Secure system architecture	Platform	Documented in Platform Overview.
A.8.28 Secure coding	Platform	Strict typing, linters, formatters, validation.
A.8.29 Security testing in development and acceptance	Platform	Unit and end-to-end tests in CI.
A.8.30 Outsourced development	Out of scope	Customer engagement model.
A.8.31 Separation of development, test and production environments	Administrator	Run separate environments per stage.
A.8.32 Change management	Platform	Versioned workflows; explicit publish; per-PR review template.
A.8.33 Test information	Administrator	Decide test data sourcing.
A.8.34 Protection of information systems during audit testing	Administrator	Scope audit access.

ISO 27001 Control Mapping

Organisational controls (Annex A.5)

Control	Coverage	Notes
A.5.7 Threat intelligence	Administrator	Subscribe to relevant threat feeds.
A.5.10 Acceptable use	Administrator	Document in your AUP.
A.5.15 Access control	Platform	Role-based access enforced on every protected route.
A.5.16 Identity management	Platform + Administrator	Identity-provider driven; administrator manages user lifecycle.
A.5.17 Authentication information	Platform	Token-based, no plaintext credentials in the application layer.
A.5.18 Access rights	Platform + Administrator	Administrator assigns roles; platform enforces them.
A.5.23 Cloud services	Administrator	Administrator decides on cloud usage and supplier vetting.

Technological controls (Annex A.8)

Control	Coverage	Notes
A.8.1 User endpoint devices	Out of scope	Endpoint posture is your organisation's policy.
A.8.2 Privileged access rights	Platform + Administrator	The Developer role is the platform's privileged tier; administrator restricts assignment.
A.8.3 Information access restriction	Platform	Role-based access plus ownership checks on every API path.
A.8.5 Secure authentication	Platform	Single sign-on with refresh-token rotation.
A.8.6 Capacity management	Administrator	Dashboards via your monitoring tooling; alerts administrator-defined.
A.8.8 Vulnerability management	Administrator	Track CVEs in dependencies and base images.
A.8.9 Configuration management	Platform + Administrator	Configuration is code; configured values are administrator-owned.
A.8.10 Information deletion	Platform	Cascading deletion on user, workflow, knowledge source.
A.8.11 Data masking	Administrator	Applied at the data-source level if required (e.g. mask PII before upload).
A.8.12 Data leakage prevention	Administrator	Local-first model inference reduces exposure; DLP tooling is administrator-deployed.
A.8.13 Information backup	Administrator	Backup of platform data stores.
A.8.15 Logging	Platform	API logs, run history, audit traces.
A.8.16 Monitoring activities	Administrator	Configure alerts on the metrics that matter.
A.8.17 Clock synchronisation	Administrator	NTP at the host level.
A.8.18 Use of privileged utility programs	Administrator	Restrict CLI access to the cluster.
A.8.19 Installation of software on operational systems	Platform	Application code shipped via signed images; image vetting is administrator-owned.
A.8.20 Network security	Administrator	Secure gateway plus private network; administrator decides firewall and segmentation.
A.8.21 Network services security	Administrator	TLS configuration on the gateway.
A.8.22 Segregation of networks	Administrator	The deployment topology supports per-tier segmentation.
A.8.23 Web filtering	Administrator	Outside platform.
A.8.24 Use of cryptography	Platform + Administrator	TLS at perimeter; encryption at rest is administrator-configured.
A.8.25 Secure development life cycle	Platform	Code reviews, type checks, automated tests.
A.8.26 Application security requirements	Platform	Role-based access, input validation, parameterised queries.
A.8.27 Secure system architecture	Platform	Documented in Platform Overview.
A.8.28 Secure coding	Platform	Strict typing, linters, formatters, validation.
A.8.29 Security testing in development and acceptance	Platform	Unit and end-to-end tests in CI.
A.8.30 Outsourced development	Out of scope	Customer engagement model.
A.8.31 Separation of development, test and production environments	Administrator	Run separate environments per stage.
A.8.32 Change management	Platform	Versioned workflows; explicit publish; per-PR review template.
A.8.33 Test information	Administrator	Decide test data sourcing.
A.8.34 Protection of information systems during audit testing	Administrator	Scope audit access.