ACSETalk to us
  1. Home
  2. Frameworks
  3. ISO/IEC 27001

ISO/IEC 27001:2022

Annex A in full, with the technical controls checked for you.

ISO/IEC 27001 is mostly about how you run security: policies, people, suppliers and processes. A small set of Annex A controls depends on how your cloud is configured. ACSE lists all 93, checks the technical ones on every scan, and marks the rest as manual so your team can attest them.

Talk to usSee how it works
Controls mapped to checksA layer of framework controls for PCI DSS, NIST, ISO, SOC 2 and CIS sits above the layer of checks that evaluate them; one failing check is traced to the control it affects.PCINISTISOSOC 2CISCONTROLSeach framework versioned and signedCHECKSone check can satisfy many controls
01

A clear line between checked and attested

You see which Annex A controls a check evaluates and which need a person, so nobody assumes coverage that is not there.

02

Technical controls kept current

Configuration, logging, cryptography and access controls are re-evaluated on every scan, not once a year.

03

Evidence for your surveillance audits

Each fix carries its approval, verification and signed record, ready for an auditor to check offline.

Coverage

Annex A controls with a check behind them

ACSE lists every one of the 93 Annex A controls. Most are organizational, people or physical controls that no cloud check can answer, and they show as manual.

AWS
12 of 93 Annex A controls
Google Cloud
8 of 93 Annex A controls
Azure
7 of 93 Annex A controls

What the checks support

The technical controls

01

Access and authentication

Privileged access rights, secure authentication with MFA, and how credentials and keys are managed.

02

Configuration management

Secure settings on storage, compute and networks, re-checked on every scan.

03

Logging and monitoring

Audit trails enabled and protected, flow logs and alarms on sensitive changes.

04

Cryptography and networks

Encryption at rest and in transit, key rotation and network exposure.

Manual controls

Attest what a check cannot see

For a manual control, your team records an attestation with an owner and an expiry. It goes to your tenant’s evidence chain and is sealed like any other record.

Attestations count toward the governed score, which is always labelled with what it includes. The raw score, from checks alone, sits beside it.

The record lives with youRecords for a finding, the proposed fix, the decision, the merge and the verification are chained, each holding the hash of the one before, and written to append-only storage in the customer’s own account.YOUR ACCOUNTobject lock · append-onlyfindingproposaldecisionmergeverifiedeach record holds the hash of the last

Questions

What people ask us

Does ACSE certify us to ISO/IEC 27001?

No. Certification comes from an accredited certification body. ACSE checks the technical controls cloud configuration can speak to and keeps evidence of how findings were fixed.

Why are so many controls manual?

Most of Annex A covers policies, people, suppliers and physical security. ACSE lists those controls so you see the whole picture, and leaves them to your team to attest.

Which edition does ACSE use?

The 2022 edition. Every report names the framework version it was produced under.

Keep reading

Related

Frameworks

SOC 2

ACSE maps cloud checks to the SOC 2 Security, Availability and Confidentiality criteria, and keeps signed evidence of every fix across your observation period.

ReadSolutions

Auditors

Verify ACSE evidence offline with an open verifier and no ACSE account: a signed, hash-chained record of who approved each change and how it was tested.

ReadPlatform

Evidence

ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.

Read

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to usExplore the platform