ISO 27001 Compliance
ISO 27001:2022 is the international standard for information security management systems (ISMS). Cloudgeni helps you implement, monitor, and maintain ISO 27001 controls across your cloud infrastructure.ISO 27001 Coverage
- 93 controls from Annex A mapped to cloud configurations
- AWS, Azure, and GCP coverage
- Continuous monitoring for control effectiveness
- Statement of Applicability support
Annex A Control Domains
A.5 - Organizational Controls
Policies and procedures for information security management.| Control | Description | Cloud Mapping |
|---|---|---|
| A.5.1 | Policies for information security | Documented policies, SCPs |
| A.5.2 | Information security roles | IAM roles and responsibilities |
| A.5.3 | Segregation of duties | Role separation, least privilege |
| A.5.4 | Management responsibilities | Governance structures |
| A.5.7 | Threat intelligence | Security Hub, Defender, SCC |
| A.5.8 | Information security in projects | Security by design |
A.6 - People Controls
Human resource security throughout employment.| Control | Description | Cloud Mapping |
|---|---|---|
| A.6.1 | Screening | Background checks (external) |
| A.6.2 | Terms of employment | Access agreements |
| A.6.3 | Security awareness | Training programs |
| A.6.4 | Disciplinary process | Policy enforcement |
| A.6.5 | Post-employment | Access revocation |
A.7 - Physical Controls
Physical security of facilities and equipment.| Control | Description | Cloud Mapping |
|---|---|---|
| A.7.1 | Physical security perimeters | Cloud provider responsibility |
| A.7.2 | Physical entry | Cloud provider + console access |
| A.7.3 | Securing offices | Cloud provider responsibility |
| A.7.4 | Physical security monitoring | CloudTrail, Activity Logs |
| A.7.5 | Protecting against threats | Multi-region, backups |
A.8 - Technological Controls
Technical security controls for systems and networks.| Control | Description | Cloud Mapping |
|---|---|---|
| A.8.1 | User endpoint devices | Conditional access, MDM |
| A.8.2 | Privileged access rights | IAM, PIM, least privilege |
| A.8.3 | Information access restriction | RBAC, resource policies |
| A.8.4 | Access to source code | Repository permissions |
| A.8.5 | Secure authentication | MFA, strong passwords |
| A.8.6 | Capacity management | Auto-scaling, monitoring |
| A.8.7 | Malware protection | GuardDuty, Defender |
| A.8.8 | Technical vulnerabilities | Patching, scanning |
| A.8.9 | Configuration management | Config rules, policies |
| A.8.10 | Information deletion | Data lifecycle, retention |
| A.8.11 | Data masking | Encryption, tokenization |
| A.8.12 | Data leakage prevention | DLP policies, Macie |
| A.8.13 | Information backup | Backup policies, snapshots |
| A.8.14 | Redundancy | Multi-AZ, replication |
| A.8.15 | Logging | CloudTrail, CloudWatch |
| A.8.16 | Monitoring activities | SIEM, alerting |
| A.8.17 | Clock synchronization | NTP, time services |
| A.8.18 | Privileged utility programs | Bastion hosts, SSM |
| A.8.19 | Software installation | Change management |
| A.8.20 | Networks security | VPCs, security groups |
| A.8.21 | Web services security | WAF, API Gateway |
| A.8.22 | Segregation of networks | Subnets, VNet peering |
| A.8.23 | Web filtering | DNS filtering, proxies |
| A.8.24 | Cryptography | KMS, encryption at rest |
| A.8.25 | Secure development | CI/CD security, SAST |
| A.8.26 | Security requirements | Security in SDLC |
| A.8.27 | Secure architecture | Reference architectures |
| A.8.28 | Secure coding | Code scanning, reviews |
| A.8.29 | Security testing | Penetration testing |
| A.8.30 | Outsourced development | Third-party security |
| A.8.31 | Separation of environments | Dev/staging/prod |
| A.8.32 | Change management | Change tracking, approval |
| A.8.33 | Test information | Data sanitization |
| A.8.34 | Audit system protection | Log integrity, WORM |
Control Mapping to Cloud Services
AWS Control Mapping
| Annex A Control | AWS Service | Cloudgeni Check |
|---|---|---|
| A.5.1 Policies | Service Control Policies | iso27001_a5_1_scp |
| A.8.2 Privileged access | IAM, Organizations | iso27001_a8_2_iam |
| A.8.5 Authentication | IAM MFA, Cognito | iso27001_a8_5_mfa |
| A.8.7 Malware | GuardDuty | iso27001_a8_7_guardduty |
| A.8.9 Configuration | AWS Config | iso27001_a8_9_config |
| A.8.15 Logging | CloudTrail | iso27001_a8_15_cloudtrail |
| A.8.20 Network | VPC, Security Groups | iso27001_a8_20_vpc |
| A.8.24 Cryptography | KMS, ACM | iso27001_a8_24_kms |
Azure Control Mapping
| Annex A Control | Azure Service | Cloudgeni Check |
|---|---|---|
| A.5.1 Policies | Azure Policy | iso27001_a5_1_policy |
| A.8.2 Privileged access | PIM, RBAC | iso27001_a8_2_pim |
| A.8.5 Authentication | Conditional Access | iso27001_a8_5_ca |
| A.8.7 Malware | Defender | iso27001_a8_7_defender |
| A.8.9 Configuration | Azure Policy | iso27001_a8_9_policy |
| A.8.15 Logging | Activity Log | iso27001_a8_15_activitylog |
| A.8.20 Network | VNet, NSG | iso27001_a8_20_vnet |
| A.8.24 Cryptography | Key Vault | iso27001_a8_24_keyvault |
GCP Control Mapping
| Annex A Control | GCP Service | Cloudgeni Check |
|---|---|---|
| A.5.1 Policies | Organization Policies | iso27001_a5_1_orgpolicy |
| A.8.2 Privileged access | IAM | iso27001_a8_2_iam |
| A.8.5 Authentication | Identity Platform | iso27001_a8_5_identity |
| A.8.7 Malware | Security Command Center | iso27001_a8_7_scc |
| A.8.9 Configuration | Cloud Asset Inventory | iso27001_a8_9_cai |
| A.8.15 Logging | Cloud Logging | iso27001_a8_15_logging |
| A.8.20 Network | VPC, Firewall Rules | iso27001_a8_20_vpc |
| A.8.24 Cryptography | Cloud KMS | iso27001_a8_24_kms |
Implementation Guide
Phase 1: Gap Assessment
-
Run ISO 27001 Assessment
- Go to Compliance → ISO 27001
- Click Run Assessment
- Review control coverage
-
Identify Gaps
- Filter by failed controls
- Prioritize by impact
- Document exceptions
Phase 2: Statement of Applicability
Document which controls apply to your organization:| Control | Applicable | Justification |
|---|---|---|
| A.8.1 Endpoints | Yes | Remote workforce |
| A.7.1 Physical | No | Cloud-only infrastructure |
| A.8.24 Cryptography | Yes | PII data processing |
Phase 3: Control Implementation
For each applicable control:- Review current state in Cloudgeni
- Generate remediation code
- Apply through pull request
- Verify with re-scan
Phase 4: Continuous Monitoring
- Enable real-time compliance monitoring
- Set up alerts for control failures
- Track compliance score trends
- Regular management reviews
Certification Preparation
Documentation Requirements
| Document | Cloudgeni Support |
|---|---|
| ISMS Scope | Dashboard overview |
| Risk Assessment | Finding analysis |
| Statement of Applicability | Control coverage report |
| Security Policies | Policy documentation |
| Control Evidence | Automated evidence collection |
Audit Evidence
Cloudgeni provides:- Configuration evidence - Point-in-time snapshots
- Change history - Who changed what, when
- Compliance trends - Historical compliance data
- Remediation records - Fix timelines and PRs
Certification Audit
-
Stage 1 Audit - Documentation review
- Export ISMS documentation
- Provide Statement of Applicability
- Show policy implementation
-
Stage 2 Audit - Implementation review
- Demonstrate control effectiveness
- Show continuous monitoring
- Provide evidence samples
Maintenance
Surveillance Audits
After certification, maintain compliance:- Annual surveillance audits - Partial control review
- Re-certification - Full audit every 3 years
- Continuous improvement - Address findings promptly
Change Management
When infrastructure changes:- Assess impact on controls
- Update documentation
- Verify compliance maintained
- Document changes