iso27001-compliance – Security skill for AI agents

ISO 27001 Compliance

Implement an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022.

When to Use

• Establishing an ISMS for the first time in an organization
• Preparing for ISO 27001 certification audit
• Conducting risk assessments and developing risk treatment plans
• Creating the Statement of Applicability (SoA)
• Transitioning from ISO 27001:2013 to the 2022 revision
• Meeting customer or regulatory requirements for ISO 27001 certification

This is a planning subset for ISO/IEC 27001:2022, not a complete normative control list or certification decision. Confirm the applicable edition/amendments, scope and accredited certification process using the organization’s licensed standard. The public ISO page lists an amendment; no full licensed standard was reviewed here. Cadences, monetary risk bands, remediation deadlines and evidence durations below are illustrative organization policies, not universal ISO mandates.

ISMS Plan-Do-Check-Act Cycle

pdca_cycle:
  plan:
    - Define ISMS scope and boundaries
    - Establish information security policy
    - Conduct risk assessment
    - Develop risk treatment plan
    - Produce Statement of Applicability
    - Obtain management approval and commitment
    - Define security objectives and metrics

  do:
    - Implement selected Annex A controls
    - Deploy technical security controls
    - Conduct security awareness training
    - Document all procedures and processes
    - Implement incident management process
    - Establish supplier security management

  check:
    - Conduct internal audits at planned, risk-based intervals
    - Perform management review meetings
    - Monitor and measure control effectiveness
    - Review incident trends and near misses
    - Assess compliance with legal requirements
    - Evaluate security metrics against objectives

  act:
    - Address nonconformities with corrective actions
    - Implement continual improvement initiatives
    - Update risk assessment based on changes
    - Refine controls based on audit findings
    - Communicate improvements to stakeholders

ISMS Scope Definition

isms_scope:
  template:
    organization: "Company Name, Ltd."
    scope_statement: |
      The ISMS covers the design, development, operation, and support of
      the Company's cloud-based SaaS platform, including all supporting
      infrastructure, personnel, and processes at the following locations.

    included:
      locations:
        - "Primary office: 123 Main Street, City, Country"
        - "AWS us-east-1 and eu-west-1 regions"
        - "Remote workers accessing corporate systems"
      business_processes:
        - "Software development and deployment"
        - "Cloud infrastructure management"
        - "Customer data processing and storage"
        - "Customer support operations"
        - "Corporate IT and internal systems"
      information_assets:
        - "Customer data (PII, business data)"
        - "Source code and intellectual property"
        - "Employee personal data"
        - "Financial records"
        - "Security configurations and credentials"
      technology:
        - "AWS cloud infrastructure"
        - "SaaS application stack"
        - "Corporate IT systems (Google Workspace, Okta, Jira)"
        - "Development tools (GitHub, CI/CD pipelines)"

    excluded:
      - "Physical data center operations (inherited from AWS)"
      - "Third-party SaaS platforms beyond integration points"
    exclusion_justification: "Assess dependencies and provider assurance; outsourcing does not remove the organization’s responsibility for information security or physical controls at its own premises."

    interfaces:
      - "Customer API endpoints"
      - "Third-party integrations (payment processor, email provider)"
      - "AWS management plane"

Risk Assessment Process

risk_assessment:
  methodology:
    approach: "Asset-based risk assessment"
    risk_formula: "Risk = Likelihood x Impact"
    scale: "1-5 for both likelihood and impact (total 1-25)"

  likelihood_scale:
    1: "Rare - less than once per 5 years"
    2: "Unlikely - once per 2-5 years"
    3: "Possible - once per 1-2 years"
    4: "Likely - multiple times per year"
    5: "Almost Certain - monthly or more frequent"

  impact_scale:
    1: "Negligible - minimal operational impact, no data loss"
    2: "Minor - limited impact, small data exposure, <$10K cost"
    3: "Moderate - significant impact, data breach <1K records, <$100K cost"
    4: "Major - severe impact, large data breach, <$1M cost, regulatory action"
    5: "Critical - catastrophic, massive breach, >$1M cost, business viability at risk"

  risk_matrix:
    #        Impact: 1    2    3    4    5
    likelihood_5:  [5,  10,  15,  20,  25]
    likelihood_4:  [4,   8,  12,  16,  20]
    likelihood_3:  [3,   6,   9,  12,  15]
    likelihood_2:  [2,   4,   6,   8,  10]
    likelihood_1:  [1,   2,   3,   4,   5]

  risk_appetite:
    accept: "Score 1-4 (low risk, accept with monitoring)"
    mitigate: "Score 5-14 (medium risk, implement controls to reduce)"
    escalate: "Score 15-25 (high/critical risk, immediate action required)"

  treatment_options:
    mitigate: "Implement controls to reduce likelihood or impact"
    transfer: "Insurance or contractual transfer to third party"
    avoid: "Eliminate the risk by removing the activity or asset"
    accept: "Accept with documented management approval"

  example_risk_register:
    - id: "RISK-001"
      asset: "Customer database"
      threat: "SQL injection attack"
      vulnerability: "Insufficient input validation"
      likelihood: 3
      impact: 4
      inherent_risk: 12
      treatment: "mitigate"
      controls: ["A.8.28 Secure coding", "A.8.8 Vulnerability management"]
      residual_likelihood: 1
      residual_impact: 4
      residual_risk: 4
      risk_owner: "CTO"

    - id: "RISK-002"
      asset: "Source code repository"
      threat: "Insider theft of intellectual property"
      vulnerability: "Excessive access permissions"
      likelihood: 2
      impact: 5
      inherent_risk: 10
      treatment: "mitigate"
      controls: ["A.5.15 Access control", "A.8.3 Information access restriction"]
      residual_likelihood: 1
      residual_impact: 5
      residual_risk: 5
      risk_owner: "VP Engineering"

    - id: "RISK-003"
      asset: "Cloud infrastructure"
      threat: "Cloud provider outage"
      vulnerability: "Single-region deployment"
      likelihood: 3
      impact: 3
      inherent_risk: 9
      treatment: "mitigate"
      controls: ["A.5.30 ICT readiness for business continuity", "A.8.14 Redundancy"]
      residual_likelihood: 3
      residual_impact: 2
      residual_risk: 6
      risk_owner: "Head of Infrastructure"

For the synthetic SQL-injection risk, input validation alone is insufficient: use parameterized queries, least privilege and testing. Residual scores are assumptions until the treatment is implemented and assessed; a lower number is not proof of effective control. Risk transfer does not transfer all accountability.

Statement of Applicability (SoA)

# ISO 27001:2022 Annex A Controls - Statement of Applicability
soa_template:
  organizational_controls_5:
    "A.5.1":
      control: "Policies for information security"
      applicable: true
      justification: "Required to establish security governance"
      implementation: "Information security policy approved by CEO, reviewed annually"

    "A.5.2":
      control: "Information security roles and responsibilities"
      applicable: true
      justification: "Required for accountability"
      implementation: "RACI matrix for security responsibilities, CISO appointed"

    "A.5.7":
      control: "Threat intelligence"
      applicable: true
      justification: "Required for proactive threat management"
      implementation: "Subscribe to threat feeds, CVE monitoring, vendor advisories"

    "A.5.15":
      control: "Access control"
      applicable: true
      justification: "Required for data protection"
      implementation: "RBAC via Okta, least-privilege IAM policies, quarterly access reviews"

    "A.5.23":
      control: "Information security for use of cloud services"
      applicable: true
      justification: "Primary infrastructure is cloud-based"
      implementation: "AWS security baseline, CSP shared responsibility documented"

    "A.5.29":
      control: "Information security during disruption"
      applicable: true
      justification: "Business continuity requirement"
      implementation: "BCP/DR plans tested annually, multi-AZ deployment"

    "A.5.30":
      control: "ICT readiness for business continuity"
      applicable: true
      justification: "Ensure technology supports continuity"
      implementation: "DR runbooks, RTO/RPO defined, failover tested quarterly"

  people_controls_6:
    "A.6.1":
      control: "Screening"
      applicable: true
      impl

… (full content is in the download package)