ISO 27001 Engineering Controls

ISO 27001 is the international standard for information security management systems (ISMS). Unlike prescriptive frameworks that tell you exactly what to do, ISO 27001 requires you to identify your risks and implement appropriate controls. The engineering challenge is turning 93 Annex A controls into automated, evidence-producing systems.

Annex A Controls to Engineering

A.5 — Organizational Controls (37 controls):
  Engineering mapping:
  ☐ A.5.1: Information security policy → Policy-as-code (OPA)
  ☐ A.5.15: Access control → RBAC, IAM automation
  ☐ A.5.23: Cloud security → Cloud security posture management
  ☐ A.5.28: Evidence collection → Automated compliance reporting

A.6 — People Controls (8 controls):
  Engineering mapping:
  ☐ A.6.1: Screening → Background check automation
  ☐ A.6.3: Security awareness → Phishing simulation platform
  ☐ A.6.5: Employment termination → Automated deprovisioning

A.7 — Physical Controls (14 controls):
  Engineering mapping:
  ☐ A.7.1: Physical security perimeters → Badge access logs
  ☐ A.7.4: Physical security monitoring → CCTV integration
  ☐ A.7.8: Equipment siting → Environmental monitoring (temp, humidity)

A.8 — Technological Controls (34 controls):
  Engineering mapping:
  ☐ A.8.1: User endpoint devices → MDM, endpoint protection
  ☐ A.8.5: Secure authentication → MFA, passwordless
  ☐ A.8.8: Vulnerability management → Automated scanning
  ☐ A.8.9: Configuration management → IaC, drift detection
  ☐ A.8.12: Data leakage prevention → DLP tools, egress filtering
  ☐ A.8.15: Logging → Centralized SIEM, tamper-proof logs
  ☐ A.8.16: Monitoring → Real-time security monitoring
  ☐ A.8.24: Cryptography → Encryption at rest/in transit
  ☐ A.8.25: Secure development → SAST/DAST in CI/CD
  ☐ A.8.28: Secure coding → Code review, dependency scanning

Automated Evidence Collection

class ISO27001EvidenceCollector:
    """Automate evidence collection for ISO 27001 audit."""
    
    def collect_all(self):
        """Generate evidence for all technological controls."""
        return {
            "A.8.5_authentication": self.collect_auth_evidence(),
            "A.8.8_vulnerability_mgmt": self.collect_vuln_evidence(),
            "A.8.9_config_mgmt": self.collect_config_evidence(),
            "A.8.15_logging": self.collect_logging_evidence(),
            "A.8.25_secure_development": self.collect_sdlc_evidence(),
        }
    
    def collect_auth_evidence(self):
        """A.8.5: Secure authentication evidence."""
        return {
            "mfa_coverage": self.iam.get_mfa_stats(),
            # { "total_users": 150, "mfa_enabled": 148, "coverage": "98.7%" }
            "password_policy": self.iam.get_password_policy(),
            # { "min_length": 12, "complexity": true, "max_age": 90 }
            "failed_logins_last_30d": self.siem.query_failed_logins(),
            "admin_access_review_date": self.last_access_review(),
        }
    
    def collect_vuln_evidence(self):
        """A.8.8: Vulnerability management evidence."""
        return {
            "scan_frequency": "weekly",
            "last_scan_date": self.scanner.last_scan(),
            "open_critical": self.scanner.count_by_severity("critical"),
            "mean_time_to_remediate": self.scanner.mttr(),
            "remediation_sla": {
                "critical": "48 hours",
                "high": "7 days",
                "medium": "30 days",
                "low": "90 days",
            },
        }

Anti-Patterns

ISO 27001 is a framework, not a destination. The best implementations treat it as an engineering system — controls are code, evidence is automated, and risk assessment is continuous. The audit becomes a formality because the system produces compliance as a byproduct of good security engineering.