Definition

ISO/IEC 27001 is the internationally recognized standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), the standard provides a systematic, risk-based approach to managing sensitive company information, ensuring its confidentiality, integrity, and availability. The current version, ISO/IEC 27001:2022, organizes 93 security controls across four themes (organizational, people, physical, and technological) in Annex A, replacing the previous 2013 version's 114 controls across 14 domains.

Certification to ISO 27001 demonstrates to customers, partners, regulators, and stakeholders that an organization follows internationally recognized information security best practices. The certification process involves independent assessment by an accredited certification body that verifies the ISMS meets all standard requirements, controls are implemented effectively, and the organization demonstrates a commitment to continual improvement. Certification is valid for three years, with annual surveillance audits ensuring ongoing compliance.

The standard's risk-based approach distinguishes it from prescriptive security frameworks. Rather than mandating specific technical controls, ISO 27001 requires organizations to identify their information assets, assess threats and vulnerabilities, evaluate risks based on likelihood and impact, and select appropriate controls from Annex A (or alternative control sets) to treat identified risks to an acceptable level. This flexibility makes the standard applicable across industries, organization sizes, and technology stacks -- from startups to multinational enterprises, from on-premises infrastructure to cloud-native platforms.

Overview

ISMS Lifecycle (Plan-Do-Check-Act)

ISO 27001 structures the ISMS around the Plan-Do-Check-Act (PDCA) cycle, ensuring continuous improvement rather than static compliance:

Phase	Activities	Deliverables
Plan	Risk assessment, control selection, policy development, objective setting	Risk treatment plan, Statement of Applicability, ISMS policies
Do	Control implementation, training, awareness programs, incident management	Operational procedures, training records, incident logs
Check	Internal audits, management review, performance monitoring, compliance checking	Audit reports, management review minutes, KPI dashboards
Act	Corrective actions, preventive measures, continual improvement	Corrective action records, improvement plans, updated risk assessments

The PDCA cycle ensures that the ISMS is never treated as a one-time implementation project. Each cycle builds on the previous, incorporating lessons learned from incidents, audit findings, and changing business requirements. This aligns with the Prismatic Platform's own continuous improvement philosophy embodied in the autoheal and autoevolve systems.

Annex A Control Structure (2022 Version)

Theme	Controls	Description	Examples
Organizational	37 controls	Governance, policies, roles, asset management	Information security policies (A.5.1), threat intelligence (A.5.7)
People	8 controls	HR security, awareness, training	Screening (A.6.1), security awareness (A.6.3)
Physical	14 controls	Physical and environmental security	Physical security perimeters (A.7.1), equipment security (A.7.8)
Technological	34 controls	Technical security measures	Access control (A.8.3), cryptography (A.8.24), secure development (A.8.25)

Key Controls in 2022 Revision

The 2022 revision introduced several controls reflecting modern security challenges that are directly relevant to the Prismatic Platform's architecture and operations:

Control	Number	Relevance to Prismatic
Threat intelligence	A.5.7	OSINT collection, HAWKEYE, Prismatic Perimeter
Cloud services security	A.5.23	Fly.io deployment, cloud provider assessment
ICT readiness for business continuity	A.5.30	OTP fault tolerance, supervision trees
Configuration management	A.8.9	Infrastructure as code, Elixir releases
Information deletion	A.8.10	GDPR data retention, privacy compliance
Data masking	A.8.11	OSINT data anonymization
Monitoring activities	A.8.16	Quality Floor Guardian, telemetry
Web filtering	A.8.23	HAWKEYE visitor intelligence
Secure coding	A.8.28	NM/ND doctrine, quality gates, pre-commit hooks

These new controls address modern security challenges -- cloud computing, threat intelligence, secure development -- that were not prominent when the 2013 version was published. The Prismatic Platform's architecture provides native implementations for many of these controls through its OTP-based fault tolerance, OSINT intelligence collection, and zero-warning quality enforcement.

Technical Details

Risk Assessment Methodology

The core of ISO 27001 is its risk assessment process, which systematically identifies and evaluates information security risks. The methodology follows a structured flow from asset identification through risk treatment:

Asset Inventory --> Threat Identification --> Vulnerability Assessment
       |                    |                        |
       v                    v                        v
 Information assets    Threat actors,          Technical and
 (data, systems,      natural events,         organizational
  processes)           human errors            weaknesses
       |                    |                        |
       +--------------------+------------------------+
                            |
                            v
                    Risk Analysis
                    (likelihood x impact)
                            |
                            v
                    Risk Evaluation
                    (compare to acceptance criteria)
                            |
                            v
                    Risk Treatment
                    (mitigate, accept, transfer, avoid)
                            |
                            v
                    Statement of Applicability
                    (selected controls from Annex A)

Risk Treatment Options

Option	Description	When to Use	Example
Mitigate	Implement controls to reduce risk	Most common approach	Deploy WAF, implement MFA
Accept	Acknowledge risk without additional controls	Risk within appetite	Minor configuration finding
Transfer	Shift risk to third party	Insurance, outsourcing	Cyber insurance, managed SOC
Avoid	Eliminate the risk source	Unacceptable risk, feasible elimination	Decommission vulnerable service

Risk Quantification Model

The Prismatic Platform implements a quantitative risk assessment model that maps to ISO 27001 requirements while providing numeric precision for automated decision-making:

defmodule PrismaticPerimeter.RiskAssessment do
  @moduledoc """
  Quantitative risk assessment engine aligned with ISO 27001
  risk assessment methodology. Computes risk scores from
  likelihood and impact assessments across multiple dimensions.
  """

  @type risk_level :: :critical | :high | :medium | :low | :negligible
  @type risk_score :: %{
    likelihood: float(),
    impact: float(),
    composite: float(),
    level: risk_level(),
    treatment: :mitigate | :accept | :transfer | :avoid
  }

  @spec assess_risk(map(), map()) :: {:ok, risk_score()} | {:error, term()}
  def assess_risk(threat, vulnerability) do
    likelihood = compute_likelihood(threat, vulnerability)
    impact = compute_impact(threat)
    composite = likelihood * impact

    level = classify_risk_level(composite)
    treatment = recommend_treatment(level)

    {:ok, %{
      likelihood: likelihood,
      impact: impact,
      composite: composite,
      level: level,
      treatment: treatment
    }}
  end

  @spec classify_risk_level(float()) :: risk_level()
  defp classify_risk_level(score) when score >= 0.8, do: :critical
  defp classify_risk_level(score) when score >= 0.6, do: :high
  defp classify_risk_level(score) when score >= 0.4, do: :medium
  defp classify_risk_level(score) when score >= 0.2, do: :low
  defp classify_risk_level(_score), do: :negligible

  @spec recommend_treatment(risk_level()) :: atom()
  defp recommend_treatment(:critical), do: :mitigate
  defp recommend_treatment(:high), do: :mitigate
  defp recommend_treatment(:medium), do: :mitigate
  defp recommend_treatment(:low), do: :accept
  defp recommend_treatment(:negligible), do: :accept
end

Mandatory Documentation

ISO 27001 requires specific documented information, which maps to platform artifacts:

Required Document	ISO Clause	Prismatic Equivalent
ISMS scope	4.3	Platform architecture documentation
Information security policy	5.2	NM/ND doctrine, AIAD policies
Risk assessment process	6.1.2	NABLA confidence scoring, Trinity Gate
Risk treatment plan	6.1.3	Quality gates, violation protocol
Statement of Applicability	6.1.3d	Security control matrix
Information security objectives	6.2	Quality score targets (100/100)
Competence evidence	7.2	Agent specifications, AIAD registry
Operational planning and control	8.1	CI/CD pipeline, pre-commit hooks
Risk assessment results	8.2	Security rating computations
Internal audit results	9.2	Quality DNA reports, session context
Management review results	9.3	ARCHER Supreme analysis reports
Corrective actions	10.1	Autoheal cycles, QDP elimination records

Implementation in Prismatic Platform

The Prismatic Platform's architecture aligns with ISO 27001 control objectives through its native security infrastructure:

defmodule PrismaticPerimeter.ComplianceAssessor do
  @moduledoc """
  ISO 27001 compliance assessment engine for evaluating
  organizational security posture against Annex A controls.
  Supports both self-assessment and third-party evaluation workflows.
  """

  @annex_a_themes [:organizational, :people, :physical, :technological]

  @type assessment_result :: %{
    organization: String.t(),
    standard: :iso_27001_2022,
    overall_score: float(),
    theme_scores: map(),
    control_findings: list(map()),
    assessed_at: DateTime.t()
  }

  @spec assess_compliance(String.t(), keyword()) ::
    {:ok, assessment_result()} | {:error, term()}
  def assess_compliance(organization, opts \\ []) do
    controls = Keyword.get(opts, :controls, all_annex_a_controls())

    findings =
      controls
      |> Enum.map(&assess_control(organization, &1))
      |> Enum.group_by(& &1.theme)

    theme_scores =
      Enum.map(@annex_a_themes, fn theme ->
        theme_findings = Map.get(findings, theme, [])
        score = compute_theme_score(theme_findings)
        {theme, score}
      end)
      |> Map.new()

    result = %{
      organization: organization,
      standard: :iso_27001_2022,
      overall_score: compute_overall_score(theme_scores),
      theme_scores: theme_scores,
      control_findings: List.flatten(Map.values(findings)),
      assessed_at: DateTime.utc_now()
    }

    {:ok, result}
  end

  @spec assess_control(String.t(), map()) :: map()
  defp assess_control(organization, control) do
    %{
      control_id: control.id,
      theme: control.theme,
      title: control.title,
      status: evaluate_control_status(organization, control),
      evidence: collect_control_evidence(organization, control),
      confidence: compute_assessment_confidence(organization, control)
    }
  end
end

Control Mapping to Platform Features

defmodule PrismaticPerimeter.ISO27001Mapping do
  @moduledoc """
  Maps ISO 27001:2022 Annex A controls to Prismatic Platform
  features and enforcement mechanisms. Provides traceability
  from standard requirements to implementation.
  """

  @type control_mapping :: %{
    title: String.t(),
    platform_feature: String.t(),
    enforcement: String.t(),
    evidence_source: String.t()
  }

  @spec get_mapping(String.t()) :: {:ok, control_mapping()} | {:error, :not_found}
  def get_mapping(control_id) do
    case Map.get(control_map(), control_id) do
      nil -> {:error, :not_found}
      mapping -> {:ok, mapping}
    end
  end

  @spec control_map() :: %{String.t() => control_mapping()}
  defp control_map do
    %{
      "A.5.1" => %{
        title: "Policies for information security",
        platform_feature: "NM/ND Doctrine + AIAD Policies",
        enforcement: "Mandatory enforcement blocks in all agents",
        evidence_source: ".aiad/policies/"
      },
      "A.5.7" => %{
        title: "Threat intelligence",
        platform_feature: "HAWKEYE + OSINT + GARDEN (250+ providers)",
        enforcement: "NABLA Signal Plurality for all intelligence products",
        evidence_source: "prismatic_osint_*"
      },
      "A.8.24" => %{
        title: "Use of cryptography",
        platform_feature: "Cloak.Ecto field encryption + TLS 1.3",
        enforcement: "Mandatory encryption for PII and credentials",
        evidence_source: "prismatic_storage_core"
      },
      "A.8.25" => %{
        title: "Secure development lifecycle",
        platform_feature: "Quality Gates + Pre-commit hooks + CI/CD",
        enforcement: "13 quality domains, 100/100 score requirement",
        evidence_source: "prismatic_safety"
      },
      "A.8.28" => %{
        title: "Secure coding",
        platform_feature: "Credo + Dialyzer + Zero-warning policy",
        enforcement: "Compilation blocked on any warning or violation",
        evidence_source: ".githooks/pre-commit"
      }
    }
  end
end

Certification Process

The ISO 27001 certification journey follows a structured path from initial gap analysis through ongoing surveillance:

Stage	Activity	Duration	Deliverable
Gap Analysis	Assess current state against ISO 27001 requirements	2-4 weeks	Gap assessment report
ISMS Design	Design risk assessment methodology, policies, controls	4-8 weeks	ISMS documentation
Implementation	Implement controls, train staff, establish processes	8-16 weeks	Operational ISMS
Internal Audit	Independent internal review of ISMS effectiveness	2-4 weeks	Internal audit report
Management Review	Senior management reviews ISMS performance	1-2 days	Management review minutes
Stage 1 Audit	Certification body reviews documentation	2-3 days	Stage 1 findings
Stage 2 Audit	Certification body verifies implementation	3-5 days	Certification decision
Surveillance Audits	Annual reviews of continued compliance	2-3 days/year	Surveillance reports
Recertification	Full re-assessment every 3 years	3-5 days	New certificate

Comparison with Alternatives

Standard	ISO 27001	SOC 2	NIST CSF	CIS Controls	NIS2
Scope	Global, all industries	US-focused, service organizations	US government, voluntary	Technical controls	EU critical infrastructure
Certification	Third-party audit	CPA attestation	Self-assessment	Self-assessment	Regulatory compliance
Approach	Risk-based ISMS	Trust service criteria	Framework-based	Prescriptive controls	Directive-based
Controls	93 (Annex A)	5 categories	6 functions	18 control groups	Article requirements
Flexibility	High (risk-based selection)	Moderate	High (framework)	Low (prescriptive)	Moderate
Cost	Moderate-High	High	Low (self-assessment)	Low	Varies by member state
Recognition	International	North America	US government	Technical community	EU regulatory

Best Practices

Start with Risk Assessment: Do not begin implementing controls until you understand your risk landscape. The risk assessment drives control selection -- implementing controls without risk context leads to gaps in high-risk areas and over-investment in low-risk areas. The Prismatic Platform's NABLA framework provides the epistemic foundation for evidence-based risk assessment.

Integrate with Existing Processes: Map ISO 27001 requirements to existing platform practices rather than creating parallel compliance structures. The Prismatic Platform's quality gates, pre-commit hooks, and CI/CD pipeline already implement many Annex A controls -- document this alignment rather than duplicating effort.

Automate Evidence Collection: Manual evidence gathering for audits is unsustainable. Use telemetry, Quality DNA persistence, and automated reporting to continuously collect compliance evidence. The platform's observability infrastructure provides most required audit evidence automatically through structured logging and metrics.

Treat the ISMS as Living Documentation: ISO 27001 requires continual improvement, not static compliance. Update risk assessments when the threat landscape changes, add controls when new vulnerabilities are discovered, and retire controls when risks are eliminated.

Align Security Objectives with Business Objectives: The ISMS exists to protect business value, not to satisfy auditors. Frame security objectives (100/100 quality score, zero QDP) in terms of their business impact (reliability, customer trust, regulatory compliance).

Leverage Annex A as Guidance, Not Gospel: The 93 controls in Annex A are a reference set, not a mandatory checklist. The Statement of Applicability should document which controls are selected (with justification) and which are excluded (with rationale). Excluding a control is acceptable when the associated risk is accepted.

Use Cases

Security Rating Assessment: Prismatic Perimeter evaluates monitored organizations' alignment with ISO 27001 control objectives through observable security indicators, contributing to security rating computations (A-F grades with 300-900 numeric scores). Organizations with visible ISO 27001-aligned practices score higher in the Perimeter's security rating system.

Supply Chain Risk Management: ISO 27001 certification status of third parties informs supply chain risk assessments. Organizations with certified ISMS demonstrate lower risk profiles in the platform's vendor assessment workflows.

NIS2 Compliance Baseline: The EU NIS2 Directive references ISO 27001 as a recognized baseline for cybersecurity risk management. Organizations certified to ISO 27001 satisfy significant portions of NIS2 Article 21 requirements, reducing the compliance burden for essential and important entities.

Platform Security Governance: The Prismatic Platform's own security practices (NM/ND doctrine, quality gates, pre-commit hooks, CI/CD enforcement) map to ISO 27001 controls, demonstrating security-by-design alignment with international standards.

Customer Assurance: ISO 27001 certification provides verifiable assurance to platform users that their data and interactions are protected by internationally recognized security management practices.

Common Pitfalls

Paper Compliance: Creating documentation that describes ideal security practices without actually implementing them. Certification bodies specifically test for implementation evidence during Stage 2 audits. The gap between documented policy and operational reality is the most common audit failure.

Treating Certification as Destination: Organizations that view certification as a project endpoint rather than an ongoing commitment lose the continuous improvement benefits. The PDCA cycle requires active iteration between audit cycles, not dormancy between surveillance visits.

Ignoring Organizational Controls: Focusing solely on technological controls (A.8) while neglecting organizational (A.5), people (A.6), and physical (A.7) controls. Security is not purely a technology problem -- the majority of breaches involve human factors.

Over-Scoping the ISMS: Including the entire organization in the ISMS scope when a focused scope on critical business processes would be more effective and achievable. Start with a manageable scope and expand iteratively.

Compliance Framework - ISO 27001 as a foundational compliance framework
GDPR - Data protection regulation complemented by ISO 27001 controls
NIS2 - EU directive referencing ISO 27001 as a compliance baseline
Security Rating - External assessment of ISO 27001-aligned practices
Vulnerability Assessment - Technical control evaluation supporting ISMS risk assessment
OWASP - Application security standards complementing ISO 27001 technical controls
Encryption at Rest - Cryptographic control implementing A.8.24
Quality Gates - Automated enforcement implementing secure development controls
Attack Surface - Asset exposure assessment feeding ISO 27001 risk analysis
Metrics - Performance measurement supporting ISMS monitoring requirements

Connect & Contribute

Created by Tomas Korcak (korczis) | Open Source under GHL

GitHub | GitLab | LinkedIn | Contact
Developer Portal | Architecture | Meet the Creator

ISO 27001

Definition

Overview

ISMS Lifecycle (Plan-Do-Check-Act)

Annex A Control Structure (2022 Version)

Key Controls in 2022 Revision

Technical Details

Risk Assessment Methodology

Risk Treatment Options

Risk Quantification Model

Mandatory Documentation

Implementation in Prismatic Platform

Control Mapping to Platform Features

Certification Process

Comparison with Alternatives

Best Practices

Use Cases

Common Pitfalls

See Also

Connect & Contribute

Glossary

Related Terms

ISO 27001

Definition

Overview

ISMS Lifecycle (Plan-Do-Check-Act)

Annex A Control Structure (2022 Version)

Key Controls in 2022 Revision

Technical Details

Risk Assessment Methodology

Risk Treatment Options

Risk Quantification Model

Mandatory Documentation

Implementation in Prismatic Platform

Control Mapping to Platform Features

Certification Process

Comparison with Alternatives

Best Practices

Use Cases

Common Pitfalls

Related Concepts

See Also

Connect & Contribute

Glossary

Related Terms