ISO/IEC 27001¶

What it is¶

ISO/IEC 27001:2022 is a standard for an information security management system: the clauses a management system has to run, and the Annex A security controls. Opencomplai carries it as the native target ISO_IEC_27001, with 118 requirement rows. The standard's text is not reproduced here; each row has an id and a note in this project's own words on the evidence we look for.

Does it apply to you¶

Nothing in law applies it. It is voluntary unless a customer contract, a plan to seek a certificate or an internal policy commits you to it. Four manifest answers shape the scope: whether you are committed to it, control premises, develop software, and have staff beyond the founders. A row that does not fit your answers is listed as excluded, with the reason, and is not scored.

How rows are decided¶

Every row has an evidence class. Of the 118 rows, 0 are machine, 43 are hybrid and 75 are organisational. So 43 of 118 requirements are checked from evidence (a draft estimate; target 34, floor 28). A hybrid row reads a file or code convention in your repository and also takes an attestation. An organisational row takes an attestation only.

Each row ends as Met, Partial, Missing or Unverified. Evidence found gives Met, Partial or Missing; a row with no evidence and no attestation reads Unverified.

Requirements¶

The table is generated from requirements.json by tools/packs/pack_doc.py. A row marked mapping not yet reviewed has a mapping that no reviewer has confirmed yet.

Scaffolds¶

opencomplai scaffold writes three starting documents: a statement of applicability, an information security policy set and a risk treatment plan. A scaffold is a prompt to fill in. An unfilled scaffold does not count as evidence.

Timeline¶

None. This is a standard without legal application dates.

Gate in CI¶

opencomplai check --target ISO_IEC_27001 --gate ISO_IEC_27001 --gate-fail-on missing --repo-root .

The command exits 1 when any in-scope row is Missing, and lists the requirement ids.

What stays attested and why¶

The organisational rows, and the human half of the hybrid rows, stay attested: they concern decisions, reviews and records that a repository scan cannot see. Access, identity and device rows wait for integrations that are not part of this release, so they stay attested until then.

Review status¶

The pack status is evaluated, set by the parity check. Every mapping is still flagged mapping not yet reviewed; no flag has been cleared.

Disclaimer¶

This page and the pack describe what evidence the tool found. They are not a certification, a legal assessment or a statement that your organisation meets the standard.