Tag
ISO 27001
66 articles
Compliance frameworks
Corrective actions that close ISO 27001 findings
How to answer an ISO 27001 nonconformity so it closes: correction versus corrective action, a cause analysis that holds, and proof the fix worked.
6 min read
Security engineering
Cloud security posture on AWS
The AWS posture controls auditors test first: account structure, root and human access, logging, guardrails and data exposure, and the evidence each yields.
6 min read
Audit readiness
Running a mock audit
A mock audit tests whether you can produce evidence under audit conditions. Who should play the auditor, what to scope, how to run it, and how to use findings.
6 min read
Security engineering
Key management and rotation
How key hierarchies, separation of duties, rotation and key deletion work in a cloud KMS, what PCI DSS and ISO 27001 expect, and the evidence auditors test.
6 min read
Compliance frameworks
Major vs minor nonconformities in ISO 27001
Where the major and minor grades come from, what pushes a finding into each, what each means for your certificate, and how to keep a stage 2 free of majors.
6 min read
Audit readiness
An audit readiness checklist
A working checklist for the weeks before an audit: scope, documents, owners, populations, people, vendors and logistics, with what each item must show.
6 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Compliance frameworks
Mapping NIST CSF to ISO 27001
How NIST CSF 2.0 functions map to ISO 27001:2022 clauses and Annex A controls, where the mapping breaks down, and how one evidence set serves both.
6 min read
Compliance frameworks
ISO 27001 vs ISO 27002: what each document does
ISO 27001 sets the requirements you are certified against. ISO 27002 explains how to implement each control. How the two fit, and when to reach for each.
6 min read
Audit readiness
Assigning control owners who stay engaged
Naming a control owner takes a minute; keeping them engaged for an audit period is the real work. How to pick owners, define the role, and survive handovers.
6 min read
Security engineering
Secrets management for engineering teams
Where application secrets should live, how to retire long-lived credentials, what to do in the first hour after a leak, and the evidence auditors ask for.
6 min read
Risk and vendors
ISO 27005 risk management
What ISO/IEC 27005 is, how it supports ISO 27001 clause 6, and how to use its event-based and asset-based approaches to build a risk method you can defend.
6 min read
Compliance frameworks
ISO 27001 for startups: a realistic first certification
What a small team needs for a first ISO 27001 certificate: a defensible scope, a working ISMS, the records auditors check, and the order to build it.
6 min read
Security engineering
Branch protection rules auditors look for
The branch protection settings that make code review a testable control, the bypass paths auditors probe, and the evidence that proves it held all period.
7 min read
Security engineering
Code review as a change management control
For most software teams, the pull request review is the change approval. What it must establish, which changes it must cover, and how auditors sample it.
6 min read
Compliance frameworks
Building an ISO 27001 risk treatment plan
What an ISO 27001 risk treatment plan must do, the fields each entry needs, how owner approval and residual risk acceptance work, and how to keep it live.
6 min read
Risk and vendors
Managing SaaS sprawl
How to find the SaaS apps your teams already use, triage them into an owned inventory, retire the extras, and stop new sprawl without blocking the business.
6 min read
Security engineering
Business continuity and disaster recovery plans
Continuity keeps the business running; recovery restores the technology. How to run an impact analysis, map dependencies, write both plans, and test them.
6 min read
Compliance frameworks
Writing an ISO 27001 scope statement
How to set ISO 27001 scope boundaries, write a scope statement your auditor and buyers can read, handle interfaces and dependencies, and avoid weak scopes.
6 min read
Security engineering
Backup and restore testing
A backup is only a control once you have restored from it. What to back up, how to keep backups out of an incident's reach, and how to run and record restores.
6 min read
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read
Audit readiness
Continuous monitoring vs point-in-time audits
What an audit covers that monitoring cannot, what monitoring catches that an audit finds too late, and how auditors treat the output of your monitoring.
6 min read
Compliance frameworks
Accredited certification bodies and why accreditation matters
How accreditation of ISO 27001 certification bodies works, what it does and does not guarantee, how to verify a certificate, and how to choose a body.
6 min read
Security engineering
Running a tabletop exercise
A tabletop exercise is how most teams test an incident response plan. How to set objectives, write injects, run the session, and produce a report that counts.
6 min read