<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-iso-27001-compliance
description: >-
  Audit ISO 27001:2022 ISMS requirements and Annex A controls. Automate
  assessment of 93 controls across 4 themes with InSpec profiles, OPA policies,
  and Statement of Applicability generation.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - iso-27001
  - iso-27002
  - isms
  - annex-a
  - certification
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing ISO 27001 Compliance

## Overview

ISO 27001:2022 defines requirements for an Information Security Management System
(ISMS) with 93 Annex A controls organized into 4 themes. This skill automates
control assessment, produces Statement of Applicability (SoA), and validates
technical controls via InSpec and OPA.

Mode: `[MODE: ARCHITECT]` — ISMS design; `[MODE: BLUE]` — Control assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| InSpec (`gem install inspec`) | Required |
| OPA (`brew install opa`) | Required |
| Document management system for ISMS policies | Required |

## Key Concepts

### Annex A Control Themes (ISO 27001:2022)

```
93 Annex A Controls — 4 Themes:
├── A.5 Organizational Controls (37 controls)
│   ├── A.5.1  Policies for information security
│   ├── A.5.2  Information security roles and responsibilities
│   ├── A.5.3  Segregation of duties
│   ├── A.5.7  Threat intelligence
│   ├── A.5.8  Information security in project management
│   ├── A.5.15 Access control
│   ├── A.5.23 Information security for cloud services
│   └── A.5.29-A.5.30 Business continuity (ICT readiness)
├── A.6 People Controls (8 controls)
│   ├── A.6.1  Screening
│   ├── A.6.2  Terms and conditions of employment
│   ├── A.6.3  Information security awareness and training
│   └── A.6.5  Responsibilities after termination
├── A.7 Physical Controls (14 controls)
│   ├── A.7.1  Physical security perimeters
│   ├── A.7.4  Physical security monitoring
│   └── A.7.10 Storage media
└── A.8 Technological Controls (34 controls)
    ├── A.8.1  User endpoint devices
    ├── A.8.2  Privileged access rights
    ├── A.8.3  Information access restriction
    ├── A.8.5  Secure authentication
    ├── A.8.8  Management of technical vulnerabilities
    ├── A.8.9  Configuration management
    ├── A.8.15 Logging
    ├── A.8.16 Monitoring activities
    ├── A.8.24 Use of cryptography
    └── A.8.25 Secure development life cycle
```

### InSpec Profile — ISO 27001 Annex A.8

```ruby
# controls/iso27001_a8.rb
control 'iso27001-a.8.2' do
  impact 1.0
  title 'A.8.2 — Privileged access rights'
  desc 'Restrict and manage allocation of privileged access rights.'
  tag iso27001: 'A.8.2'
  tag nist: ['AC-6']

  describe passwd.where { uid == 0 } do
    its('users') { should eq ['root'] }
  end

  describe command('getent group sudo') do
    its('stdout') { should_not match(/,.*,.*,/) }
  end
end

control 'iso27001-a.8.5' do
  impact 1.0
  title 'A.8.5 — Secure authentication'
  desc 'Secure authentication technologies and procedures established.'
  tag iso27001: 'A.8.5'

  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
    its('PermitRootLogin') { should eq 'no' }
    its('MaxAuthTries') { should cmp <= 3 }
  end
end

control 'iso27001-a.8.15' do
  impact 1.0
  title 'A.8.15 — Logging'
  desc 'Logs recording activities, exceptions, and events produced and kept.'
  tag iso27001: 'A.8.15'
  tag nist: ['AU-2']

  describe service('auditd') do
    it { should be_enabled }
    it { should be_running }
  end

  describe service('rsyslog') do
    it { should be_enabled }
  end
end

control 'iso27001-a.8.24' do
  impact 1.0
  title 'A.8.24 — Use of cryptography'
  desc 'Rules for effective use of cryptography defined and implemented.'
  tag iso27001: 'A.8.24'

  describe ssl(port: 443) do
    it { should be_enabled }
    its('protocols') { should_not include 'TLSv1.0' }
  end
end
```

## Workflow

### Step 1: Generate Statement of Applicability

```bash
node scripts/agent.js --action soa --output /tmp/iso27001-soa.json
```

### Step 2: Assess Technical Controls

```bash
node scripts/agent.js --action assess --profile ./controls/ \
  --themes a8 --output /tmp/iso27001-assessment.json
```

### Step 3: Produce Gap Report

```bash
node scripts/agent.js --action gap-report --input /tmp/iso27001-assessment.json \
  --output /tmp/iso27001-gaps.json
```

## Verification

- [ ] ISMS scope defined (Clause 4.3)
- [ ] Risk assessment methodology documented (Clause 6.1.2)
- [ ] Statement of Applicability produced with justifications
- [ ] All 93 Annex A controls assessed (applicable or excluded with reason)
- [ ] Technical controls (A.8) validated via automated testing
- [ ] Internal audit program established (Clause 9.2)
- [ ] Management review scheduled (Clause 9.3)

## References

- [ISO/IEC 27001:2022](https://www.iso.org/standard/27001)
- [ISO/IEC 27002:2022 Implementation Guidance](https://www.iso.org/standard/75652.html)
