<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# ISO 27001 Gap Analysis — API Reference

## InSpec ISMS Resources

```bash
# Run ISO 27001 InSpec profile
inspec exec iso27001-profile -t ssh://user@target --reporter json:/tmp/isms.json

# Run specific Annex A control checks
inspec exec iso27001-profile --controls A.8.5 A.8.15 A.8.24

# Validate profile structure
inspec check iso27001-profile

# Generate profile skeleton
inspec init profile iso27001-custom --platform os
```

## OPA Policy Evaluation

```bash
# Evaluate ISMS policy against configuration data
opa eval -d isms_policy.rego -i system_config.json "data.isms.violations"

# Batch evaluation with bundle
opa eval -b ./policies/ -i inventory.json "data.annex_a.gaps"

# Test policies
opa test ./policies/ -v
```

## Annex A Control Theme Mapping

| Theme | Prefix | Count | Key Controls |
|-------|--------|-------|-------------|
| Organizational | A.5 | 37 | Policies, roles, threat intel, cloud security |
| People | A.6 | 8 | Screening, awareness, remote working |
| Physical | A.7 | 14 | Perimeters, monitoring, equipment |
| Technological | A.8 | 34 | Endpoints, auth, logging, crypto |

## Maturity Assessment Commands

```bash
# Password policy (A.8.5)
grep -E "^(minlen|dcredit|ucredit|lcredit)" /etc/security/pwquality.conf

# Audit logging (A.8.15)
systemctl is-enabled auditd && auditctl -l | wc -l

# File integrity (A.8.9)
aide --check 2>&1 | tail -5

# Encryption at rest (A.8.24)
lsblk -o NAME,FSTYPE,MOUNTPOINT | grep -i crypt
cryptsetup status $(lsblk -ln -o NAME,FSTYPE | awk '/crypt/{print $1}')

# Backup verification (A.8.13)
restic snapshots --json | jq 'length'
```

## SoA Generation

```bash
# Generate Statement of Applicability from assessment
node scripts/agent.js --action report --format soa \
  --input /tmp/iso27001-assess.json --output /tmp/soa.json

# Export to CSV for stakeholder review
jq -r '.soa.entries[] | [.control, .title, .applicable, .current_maturity, .target_maturity] | @csv' \
  /tmp/soa.json > /tmp/soa.csv
```
