<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# ISO 27001 Compliance Auditing — API Reference

## InSpec ISO 27001 Resources

```bash
# Run ISO 27001 Annex A profile
inspec exec iso27001-profile -t ssh://user@target --reporter json

# Filter by theme
inspec exec iso27001-profile --controls /iso27001-a.8/

# Target cloud environment
inspec exec iso27001-profile -t aws:// --reporter json
```

## Annex A Control Themes

| Theme | Controls | Automatable | Key Areas |
|-------|----------|-------------|-----------|
| A.5 Organizational | 37 | ~30% | Policies, roles, threat intel |
| A.6 People | 8 | ~15% | Screening, training, termination |
| A.7 Physical | 14 | ~20% | Perimeters, monitoring, media |
| A.8 Technological | 34 | ~80% | Auth, crypto, logging, vuln mgmt |

## Certification Process

```
ISO 27001 Certification Lifecycle:
├── Stage 1 Audit: Documentation review (ISMS scope, SoA, risk assessment)
├── Stage 2 Audit: Implementation effectiveness (3-6 months after Stage 1)
├── Certificate Issued: Valid for 3 years
├── Surveillance Audit Year 1: Subset of controls
├── Surveillance Audit Year 2: Subset of controls
└── Recertification Audit Year 3: Full reassessment
```

## Statement of Applicability Template

```json
{
  "control_id": "A.8.5",
  "description": "Secure authentication",
  "applicable": true,
  "justification": "Required — all systems require secure auth per risk assessment",
  "implementation_status": "implemented",
  "implementation_evidence": "SSH key-only auth, MFA on IAM",
  "risk_treatment": "mitigate"
}
```
