ISO 27001 Annex A

EdgeCMS maps a focused Annex A subset to code, tests, CI and host hooks so a host can collect security evidence. This document is not a Statement of Applicability, not an ISMS, and not an ISO 27001 certification claim (see SAAS-PRD.md SP-07 / D7). For SOC 2 Common Criteria pairing and a draft SoA applicability matrix, see the SOC 2 ↔ ISO SoA crosswalk (CMP-02 stub).

Status vocabulary used here and in apps/api/src/compliance/iso27001/:

Never treat engineered as “certified” or “compliant”.

#How to export evidence

bun scripts/iso27001-evidence.ts           # verify cited paths exist
bun scripts/iso27001-evidence.ts --json    # print the evidence bundle

Programmatic export from a host Worker:

import {
  buildIso27001EvidenceBundle,
  buildAssetInventoryStub,
  buildSupplierDependencyNote,
  type ChangeControlSink,
} from 'edgecms-api/app'

const evidence = buildIso27001EvidenceBundle({
  configuredEnvKeys: Object.keys(env), // names only; values never inventoried
})

const changeControlSink: ChangeControlSink = {
  record: (event) => evidenceQueue.send({ body: event }),
}

export const app = createApp({ host: { changeControlSink } })

claim in the JSON bundle is always engineering_evidence_only.

#Themes

#Access control (A.5.15–A.5.18, A.8.2, A.8.3, A.8.5)

RBAC, default-deny ABAC, tenant isolation, signup policy, and MFA gates. Operator guide: Authentication And Access. Related PRD / SaaS ids: HS-01, HS-11, PL-03, CMP-03, CMP-04.

#Logging and monitoring (A.8.15, A.8.16)

Hash-chained audit_events ledger, export/verify routes, optional host.auditSink / SIEM webhook. Operator guide: Operations and security. Related: HS-12, CMP-05.

#Change and configuration management (A.8.9, A.8.32)

• Infra/config as code: apps/api/wrangler.toml, composition-time createApp({ host }) (never request-mutable).
• Code change evidence: PR + CI (.github/workflows/ci.yml) and deploy workflows.
• Optional host.changeControlSink records structured change events (including a boot host_policies_applied event when the sink is set). Related: CMP-06.

#Asset inventory stub (A.5.9)

buildAssetInventoryStub() lists known Worker asset classes (D1, KV, R2, queues, secrets by name, lockfile, source repo). completeness is always stub. Hosts must keep the authoritative CMDB.

#Supplier and dependencies note (A.5.19, A.5.21, A.5.23)

buildSupplierDependencyNote() names Cloudflare, optional IdPs/AI/payments, host email, and the open-source lockfile (bun.lock). It is not a completed vendor review or subprocessor DPA pack. Related: CMP-12, CMP-14. SBOM/SLSA gates are a separate track.

#Control table (engineering map)

Full pointer list and gaps: apps/api/src/compliance/iso27001/controls.ts.

#Explicit non-claims

• No ISO 27001 certificate, surveillance audit, or accredited certification body engagement is asserted here.
• No completed Statement of Applicability (SoA) or risk register is shipped; only a SOC 2 ↔ ISO crosswalk stub. Living SoA + risk register remain host ISMS documents (CMP-01, CMP-02).
• No production backup, penetration-test, or remote performance proof is claimed by this map.
• Staff security training, background checks, and physical controls are out of product scope (CMP-17).

#Related guides

• Auth and access
• Operations and security
• Hosting seams
• SaaS compliance track: SAAS-PRD.md §4.8