ISO 27001 with ARRTECH
Records for the controls in a Statement of Applicability.
Records for the Annex A controls in scope
The Statement of Applicability identifies the controls the organization has selected. Discovery, logging, incident and transfer records help demonstrate how relevant controls operate in practice.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| A.5.12 | Information classified. | DLP finds and classifies sensitive data. → |
| A.5.13 | Information labelled. | DLP labels files by rule. → |
| A.5.14 | Information transfer controlled. | DLP checks data before it leaves. → |
| A.5.26 | Response to incidents. | Cases and playbook run history. → |
| A.5.28 | Evidence collected. | Signed exports with a verifier. → |
| A.7.10 | Storage media managed. | DLP controls USB devices. → |
| A.8.15 | Logging. | Signed, chained logs. → |
| A.8.16 | Monitoring activities. | Events tagged with MITRE ATT&CK. → |
Classification
Discovery and classification by a DLP help identify sensitive information in supported endpoints, file servers and SQL databases. Labels and handling policies then make its protection needs clear to the people and systems using it.
Transfer
DLP policies can inspect sensitive information on covered transfer paths. Blocking, approval, justification and other DLP responses let the organization protect information while accommodating legitimate work.
Logging
Signed records from a SIEM and their verification material let an auditor check integrity outside the original console. The review also considers source accuracy, collection coverage and the meaning of the events.
Monitoring
Correlation in a SIEM connects related events across sources, while AI Detection helps identify changes worth examining. Review the underlying activity and retain the reason for escalation or closure.
Incidents
An incident report should connect its assessment to retained source events and actions. Signed exports from a SIEM support integrity checks when evidence is reviewed outside the security console.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
A.8.17
Clock synchronization. The record comes from the time servers’ configuration.
A.8.5
Secure authentication. The organization’s identity system holds the record. The console accepts Active Directory or LDAP sign-in.
A.8.13
Backup and recovery controls maintain recoverable copies and evidence of restoration tests.
A.8.8
Vulnerability management identifies technical weaknesses and tracks assessment and remediation through the appropriate tools.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
A.5.12
Classify information by its protection needs. Discovery scans by a DLP identify matching content in supported repositories so the data owner can review its location and handling.
A.5.13
Label information by its classification. Classification and labeling make the information’s protection needs visible to the people and systems using it.
A.5.14
Protect information in transfer. DLP policies inspect covered transfers and apply the organization’s blocking or approval rules.
A.5.26
Respond to incidents by documented procedures. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
A.5.28
Collect and preserve evidence of security events. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
A.7.10
Manage storage media through its life cycle. DLP device policies restrict supported removable media, with approved exceptions and activity retained for review.
A.8.15
Logs produced, stored, protected and analysed. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
A.8.16
Monitor for anomalous behavior. Monitoring in a SIEM connects source events with relevant MITRE ATT&CK context for investigation.
Questions
Is there a ready ISO report?
Yes, for ISO/IEC. Check each one against the Statement of Applicability.
Can our assessor check the logs without ARRTECH?
Yes. A signed SIEM export includes the verification material and a standalone verifier, allowing an independent check of record integrity.
Does ISO certify anyone?
No. ISO does not perform certification or issue certificates.
Guide
What is ISO 27001?
The international standard for an information security management system. It addresses how an organization manages information-security risk and operates its selected controls.
What is Annex A?
The list of 93 reference controls an organization selects from and justifies.
What is a Statement of Applicability?
The document that lists each Annex A control, whether it applies and why.
How ARRTECH takes care of ISO 27001 evidence
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
