ISO/IEC 27001:2022 Information Security Management (ISO_27001)

This page describes the community framework ISO_27001 as shipped with SWAO: what it covers, when to use it, what SWAO checks, and how to enable it.

Summary

Property	Value
Framework ID (for regimes_active)	ISO_27001
Authority / publisher	International Organization for Standardization (ISO), jointly with IEC
Version	2022
Status	Not declared in the catalogue
SWAO catalogue version	1.0.0
Total controls	93
Scoring mode	binary (declared)
Assessment types (metadata)	app, aud
Licence and redistribution	ISO/IEC 27001:2022 and ISO/IEC 27002:2022 are copyright ISO. Control titles and descriptions paraphrase the intent and do not reproduce the standard text; obtain the authoritative text from ISO or a national standards body.
Last reviewed	2026-09-21
Folder	iso-27001

What it is

ISO/IEC 27001 is the international standard for information security management systems (ISMS). Organisations are certified against it by accredited certification bodies. The 2022 revision restructured Annex A into 93 controls in four themes: organisational (A.5), people (A.6), physical (A.7) and technological (A.8). Eleven controls are new in the 2022 revision. Implementation guidance for each control is in ISO/IEC 27002:2022.

The SWAO catalogue contains all 93 Annex A controls. The new 2022 controls carry an introduced marker in the catalogue. The ISMS clauses 4 to 10 are not modelled as controls.

Who should use it in SWAO and when

• Enterprise engagements that need broad, sector-neutral security coverage (catalogue hints: enterprise, ism, broad_coverage).
• Clients with an existing ISO 27001 certificate who must show the migrated workload stays within the certified scope.
• As the common reference that many other catalogues map to (BSI_C5, DORA, EUCS, KRITIS_DE and others reference Annex A controls).

What SWAO checks

Controls are evaluated in Pass 11 (compliance evaluation). The pass reads the assessment.regimes_active list from the app's .swao.yml, loads the catalogue and sends the controls in batches of 20 to the configured LLM. For each control the LLM receives the ID, title, description and default severity, together with all signals that the earlier passes of the run produced. It returns one of five outcomes per control:

Outcome	Meaning
SATISFIED	Signals confirm the control is met.
PARTIAL	Some elements are present, but gaps remain.
GAP	Signals show the control is not met.
UNKNOWN	No signal addresses the control either way.
N_A	The control does not apply to this workload (with justification).

Cited signal IDs are checked against the signals that actually exist; invented IDs are dropped. Without a configured LLM provider every control is reported as UNKNOWN.

What evidence the controls expect

Each control declares in its evidence_basis field what kind of evidence it relies on. This tells the reviewer what evidence is expected; the outcome itself is decided by the LLM from the signals. For this framework the split is:

Evidence type	Controls
Code and configuration signals only (signal_prefix, local_signal_regex)	19
Signals and documents combined	14
Documents or questionnaires only (context_input, manual_questionnaire)	60
Marked as audit-only (assessment_type_scope: [aud])	0
Marked as the cloud provider's responsibility (csp_inherited: true)	12

Signal areas referenced

Prefix	Controls	Source
OBS	12	evidence area observability, logging and monitoring; no SWAO analysis pass emits signals with this prefix
IAM	12	evidence area identity and access; no SWAO analysis pass emits signals with this prefix
EGR	7	Pass 07 (EGR)
TF	5	Pass 06 (TF)
CRYPTO	1	Pass 08 (CRYPTO)

Examples

Controls with code or configuration evidence:

• ISO_27001_A.5.7 Threat intelligence (OBS)
• ISO_27001_A.5.14 Information transfer (EGR)
• ISO_27001_A.5.15 Access control (IAM)

Controls that need documents:

• ISO_27001_A.5.1 Policies for information security
• ISO_27001_A.5.2 Information security roles and responsibilities

Place documents in apps/<app-id>/wsp/inputs/ so that Pass 04 (CTX) reads them and turns them into signals; see also Workspace setup. Without them, expect UNKNOWN for document-based controls.

Control structure

Group	Controls	Example controls
Organisational controls (A.5)	37	ISO_27001_A.5.1 Policies for information security; ISO_27001_A.5.2 Information security roles and responsibilities
People controls (A.6)	8	ISO_27001_A.6.1 Screening; ISO_27001_A.6.2 Terms and conditions of employment
Physical controls (A.7)	14	ISO_27001_A.7.1 Physical security perimeters; ISO_27001_A.7.2 Physical entry
Technological controls (A.8)	34	ISO_27001_A.8.1 User end-point devices; ISO_27001_A.8.2 Privileged access rights
Total	93

Default severities: critical 3, high 56, medium 32, low 2.

Cross-mapping to other frameworks

5 of 93 controls carry maps_to references to controls of other frameworks. The table counts the references per target framework. "Resolved" means the target ID exists as a control in a bundled SWAO catalogue; "unresolved" means the reference points at article or clause level, or uses an ID spelling that no catalogue contains.

Target framework	Resolved references	Unresolved references
BSI_GRUNDSCHUTZ_2023	3	0
GDPR	2	0

In the other direction, controls of these frameworks reference ISO_27001 controls: BSI_GRUNDSCHUTZ_2023 (144), BSI_C5 (97), SOC_2 (68), NIST_SP_800_66R2 (59), NCA_ECC (57), NCA_CCC_CSP (56), SAMA_CSF (54), EUCS (50), NIS2 (47), GDPR (43), KRITIS_DE (43), DORA (39), SECNUMCLOUD (38), COBIT_5 (21), NCA_CCC_CST (21), EU_CRA (10), OPENSSF_SCORECARD (6), EU_AI_ACT (4), EC_CSF (1).

In addition, the metadata (cross_mapping_hints) names these related frameworks: BSI_GRUNDSCHUTZ_2023, BSI_C5, GDPR, SOC_2, DORA, EUCS. This list indicates thematic overlap; it is not a control-level mapping.

Demo variant

Property	Value
Framework ID	ISO_27001_DEMO
Folder	iso-27001-demo
Controls	12
Catalogue version	0.1.0
Last reviewed	2026-09-21
Pre-installed in new workspaces	No

The demo variant contains 12 controls sampled across all four Annex A themes (for example A.5.1 policies, A.5.23 cloud services, A.8.5 secure authentication, A.8.24 cryptography), reusing the IDs of the full framework. It is intended for live presentations; use the full ISO_27001 framework for real assessments.

Use the demo variant for workshops, training and presentations where a short report matters more than full coverage. Enable it with its own ID, for example regimes_active: [ISO_27001_DEMO].

Get or customise this framework

• Source to view and copy: github.com/Accenture/SWAO/tree/main/packages/@swao/community-frameworks/frameworks/iso-27001
• Demo variant: github.com/Accenture/SWAO/tree/main/packages/@swao/community-frameworks/frameworks/iso-27001-demo
• Overview of all community frameworks: github.com/Accenture/SWAO/tree/main/community-frameworks

To customise the framework for one engagement, copy the iso-27001 folder (with framework-meta.yaml and controls.yaml) into the workspace at wsp/inputs/catalogs/community/iso-27001/ and edit the copy there. SWAO reads catalogues for the compliance evaluation from this directory, so the workspace copy is the one that counts. Keep the id in regime_meta unchanged so that regimes_active still finds it, and check the copy afterwards with the health check.

How to enable

1. Make sure the iso-27001 folder is present under wsp/inputs/catalogs/community/ in the workspace (see above). After swao init, new workspaces contain only the demo frameworks gdpr-demo, ai-10-pillars-demo, nist-sp-800-66r2-demo and bsi-grundschutz-2023-demo.

2. Add the framework ID to the app's .swao.yml (apps/<app-id>/.swao.yml):

   assessment:
     regimes_active: [ISO_27001]

   List several frameworks to evaluate them together, for example regimes_active: [ISO_27001, GDPR]. Alternatively, swao regime-select --app app-crm-01 --regimes "ISO_27001" writes the same entry.

3. Run the application assessment with an LLM configured.

Pass 11 reads regimes_active from the app's .swao.yml. When the app has no list, it uses the list in the workspace-root .swao.yml (which swao regime-select writes when --app is omitted); a list in the app always takes precedence. If the catalogue is missing, Pass 11 emits a COMP-NN signal stating that no catalogue was found.

Limitations and notes

• 12 of the 14 physical controls (A.7) are marked csp_inherited; in a cloud deployment they are the provider's responsibility. The report marks them as CSP-managed.
• Certification requires an audit of the whole ISMS, including clauses 4 to 10. SWAO evaluates only the Annex A controls as they relate to one workload.
• Outcomes come from an LLM that interprets signals and documents. They are a structured starting point for expert review, not an audit opinion or a certification.
• Control texts are paraphrased summaries. The publisher's official source is always authoritative.
• This page and SWAO results are not legal advice.

Related pages

• Frameworks overview
• Pass 11: compliance evaluation
• Application assessment