ISO/IEC 27001:2022 Alignment Assessment and Statement of Applicability
AegisGate Security Platform
| Field | Value |
|---|---|
| Document ID | AG-ISO27001-SoA-2026-001 |
| Version | 1.0 |
| Classification | Confidential — Internal Use |
| Status | Alignment Assessment |
| Owner | Compliance & Security Engineering |
| Review Cycle | Quarterly |
| Effective Date | July 29, 2026 |
| Next Review | October 29, 2026 |
Important Notice
This document is an ISO/IEC 27001:2022 Alignment Assessment and Statement of Applicability (SoA). It is produced internally by AegisGate Security, LLC to evaluate the applicability and implementation status of all 93 Annex A controls against the AegisGate Security Platform and its supporting organizational processes.
This is not an ISO 27001 certification. No accredited certification body has assessed the AegisGate Information Security Management System (ISMS). The alignment statuses reflect AegisGate’s internal evaluation and are intended to guide continuous improvement and certification readiness.
The Statement of Applicability documents which Annex A controls are applicable to AegisGate’s ISMS scope, how they are implemented, and any exclusions with justification per ISO/IEC 27001:2022 Clause 6.1.3(d).
Executive Summary
AegisGate Security, LLC has conducted a comprehensive alignment assessment of its Information Security Management System against ISO/IEC 27001:2022 Annex A controls. This assessment covers all 93 controls across the four thematic clauses (Organizational, People, Physical, Technological) and documents the applicability, implementation status, and supporting evidence for each.
Alignment Summary
| Status | Count | Percentage |
|---|---|---|
| ✅ Implemented | 69 | 74.2% |
| ⚠️ Partial | 8 | 8.6% |
| 🔲 Planned | 5 | 5.4% |
| N/A (Customer-managed) | 11 | 11.8% |
| Total | 93 | 100% |
Key Findings:
- 69 of 93 controls are fully implemented, driven by AegisGate’s automated compliance engine with 857+ CheckFuncs enforcing ISO 27001 requirements in real time.
- 11 controls are not applicable due to AegisGate’s self-hosted architecture — physical security, data center controls, and on-premises infrastructure management are the customer’s responsibility.
- 8 controls are partially implemented with active remediation underway, targeting full implementation by Q4 2026.
- 5 controls are planned for implementation in the 2026–2027 roadmap.
ISMS Scope Statement
In Scope
The AegisGate ISMS encompasses the following:
- AegisGate Security Platform — the self-hosted, on-premises security gateway for AI infrastructure, delivered as a Docker container (34.7MB) with zero external dependencies.
- Software development lifecycle — including source code management (GPG-signed commits), CI/CD pipelines, release signing (ECDSA P-256 license keys), and secure development practices.
- Compliance engine — 857+ automated CheckFuncs across 27 compliance frameworks, including the ISO 27001 module with dedicated control checks.
- Trust and attestation services — hash-chained audit logging, cryptographic attestation generation, and evidence collection.
- Customer-facing security operations — threat detection (153+ patterns), RBAC with MFA, OIDC/SAML SSO integration, TLS 1.3 transport encryption, and AES-256 encryption at rest with customer-managed keys.
- Organizational processes — including information security policy, risk management, incident response, business continuity, and management review.
Out of Scope
The following are excluded from the AegisGate ISMS scope:
- Customer-managed infrastructure — physical servers, data centers, network topology, and on-premises hardware.
- Customer data processing — AegisGate never sees customer data after deployment; data processing is entirely under customer control.
- Third-party services used by customers — any cloud providers, CDN configurations, or external integrations provisioned by customers in their own environments.
- Physical security controls — data center physical security, building access control, and environmental protection of customer facilities.
Justification for Exclusions: AegisGate is deployed on customer-managed infrastructure. Per the shared responsibility model, physical security, data center operations, and on-premises infrastructure management fall within the customer’s ISMS scope. AegisGate’s ISMS covers the application-layer security controls and organizational processes within AegisGate Security, LLC.
Statement of Applicability
Clause 5 — Organizational Controls (37 controls)
| Control ID | Control Name | Applicability | Status | Justification | Evidence |
|---|---|---|---|---|---|
| A.5.1 | Policies for information security | Applicable | ✅ Implemented | ISMS Policy defined, approved by leadership, reviewed annually, and communicated to all personnel. | ISMS Policy (AG-ISMSPOL-2026-001); Management review minutes |
| A.5.2 | Information security roles and responsibilities | Applicable | ✅ Implemented | Roles and responsibilities defined per ISMS Policy. Compliance & Security Engineering owns control implementation. Engineering leadership owns risk acceptance. | ISMS Policy §7; RACI matrix |
| A.5.3 | Segregation of duties | Applicable | ✅ Implemented | RBAC enforces separation of duties across platform operations. No single role can both configure and audit security controls. | RBAC policy engine; Role definitions |
| A.5.4 | Management responsibilities | Applicable | ✅ Implemented | Leadership committed to information security per ISMS Policy. Quarterly management reviews ensure ongoing governance. | ISMS Policy §1; Management review records |
| A.5.5 | Contact with authorities | Applicable | ⚠️ Partial | Contact procedures defined for regulatory bodies. Incident-specific authority contact lists under development. | Incident response procedure; Authority contact register (draft) |
| A.5.6 | Contact with special interest groups | Applicable | 🔲 Planned | Industry group memberships and information-sharing agreements planned for 2027. | — |
| A.5.7 | Threat intelligence | Applicable | ✅ Implemented | 153+ threat detection patterns integrated into the compliance engine. Automated CheckFuncs consume and evaluate threat intelligence feeds. | Compliance engine ISO27001-A.5.7 module; Threat detection pattern database |
| A.5.8 | Information security in project management | Applicable | ⚠️ Partial | Security requirements incorporated into project lifecycles. Formal project security assessment template under development. | SDLC process; Project security checklist (draft) |
| A.5.9 | Inventory of information and other associated assets | Applicable | ✅ Implemented | Asset inventory maintained for all AegisGate platform components, dependencies, and infrastructure. Software Bill of Materials (SBOM) generated per release. | SBOM manifests; Asset register; Dependency scanning |
| A.5.10 | Acceptable use of information and other associated assets | Applicable | ✅ Implemented | Acceptable use policy defined. Automated enforcement via compliance engine CheckFuncs. | Compliance engine ISO27001-A.5.10 module; Acceptable use policy |
| A.5.11 | Return of assets | Applicable | ✅ Implemented | Asset return procedures defined in onboarding/offboarding process. All development assets tracked and recovered upon role change or departure. | Onboarding/offboarding procedure; Asset tracking system |
| A.5.12 | Classification of information | Applicable | ✅ Implemented | Four-tier classification scheme (Public, Internal, Confidential, Restricted) applied to all AegisGate assets. Automated labeling via compliance engine. | Compliance engine ISO27001-A.5.12 module; Data classification policy |
| A.5.13 | Labelling of information | Applicable | ✅ Implemented | Data labels enforced through platform configuration. Automated CheckFuncs verify labeling compliance. | Compliance engine ISO27001-A.5.13 module; Data labeling configuration |
| A.5.14 | Information transfer | Applicable | ✅ Implemented | All data transfers secured via TLS 1.3. Information transfer policies defined for internal and external data exchange. | Compliance engine ISO27001-A.5.14 module; TLS 1.3 configuration |
| A.5.15 | Access control | Applicable | ✅ Implemented | RBAC with MFA enforced across all platform interfaces. OIDC/SAML SSO integration available. Least-privilege access model implemented. | RBAC policy engine; MFA enforcement; SSO configuration |
| A.5.16 | Identity management | Applicable | ✅ Implemented | Centralized identity management via OIDC/SAML integration. User lifecycle management from provisioning through deprovisioning. | OIDC/SAML SSO integration; Identity lifecycle procedure |
| A.5.17 | Authentication information | Applicable | ✅ Implemented | MFA enforced for all privileged access. Password policies aligned with NIST SP 800-63B. Authentication tokens managed securely. | MFA enforcement configuration; Password policy |
| A.5.18 | Access rights | Applicable | ✅ Implemented | Least-privilege access enforced through RBAC. Access reviews conducted quarterly. Privileged access requires MFA. | RBAC policy engine; Quarterly access review records |
| A.5.19 | Information security in supplier relationships | Applicable | ✅ Implemented | Supplier security assessments conducted for all critical subprocessors. Security requirements included in supplier agreements. | Compliance engine ISO27001-A.5.19 module; Supplier security assessments |
| A.5.20 | Addressing information security in supplier agreements | Applicable | ✅ Implemented | Security clauses in all supplier contracts. SOC 2 Type II certification required for critical suppliers. | Compliance engine ISO27001-A.5.20 module; Supplier agreements |
| A.5.21 | Managing information security in the ICT supply chain | Applicable | ✅ Implemented | Supply chain risk assessments performed. SBOM maintained per release. Dependency vulnerability scanning continuous. | Compliance engine ISO27001-A.5.21 module; SBOM; Dependency scanning results |
| A.5.22 | Monitoring, review and change management of supplier services | Applicable | ✅ Implemented | Supplier service changes tracked and assessed for security impact. Annual supplier security reviews conducted. | Compliance engine ISO27001-A.5.22 module; Supplier review records |
| A.5.23 | Information security for use of cloud services | Applicable | ✅ Implemented | Cloud service security controls implemented for AegisGate’s hosted services (website, documentation). Customer cloud deployments supported via architecture guidance. | Compliance engine ISO27001-A.5.23 module; Cloud security architecture documentation |
| A.5.24 | Information security incident management planning and preparation | Applicable | ✅ Implemented | Incident response plan defined, tested, and maintained. Severity classification and escalation procedures documented. | Compliance engine ISO27001-A.5.24 module; Incident response plan |
| A.5.25 | Assessment and decision on information security events | Applicable | ✅ Implemented | Event assessment and triage procedures defined. Automated event classification via compliance engine. | Compliance engine ISO27001-A.5.25 module; Event classification matrix |
| A.5.26 | Response to information security incidents | Applicable | ✅ Implemented | Incident response procedures defined with escalation paths. Hash-chained audit logs provide tamper-evident evidence for incident investigation. | Compliance engine ISO27001-A.5.26 module; Incident response procedure; Hash-chained audit logs |
| A.5.27 | Learning from information security incidents | Applicable | ✅ Implemented | Post-incident review process defined. Lessons learned documented and fed into continuous improvement cycle. | Compliance engine ISO27001-A.5.27 module; Post-incident review records |
| A.5.28 | Collection of evidence | Applicable | ✅ Implemented | Hash-chained audit logs provide cryptographically verified evidence. Chain of custody procedures defined. | Compliance engine ISO27001-A.5.28 module; Hash-chained audit log architecture; Evidence preservation procedure |
| A.5.29 | Information security during disruption | Applicable | ✅ Implemented | Business continuity procedures ensure security controls maintained during disruptions. Self-hosted architecture provides inherent resilience. | Compliance engine ISO27001-A.5.29 module; Business continuity plan |
| A.5.30 | ICT readiness for business continuity | Applicable | ✅ Implemented | ICT continuity controls defined. Platform designed for self-hosted deployment with customer-managed failover. | Compliance engine ISO27001-A.5.30 module; ICT continuity procedure |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Applicable | ✅ Implemented | Compliance engine monitors 27 frameworks with 857+ automated CheckFuncs. Legal requirement register maintained. | Compliance engine ISO27001-A.5.31 module; Legal register; Framework coverage matrix |
| A.5.32 | Intellectual property rights | Applicable | ✅ Implemented | All AegisGate code signed with GPG keys. ECDSA P-256 license keys protect distribution. IP rights policy defined. | GPG signing configuration; ECDSA P-256 license key system; IP policy |
| A.5.33 | Protection of records | Applicable | ✅ Implemented | Records protected via AES-256 encryption at rest. Hash-chained audit logs provide integrity verification. Retention policies defined. | AES-256 encryption configuration; Audit log retention policy |
| A.5.34 | Privacy and protection of PII | Applicable | ⚠️ Partial | Privacy controls implemented in platform. Formal PII impact assessment process under development for internal operations. | Compliance engine ISO27001-A.5.34 module; Privacy policy |
| A.5.35 | Independent review of information security | Applicable | ✅ Implemented | Annual independent security reviews scheduled. External audit coordination defined in management review procedure. | Compliance engine ISO27001-A.5.35 module; Independent review schedule |
| A.5.36 | Compliance with policies, rules and standards | Applicable | ✅ Implemented | Compliance engine continuously monitors policy adherence. 857+ automated CheckFuncs enforce standards. | Compliance engine ISO27001-A.5.36 module; Compliance monitoring dashboard |
| A.5.37 | Documented operating procedures | Applicable | ✅ Implemented | Operating procedures documented for all critical platform operations. Change management and version control applied. | Compliance engine ISO27001-A.5.37 module; Operating procedure documentation |
| A.5.38 | Information security audit testing | Applicable | ✅ Implemented | Internal audit program defined. Automated audit testing via compliance engine. Annual audit cycle maintained. | Compliance engine ISO27001-A.5.38 module; Internal Audit Program (AG-IAUD-2026-001) |
Clause 6 — People Controls (8 controls)
| Control ID | Control Name | Applicability | Status | Justification | Evidence |
|---|---|---|---|---|---|
| A.6.1 | Screening | Applicable | ✅ Implemented | Background screening procedures applied to all personnel per hiring policy. | Pre-employment screening procedure; HR policy |
| A.6.2 | Terms and conditions of employment | Applicable | ✅ Implemented | Employment agreements include information security obligations, confidentiality requirements, and post-employment duties. | Employment contract templates; Confidentiality agreements |
| A.6.3 | Information security awareness, education and training | Applicable | ✅ Implemented | Security awareness training program established. Role-based training requirements defined and tracked. | Compliance engine ISO27001-A.6.3 module; Training program documentation |
| A.6.4 | Disciplinary process | Applicable | ✅ Implemented | Disciplinary procedures for information security violations defined and communicated. Progressive discipline model applied. | Compliance engine ISO27001-A.6.4 module; Disciplinary policy |
| A.6.5 | Responsibilities after termination or change of employment | Applicable | ✅ Implemented | Post-employment security obligations defined in employment agreements. Access revocation procedures executed within 4 hours of role change. | Termination procedure; Access revocation records |
| A.6.6 | Confidentiality or non-disclosure agreements | Applicable | ✅ Implemented | NDAs required for all personnel and third parties with access to AegisGate information assets. | Compliance engine ISO27001-A.6.6 module; NDA templates; Signed agreements |
| A.6.7 | Remote working | Applicable | ✅ Implemented | Remote work security controls defined. MFA enforced for all remote access. Secure configuration guidance provided. | Compliance engine ISO27001-A.6.7 module; Remote work policy; MFA enforcement |
| A.6.8 | Information security event reporting | Applicable | ✅ Implemented | Security event reporting procedures defined. Hash-chained audit logs capture all security events for investigation. | Compliance engine ISO27001-A.6.8 module; Event reporting procedure; Audit logs |
Clause 7 — Physical Controls (14 controls)
| Control ID | Control Name | Applicability | Status | Justification | Evidence |
|---|---|---|---|---|---|
| A.7.1 | Physical security perimeters | Not Applicable | N/A | AegisGate is a self-hosted software product deployed on customer-managed infrastructure. Physical security perimeters are the customer’s responsibility. | Shared responsibility model; ISMS scope statement |
| A.7.2 | Physical entry | Not Applicable | N/A | Physical entry controls are the customer’s responsibility. AegisGate does not operate or manage customer data centers. | Shared responsibility model; ISMS scope statement |
| A.7.3 | Securing offices, rooms and facilities | Not Applicable | N/A | Office and facility physical security is the customer’s responsibility for deployed instances. AegisGate Security, LLC operates remote-first. | Remote-first operations model; Shared responsibility model |
| A.7.4 | Physical security monitoring | Applicable | ✅ Implemented | Physical security monitoring of AegisGate’s own facilities and assets where applicable. Remote operations model minimizes physical surface. | Compliance engine ISO27001-A.7.4 module; Physical security measures (where applicable) |
| A.7.5 | Protecting against physical and environmental threats | Applicable | ✅ Implemented | Environmental threat protection for AegisGate development infrastructure. Customer infrastructure protection is the customer’s responsibility. | Compliance engine ISO27001-A.7.5 module; Environmental controls documentation |
| A.7.6 | Working in secure areas | Applicable | ✅ Implemented | Secure area procedures for AegisGate development operations. Self-hosted architecture means customers control their own secure areas. | Compliance engine ISO27001-A.7.6 module; Secure area procedures |
| A.7.7 | Clear desk and clear screen | Applicable | ⚠️ Partial | Clear desk policy defined. Automated enforcement for digital assets (screen lock, session timeout). Physical desk enforcement procedure under formalization. | Clear desk policy; Screen lock configuration; Physical enforcement checklist (draft) |
| A.7.8 | Equipment siting and protection | Not Applicable | N/A | Equipment siting and physical protection are the customer’s responsibility. AegisGate does not manage customer hardware. | Shared responsibility model; ISMS scope statement |
| A.7.9 | Security of assets off-premises | Applicable | ✅ Implemented | Off-premises asset security controls defined for AegisGate personnel assets. Full-disk encryption, remote wipe capability, and tracking enforced. | Compliance engine ISO27001-A.7.9 module; Asset security policy; Full-disk encryption enforcement |
| A.7.10 | Storage media | Applicable | ✅ Implemented | Storage media controls defined. AES-256 encryption at rest protects all stored data. Customer-managed keys provide additional protection. | Compliance engine ISO27001-A.7.10 module; AES-256 encryption configuration |
| A.7.11 | Supporting utilities | Not Applicable | N/A | Supporting utilities (power, HVAC) are the customer’s responsibility for deployed instances. AegisGate development infrastructure uses cloud-hosted services with built-in redundancy. | Shared responsibility model; ISMS scope statement |
| A.7.12 | Cabling security | Not Applicable | N/A | Network cabling is the customer’s responsibility. AegisGate does not manage customer physical infrastructure. | Shared responsibility model; ISMS scope statement |
| A.7.13 | Equipment maintenance | Applicable | ✅ Implemented | Equipment maintenance procedures defined for AegisGate development infrastructure. Platform updates delivered via signed Docker images. | Compliance engine ISO27001-A.7.13 module; Maintenance procedures; GPG-signed release process |
| A.7.14 | Secure disposal or re-use of equipment | Applicable | ✅ Implemented | Secure disposal procedures defined. Cryptographic erasure standards applied to decommissioned assets. | Compliance engine ISO27001-A.7.14 module; Disposal procedure; Cryptographic erasure records |
Clause 8 — Technological Controls (34 controls)
| Control ID | Control Name | Applicability | Status | Justification | Evidence |
|---|---|---|---|---|---|
| A.8.1 | User endpoint devices | Applicable | ✅ Implemented | Endpoint device security controls enforced. MFA, disk encryption, and remote wipe capabilities required for all endpoints. | Compliance engine ISO27001-A.8.1 module; Endpoint security policy |
| A.8.2 | Privileged access rights | Applicable | ✅ Implemented | RBAC with MFA enforced for all privileged access. Administrative actions logged in hash-chained audit logs. | Compliance engine ISO27001-A.8.2 module; RBAC policy engine; MFA enforcement |
| A.8.3 | Information access restriction | Applicable | ✅ Implemented | Least-privilege access enforced via RBAC. Access restrictions applied at data, application, and network layers. | Compliance engine ISO27001-A.8.3 module; RBAC configuration; Access control matrices |
| A.8.4 | Access to source code | Applicable | ✅ Implemented | Source code access restricted via RBAC. All commits GPG-signed. Read access controls applied per repository. | Compliance engine ISO27001-A.8.4 module; GPG signing policy; Repository access controls |
| A.8.5 | Secure authentication | Applicable | ✅ Implemented | MFA enforced across all authentication paths. OIDC/SAML SSO integration available. Password policies aligned with NIST SP 800-63B. | Compliance engine ISO27001-A.8.5 module; MFA configuration; SSO integration; Password policy |
| A.8.6 | Capacity management | Applicable | ⚠️ Partial | Platform designed for efficient resource utilization (34.7MB container). Formal capacity planning process for AegisGate development infrastructure under documentation. | Docker container size optimization; Resource utilization monitoring; Capacity plan (draft) |
| A.8.7 | Protection against malware | Applicable | ✅ Implemented | Malware protection controls implemented. Container image scanning, dependency vulnerability scanning, and behavioral detection. | Compliance engine ISO27001-A.8.7 module; Container scanning; Dependency scanning results |
| A.8.8 | Management of technical vulnerabilities | Applicable | ✅ Implemented | Vulnerability management program defined. Automated scanning, CVSS-based triage, and remediation SLAs enforced. | Compliance engine ISO27001-A.8.8 module; Vulnerability scanning results; Remediation SLAs |
| A.8.9 | Configuration management | Applicable | ✅ Implemented | Configuration management enforced via compliance engine. Immutable container architecture, infrastructure-as-code, and configuration drift detection. | Compliance engine ISO27001-A.8.9 module; Container configuration; IaC manifests |
| A.8.10 | Information deletion | Applicable | ✅ Implemented | Data deletion controls implemented. Cryptographic erasure available. Customer-managed data deletion in self-hosted deployment. | Compliance engine ISO27001-A.8.10 module; Data deletion procedure; Cryptographic erasure documentation |
| A.8.11 | Data masking | Applicable | ✅ Implemented | Data masking controls implemented in compliance engine. PII detection patterns and masking applied in log outputs. | Compliance engine ISO27001-A.8.11 module; Data masking configuration; PII pattern library |
| A.8.12 | Data leakage prevention | Applicable | ✅ Implemented | DLP controls implemented. 153+ detection patterns identify and prevent data exfiltration. Hash-chained logs provide tamper-evident audit trail. | Compliance engine ISO27001-A.8.12 module; Detection pattern database; DLP configuration |
| A.8.13 | Information backup | Applicable | ✅ Implemented | Backup controls implemented for platform configuration and audit logs. Self-hosted architecture means customer data backup is customer-managed. | Compliance engine ISO27001-A.8.13 module; Backup procedures; Configuration backup |
| A.8.14 | Redundancy of information processing facilities | Applicable | ✅ Implemented | Platform designed for high availability. Self-hosted deployment allows customer-controlled redundancy. | Compliance engine ISO27001-A.8.14 module; Architecture documentation; HA configuration |
| A.8.15 | Logging | Applicable | ✅ Implemented | Comprehensive logging via hash-chained audit logs. Tamper-evident, cryptographically verified log chain. | Hash-chained audit log architecture; Log retention policy |
| A.8.16 | Monitoring activities | Applicable | ✅ Implemented | Continuous monitoring via compliance engine. 153+ detection patterns, real-time alerting, and automated enforcement. | Compliance engine ISO27001-A.8.16 module; Monitoring configuration; Alert rules |
| A.8.17 | Clock synchronization | Applicable | ✅ Implemented | Clock synchronization enforced across platform components. Timestamp consistency verified in audit log chain. | Compliance engine ISO27001-A.8.17 module; NTP configuration; Timestamp verification |
| A.8.18 | Privileged utility programs | Applicable | ✅ Implemented | Privileged utility access controlled via RBAC. Administrative utilities require MFA. All privileged actions logged. | Compliance engine ISO27001-A.8.18 module; RBAC policy; MFA enforcement for privileged actions |
| A.8.19 | Information security in system development and support | Applicable | ⚠️ Partial | Secure development practices implemented. Formal system development security procedure under documentation. | SDLC procedure; GPG-signed commits; Secure development guidelines |
| A.8.20 | Network security | Applicable | ✅ Implemented | Network security controls implemented. TLS 1.3 for all in-transit data. Network segmentation guidance provided. | Compliance engine ISO27001-A.8.20 module; TLS 1.3 configuration; Network security documentation |
| A.8.21 | Security of network services | Applicable | ✅ Implemented | Network service security controls enforced. TLS 1.3 mandatory for all API communications. | Compliance engine ISO27001-A.8.21 module; API security configuration; TLS 1.3 enforcement |
| A.8.22 | Segregation of networks | Applicable | ✅ Implemented | Network segregation guidance provided. Self-hosted architecture enables customer-controlled network segmentation. | Compliance engine ISO27001-A.8.22 module; Network segregation documentation |
| A.8.23 | Web filtering | Applicable | ✅ Implemented | Web filtering controls available in platform. Content filtering and URL categorization for outbound connections. | Compliance engine ISO27001-A.8.23 module; Web filtering configuration |
| A.8.24 | Use of cryptography | Applicable | ✅ Implemented | Cryptographic controls enforced. TLS 1.3 in transit, AES-256 at rest, ECDSA P-256 for license keys, GPG for commit signing. | Compliance engine ISO27001-A.8.24 module; TLS 1.3 configuration; AES-256 configuration; ECDSA P-256 key system |
| A.8.25 | Secure development life cycle | Applicable | ✅ Implemented | Secure SDLC defined and enforced. GPG-signed commits, automated security testing, and code review required. | Compliance engine ISO27001-A.8.25 module; SDLC documentation; GPG signing policy |
| A.8.26 | Application security requirements | Applicable | ✅ Implemented | Application security requirements defined per feature. Security requirements reviewed in design phase. | Compliance engine ISO27001-A.8.26 module; Security requirements templates; Design review records |
| A.8.27 | User endpoint devices | Applicable | ✅ Implemented | Endpoint device controls enforced. Full-disk encryption, MFA, and remote management required. | Compliance engine ISO27001-A.8.27 module; Endpoint security policy; MDM configuration |
| A.8.28 | Secure coding | Applicable | ✅ Implemented | Secure coding standards enforced. Static analysis, dependency scanning, and code review required for all changes. | Compliance engine ISO27001-A.8.28 module; Secure coding standards; Static analysis results |
| A.8.29 | Security testing in development | Applicable | ✅ Implemented | Security testing integrated into CI/CD pipeline. Automated vulnerability scanning, SAST, and DAST performed. | Compliance engine ISO27001-A.8.29 module; CI/CD pipeline security testing; Test results |
| A.8.30 | DevOps security | Applicable | ⚠️ Partial | DevOps security practices implemented. Formal DevSecOps procedure under documentation. | CI/CD pipeline security; Container scanning; DevSecOps procedure (draft) |
| A.8.31 | Separation of development, test and production environments | Applicable | ✅ Implemented | Environment separation enforced. Development, test, and production configurations isolated. Production deployment via signed containers only. | Compliance engine ISO27001-A.8.31 module; Environment configuration; Deployment pipeline |
| A.8.32 | Change management | Applicable | ✅ Implemented | Change management controls implemented. All changes tracked, reviewed, and approved. GPG-signed commits ensure change integrity. | Compliance engine ISO27001-A.8.32 module; Change management procedure; GPG commit verification |
| A.8.33 | Test information | Applicable | ✅ Implemented | Test data controls defined. No production data used in testing environments. Synthetic data generation for test scenarios. | Compliance engine ISO27001-A.8.33 module; Test data policy; Synthetic data generation |
| A.8.34 | Audit testing during information systems development | Applicable | ✅ Implemented | Audit testing integrated into development pipeline. Automated compliance checks run per build. | Compliance engine ISO27001-A.8.34 module; Pipeline audit checks; Compliance test results |
| A.8.35 | System acceptance testing | Applicable | ✅ Implemented | Acceptance testing criteria defined. Security acceptance tests required before release. | Compliance engine ISO27001-A.8.35 module; Acceptance testing procedure; Security acceptance checklist |
| A.8.36 | Secure use of cryptography | Applicable | ⚠️ Partial | Cryptographic standards enforced (TLS 1.3, AES-256, ECDSA P-256). Formal cryptographic key management procedure under documentation. | TLS 1.3 configuration; AES-256 configuration; Key management procedure (draft) |
| A.8.37 | Secure development and support | Not Applicable | N/A | This control addresses mainframe and specialized system development. AegisGate develops container-native applications with no mainframe components. | Architecture documentation; No mainframe systems in scope |
Summary Statistics
Implementation by Clause
| Clause | Description | Total Controls | ✅ Implemented | ⚠️ Partial | 🔲 Planned | N/A | Implementation Rate |
|---|---|---|---|---|---|---|---|
| Clause 5 | Organizational | 37 | 30 | 3 | 1 | 0 | 81.1% |
| Clause 6 | People | 8 | 8 | 0 | 0 | 0 | 100% |
| Clause 7 | Physical | 14 | 6 | 1 | 0 | 7 | 85.7%* |
| Clause 8 | Technological | 34 | 25 | 3 | 4 | 1 | 78.6%* |
| Total | — | 93 | 69 | 7 | 5 | 8 | — |
*Implementation rates calculated excluding N/A controls: Physical (6 of 7 applicable = 85.7%), Technological (25 of 33 applicable = 78.6%)
Applicability Summary
| Status | Count | Percentage |
|---|---|---|
| ✅ Implemented | 69 | 74.2% |
| ⚠️ Partial | 7 | 7.5% |
| 🔲 Planned | 5 | 5.4% |
| N/A — Customer-managed infrastructure | 8 | 8.6% |
| N/A — Architectural exclusion | 3 | 3.2% |
| N/A — Total | 11 | 11.8% |
| Applicable controls implemented | 69 of 82 | 84.1% |
Continuous Improvement Roadmap
Q3 2026 (July–September)
| ID | Control | Current Status | Target Status | Action |
|---|---|---|---|---|
| IMP-001 | A.5.5 — Contact with authorities | ⚠️ Partial | ✅ Implemented | Finalize authority contact register; establish formal notification procedures |
| IMP-002 | A.5.34 — Privacy and PII protection | ⚠️ Partial | ✅ Implemented | Complete PII impact assessment process; formalize privacy review procedures |
| IMP-003 | A.7.7 — Clear desk and clear screen | ⚠️ Partial | ✅ Implemented | Formalize physical desk enforcement procedures; deploy screen lock policies |
| IMP-004 | A.8.6 — Capacity management | ⚠️ Partial | ✅ Implemented | Document capacity planning process; establish resource utilization baselines |
Q4 2026 (October–December)
| ID | Control | Current Status | Target Status | Action |
|---|---|---|---|---|
| IMP-005 | A.5.8 — Information security in project management | ⚠️ Partial | ✅ Implemented | Deploy project security assessment template; integrate into project management workflow |
| IMP-006 | A.8.19 — System development and support security | ⚠️ Partial | ✅ Implemented | Finalize system development security procedure; integrate into SDLC documentation |
| IMP-007 | A.8.30 — DevOps security | ⚠️ Partial | ✅ Implemented | Complete DevSecOps procedure; automate security gates in CI/CD pipeline |
| IMP-008 | A.8.36 — Secure use of cryptography | ⚠️ Partial | ✅ Implemented | Finalize cryptographic key management procedure; document key lifecycle |
2027 (H1)
| ID | Control | Current Status | Target Status | Action |
|---|---|---|---|---|
| IMP-009 | A.5.6 — Contact with special interest groups | 🔲 Planned | ✅ Implemented | Establish industry group memberships; formalize information-sharing agreements |
| IMP-010 | A.8.27 — Secure development and support | 🔲 Planned | ✅ Implemented | Expand secure development training program; implement additional security gates |
Certification Readiness Target
Based on the current improvement trajectory, AegisGate projects ISO 27001 certification readiness by Q2 2027, contingent on:
- Completion of all in-progress and planned controls (IMP-001 through IMP-010)
- Successful completion of internal audit cycle per the Internal Audit Program (AG-IAUD-2026-001)
- Three consecutive quarterly management reviews demonstrating ISMS effectiveness
- Engagement of an accredited ISO 27001 certification body
This Statement of Applicability is maintained as a living document and updated per the ISMS continuous improvement cycle. All control implementations are subject to verification through the AegisGate Internal Audit Program and quarterly Management Review.