Framework pack in trustlynce
ISO 27001
ISO/IEC 27001:2022
ISO/IEC 27001 certifies an information security management system: risk assessment, risk treatment, a Statement of Applicability, internal audit, and management review. The 2022 revision reorganized Annex A into 93 controls across four themes. Certification is followed by annual surveillance audits.
Applies to: Any organization that wants a certified information security management system (ISMS).
What to Know
- Annex A has 93 controls in four themes: Organizational (37), People (8), Physical (14), and Technological (34).
- The Statement of Applicability records which controls apply and why any are excluded.
- Organizations certified to the 2013 version had to transition to the 2022 version by October 2025.
Controls Lionhouse Helps With
The engineering-owned controls where continuous evidence saves the most time. Policies, training, and physical controls are tracked in trustlynce too.
| Reference | Control | How Lionhouse helps | Products |
|---|---|---|---|
| A.5.15 / A.5.18 | Access control and access rights | trustlynce runs access review campaigns across identity providers and SaaS; TrustIvan inventories machine identities and flags unused or over-privileged credentials. | trustlynce, TrustIvan |
| A.8.8 | Management of technical vulnerabilities | TrustIvan scans images and dependencies continuously, opens fix pull requests, and keeps an auditable record of every triage decision. | TrustIvan |
| A.8.15 / A.8.16 | Logging and monitoring activities | aiAxonIQ stores OpenTelemetry logs and traces in ClickHouse with configurable retention and anomaly detection. | aiAxonIQ |
| A.8.28 | Secure coding | TrustIvan secret detection and dependency scanning run in CI, so issues are caught before merge rather than after release. | TrustIvan |
Lionhouse helps you prepare and maintain evidence. Your auditor or certification body makes the final determination.
Other Frameworks
Talk to an Architect
See the Four Products Running in Your Environment.
A technical session with a Lionhouse architect covering your stack, your deployment model, and a pilot plan.