Security · International (ISO/IEC)

ISO/IEC 27001:2022 (Annex A)

Attestkeep maps what your cluster's admission control and image scanning recorded in a period to 12 clauses of ISO/IEC 27001:2022. 10 are assessed from those records; 2 are marked outside scope, each with the reason.

Create an account How a package is built

What the framework asks

10 clauses a cluster can answer.

Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.

Information security management systems — Requirements

ISO/IEC 27001:2022

Annex A controls 5.15, 5.23, 5.25, 5.30, 8.8, 8.9, 8.15, 8.19, 8.28 and 8.32

Citation	Clause	Report sections
Annex A 5.15	Access control Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.	Evidence chain
Annex A 5.23	Information security for use of cloud services Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.	Control statementSupply chain
Annex A 5.25	Assessment and decision on information security events The organization shall assess information security events and decide if they are to be categorised as information security incidents.	Admission decisionsEvidence chainBreak-glass events
Annex A 8.8	Management of technical vulnerabilities Information about technical vulnerabilities of information systems in use shall be obtained, the organization's exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.	CoverageAdmission decisionsOutcomesControl statementDeployment contextIssues
Annex A 8.9	Configuration management Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.	Control statementAdmission decisions
Annex A 8.15	Logging Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed.	Evidence chain
Annex A 8.19	Installation of software on operational systems Procedures and measures shall be implemented to securely manage software installation on operational systems.	Control statementAdmission decisionsSupply chain
Annex A 8.28	Secure coding Secure coding principles shall be applied to software development, including the secure acquisition and use of third-party components.	Supply chainCoverage
Annex A 8.32	Change management Changes to information processing facilities and information systems shall be subject to change management procedures.	Triage decisionsEvidence chain
Annex A 5.30	ICT readiness for business continuity ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.	Availability

2 clauses marked outside scope, and why

Citation	Clause and reason
Clauses 4 to 10	The management system itself certification is assessed against the organisation's management system; a control instrument produces evidence for it and cannot stand in for it
Annex A 6 and 7	People and physical controls nothing in these control sets is observable from a cluster; they are listed so their absence from this document is deliberate

What Attestkeep produces

Evidence from records the cluster already keeps.

Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.

Statements the mapping draws on

Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.

Every decision and administrative action is recorded4 clauses
Only images of established provenance may run2 clauses
Images may enter only from named registries2 clauses
Every image in the inventory carries a scan record2 clauses
Administrative access is federated to a directory1 clause
Admission refuses non-compliant workloads1 clause
Vulnerability thresholds are stricter where the workload is exposed or privileged1 clause
The control itself was operating throughout the period1 clause
Workloads name images by digest, not by a movable tag1 clause
Accepted risks are named, justified and expire1 clause
A refusal or a critical finding reaches a person1 clause
Remediation windows are declared for each severity1 clause
A bill of materials is held for the images in service1 clause
Images carrying severe findings are refused1 clause
Workload privilege is constrained at admission1 clause

The package

What the report contains.

Every package carries the same sections, whatever the framework. The ones marked are those ISO/IEC 27001 answers cite, with the number of clauses citing each.

The scope paragraph, as the report states it.

This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto ISO/IEC 27001:2022 Annex A. Certification is granted to an information security management system, not to a control instrument: this document is evidence an assessor can place against a small number of Annex A controls, chiefly A.8.8 technical vulnerability management, A.8.19 software on operational systems and A.8.28 secure coding's deployment half. The management system clauses and the controls that govern people, physical security and suppliers as organisations are outside the scope of this document and are marked as such.

Questions

About ISO/IEC 27001 and Attestkeep

Is this a ISO/IEC 27001 certification?

No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.

Why are 2 of the clauses outside scope?

They ask about things one cluster's admission and scanning records cannot show. They are listed with the reason rather than left out, so whoever reads the report can see the gap is deliberate.

Which plan includes ISO/IEC 27001?

Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.

How does an auditor check the package?

In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account