| A.5.1 | Policies for Information Security | Y | Policy acknowledgement collection is in progress (records prepared for employees/contractors; signatures pending for some personnel). | Partial | Timo Andreas Bejan | 01.03-information-security-policy; 01.05-control-of-documented-information; 01.07-competence-awareness-and-training; 03-policies/; 04-procedures/ | doc-register; training-register; 07-records/2026/policy-acknowledgements/ | ISO 27001:2022/A.5-organizational-controls/A.5.1-policies-for-information-security.md |
| A.5.2 | Information Security Roles and Responsibilities | Y | Roles are defined and allocated; full communication/ack evidence is being collected (see acknowledgement records). | Partial | Timo Andreas Bejan | 01.04-roles-responsibilities-and-authorities; 01.07-competence-awareness-and-training; 04.01-people-onboarding-offboarding-and-third-parties | doc-register; training-register; 07-records/2026/policy-acknowledgements/ | ISO 27001:2022/A.5-organizational-controls/A.5.2-information-security-roles-and-responsibilities.md |
| A.5.3 | Segregation of Duties | Y | Due to small company size and customer constraints, full segregation is not always feasible; compensating controls (approvals, logging, reviews) are used and exceptions are handled via risk acceptance. | Partial | Timo Andreas Bejan | 03.15-segregation-of-duties-and-dual-control-policy; 01.04-roles-responsibilities-and-authorities; 03.02-access-control-policy; 04.02-access-request-changes-and-offboarding; 04.03-change-management; 03.05-secure-development-policy; 04.09-internal-audit | 02.02-risk-register (R-0003); 02.03-risk-treatment-plan (RTP-0004/0005/0006); access-register (ACC-0001–ACC-0018); internal-audit-program | ISO 27001:2022/A.5-organizational-controls/A.5.3-segregation-of-duties.md |
| A.5.4 | Management Responsibilities | Y | Framework and procedures in place; management review and internal audit cycles not yet completed. | Partial | Timo Andreas Bejan | 01.04-roles-responsibilities-and-authorities; 01.07-competence-awareness-and-training; 04.09-internal-audit; 04.10-management-review; 04.11-nonconformity-and-corrective-action | training-register; 07-records/2026/policy-acknowledgements/ | ISO 27001:2022/A.5-organizational-controls/A.5.4-management-responsibilities.md |
| A.5.5 | Contact with Authorities | Y | | Implemented | Timo Andreas Bejan | 04.05-incident-response; 01.04-roles-responsibilities-and-authorities | authorities-contact-register | ISO 27001:2022/A.5-organizational-controls/A.5.5-contact-with-authorities.md |
| A.5.6 | Contact with Special Interest Groups | Y | Small company; CISO monitors security advisories and vendor bulletins; formal group membership not warranted. | Partial | Timo Andreas Bejan | 01.07-competence-awareness-and-training | | ISO 27001:2022/A.5-organizational-controls/A.5.6-contact-with-special-interest-groups.md |
| A.5.7 | Threat Intelligence | Y | Threat awareness integrated into risk assessment and vulnerability management; dedicated threat intelligence tooling not warranted for company size. | Partial | Timo Andreas Bejan | 02.01-risk-management-methodology; 04.08-vulnerability-and-patching; 01.07-competence-awareness-and-training | | ISO 27001:2022/A.5-organizational-controls/A.5.7-threat-intelligence.md |
| A.5.8 | Information Security in Project Management | Y | | Implemented | Timo Andreas Bejan | template-project-security-checklist; 03.05-secure-development-policy; 04.02-access-request-changes-and-offboarding | customer-project-register; 07-records/2025/project-security-reviews/ | ISO 27001:2022/A.5-organizational-controls/A.5.8-information-security-in-project-management.md |
| A.5.9 | Inventory of Information and Other Associated Assets | Y | | Implemented | Timo Andreas Bejan | 03.03-asset-management-and-classification-policy | asset-register | ISO 27001:2022/A.5-organizational-controls/A.5.9-inventory-of-information-and-other-associated-assets.md |
| A.5.10 | Acceptable Use of Information and Other Associated Assets | Y | | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy; 03.14-ai-acceptable-use-policy | | ISO 27001:2022/A.5-organizational-controls/A.5.10-acceptable-use-of-information-and-other-associated-assets.md |
| A.5.11 | Return of Assets | Y | | Implemented | Timo Andreas Bejan | 04.01-people-onboarding-offboarding-and-third-parties; 04.02-access-request-changes-and-offboarding | access-register; asset-register | ISO 27001:2022/A.5-organizational-controls/A.5.11-return-of-assets.md |
| A.5.12 | Classification of Information | Y | | Implemented | Timo Andreas Bejan | 03.03-asset-management-and-classification-policy | | ISO 27001:2022/A.5-organizational-controls/A.5.12-classification-of-information.md |
| A.5.13 | Labelling of Information | Y | Labelling is implicit via folder structure and access controls (private repos, restricted Drive folders); formal labelling system not warranted for company size. | Partial | Timo Andreas Bejan | 03.03-asset-management-and-classification-policy | | ISO 27001:2022/A.5-organizational-controls/A.5.13-labelling-of-information.md |
| A.5.14 | Information Transfer | Y | | Implemented | Timo Andreas Bejan | 03.04-cryptography-and-secrets-policy; 03.01-acceptable-use-policy; template-project-security-checklist | 07-records/2026/supplier-agreements/ | ISO 27001:2022/A.5-organizational-controls/A.5.14-information-transfer.md |
| A.5.15 | Access Control | Y | | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 04.02-access-request-changes-and-offboarding | access-register | ISO 27001:2022/A.5-organizational-controls/A.5.15-access-control.md |
| A.5.16 | Identity Management | Y | | Implemented | Timo Andreas Bejan | 03.02-access-control-policy | access-register | ISO 27001:2022/A.5-organizational-controls/A.5.16-identity-management.md |
| A.5.17 | Authentication Information | Y | | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 03.04-cryptography-and-secrets-policy | | ISO 27001:2022/A.5-organizational-controls/A.5.17-authentication-information.md |
| A.5.18 | Access Rights | Y | | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 04.02-access-request-changes-and-offboarding; 03.15-segregation-of-duties-and-dual-control-policy | access-register | ISO 27001:2022/A.5-organizational-controls/A.5.18-access-rights.md |
| A.5.19 | Information Security in Supplier Relationships | Y | | Implemented | Timo Andreas Bejan | 03.06-supplier-management-policy | supplier-register; 07-records/2025/supplier-reviews/ | ISO 27001:2022/A.5-organizational-controls/A.5.19-information-security-in-supplier-relationships.md |
| A.5.20 | Addressing Information Security within Supplier Agreements | Y | | Implemented | Timo Andreas Bejan | 04.06-supplier-onboarding-and-review | supplier-register; 07-records/2025/supplier-reviews/; 07-records/2026/supplier-agreements/ | ISO 27001:2022/A.5-organizational-controls/A.5.20-addressing-information-security-within-supplier-agreements.md |
| A.5.21 | Managing Information Security in the ICT Supply Chain | Y | | Implemented | Timo Andreas Bejan | 03.06-supplier-management-policy; 04.06-supplier-onboarding-and-review | supplier-register; 07-records/2025/supplier-reviews/ | ISO 27001:2022/A.5-organizational-controls/A.5.21-managing-information-security-in-the-ict-supply-chain.md |
| A.5.22 | Monitoring, Review, and Change Management of Supplier Services | Y | | Implemented | Timo Andreas Bejan | 04.06-supplier-onboarding-and-review | supplier-register; 07-records/2025/supplier-reviews/ | ISO 27001:2022/A.5-organizational-controls/A.5.22-monitoring-review-and-change-management-of-supplier-services.md |
| A.5.23 | Information Security for Use of Cloud Services | Y | | Implemented (cloud-first; supplier controls; MFA; logging; risk-based exceptions; AI usage governed) | Timo Andreas Bejan | 03.06-supplier-management-policy; 03.14-ai-acceptable-use-policy | | ISO 27001:2022/A.5-organizational-controls/A.5.23-information-security-for-use-of-cloud-services.md |
| A.5.24 | Information Security Incident Management Planning and Preparation | Y | | Implemented | Timo Andreas Bejan | 04.05-incident-response; 03.07-incident-management-policy | incident-register; authorities-contact-register | ISO 27001:2022/A.5-organizational-controls/A.5.24-information-security-incident-management-planning-and-preparation.md |
| A.5.25 | Assessment and Decision on Information Security Events | Y | | Implemented | Timo Andreas Bejan | 04.05-incident-response | incident-register | ISO 27001:2022/A.5-organizational-controls/A.5.25-assessment-and-decision-on-information-security-events.md |
| A.5.26 | Response to Information Security Incidents | Y | | Implemented | Timo Andreas Bejan | 04.05-incident-response | incident-register | ISO 27001:2022/A.5-organizational-controls/A.5.26-response-to-information-security-incidents.md |
| A.5.27 | Learning from Information Security Incidents | Y | | Implemented | Timo Andreas Bejan | 04.05-incident-response; 04.11-nonconformity-and-corrective-action | incident-register | ISO 27001:2022/A.5-organizational-controls/A.5.27-learning-from-information-security-incidents.md |
| A.5.28 | Collection of Evidence | Y | | Implemented | Timo Andreas Bejan | 04.05-incident-response | 07-records/ | ISO 27001:2022/A.5-organizational-controls/A.5.28-collection-of-evidence.md |
| A.5.29 | Information Security During Disruption | Y | Proportionate to small (~7 person) remote consultancy; informal redundancy (local copies, fallback communication channels) rather than formal BCP. | Implemented | Timo Andreas Bejan | 03.08-business-continuity-and-availability-policy; 04.05-incident-response | | ISO 27001:2022/A.5-organizational-controls/A.5.29-information-security-during-disruption.md |
| A.5.30 | ICT Readiness for Business Continuity | Y | Cloud-first model with SaaS provider resilience; local copies on developer machines; formal DR runbook not warranted for company size. | Implemented | Timo Andreas Bejan | 03.08-business-continuity-and-availability-policy; 04.04-backup-and-restore | 07-records/2026/risk-acceptance/RA-2026-0001-no-independent-backups.md | ISO 27001:2022/A.5-organizational-controls/A.5.30-ict-readiness-for-business-continuity.md |
| A.5.31 | Legal, Statutory, Regulatory, and Contractual Requirements | Y | | Implemented | Timo Andreas Bejan | 01.02-context-and-interested-parties; 03.12-privacy-and-pii-policy; template-project-security-checklist | | ISO 27001:2022/A.5-organizational-controls/A.5.31-legal-statutory-regulatory-and-contractual-requirements.md |
| A.5.32 | Intellectual Property Rights | Y | | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy | Customer contracts (IP clauses); devplant GitHub (DP WAT IP) | ISO 27001:2022/A.5-organizational-controls/A.5.32-intellectual-property-rights.md |
| A.5.33 | Protection of Records | Y | | Implemented | Timo Andreas Bejan | 01.05-control-of-documented-information | GitHub repository (primary); Google Drive (secondary copy) | ISO 27001:2022/A.5-organizational-controls/A.5.33-protection-of-records.md |
| A.5.34 | Privacy and Protection of Personal Identifiable Information (PII) | Y | | Implemented | Timo Andreas Bejan | 03.12-privacy-and-pii-policy; 04.05-incident-response (72-hour notification); template-project-security-checklist | 07-records/2025/project-security-reviews/ (DPA tracking per project); authorities-contact-register (ANSPDCP contact) | ISO 27001:2022/A.5-organizational-controls/A.5.34-privacy-and-protection-of-personal-identifiable-information-pii.md |
| A.5.35 | Independent Review of Information Security | Y | | Implemented | Timo Andreas Bejan | 04.09-internal-audit | UP QUALITY (external) performs independent review; internal audits supplement | ISO 27001:2022/A.5-organizational-controls/A.5.35-independent-review-of-information-security.md |
| A.5.36 | Compliance with Policies, Rules, and Standards for Information Security | Y | | Implemented | Timo Andreas Bejan | 04.09-internal-audit; 04.11-nonconformity-and-corrective-action | 07-records/ (audit reports) | ISO 27001:2022/A.5-organizational-controls/A.5.36-compliance-with-policies-rules-and-standards-for-information-security.md |
| A.5.37 | Documented Operating Procedures | Y | | Implemented | Timo Andreas Bejan | 04-procedures/ | doc-register | ISO 27001:2022/A.5-organizational-controls/A.5.37-documented-operating-procedures.md |
| A.6.1 | Screening | Y | | Implemented | Timo Andreas Bejan | 04.01-people-onboarding-offboarding-and-third-parties | 07-records/ (screening evidence) | ISO 27001:2022/A.6-people-controls/A.6.1-screening.md |
| A.6.2 | Terms and Conditions of Employment | Y | | Implemented | Timo Andreas Bejan | 04.01-people-onboarding-offboarding-and-third-parties | Employment contracts; contractor agreements | ISO 27001:2022/A.6-people-controls/A.6.2-terms-and-conditions-of-employment.md |
| A.6.3 | Information Security Awareness, Education, and Training | Y | | Implemented | Timo Andreas Bejan | 01.07-competence-awareness-and-training; 04.01-people-onboarding-offboarding-and-third-parties | training-register; 07-records/ | ISO 27001:2022/A.6-people-controls/A.6.3-information-security-awareness-education-and-training.md |
| A.6.4 | Disciplinary Process | Y | Enforcement clause in AUP; formal HR disciplinary procedure follows Romanian labor law. | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy | | ISO 27001:2022/A.6-people-controls/A.6.4-disciplinary-process.md |
| A.6.5 | Responsibilities After Termination or Change of Employment | Y | | Implemented | Timo Andreas Bejan | 04.01-people-onboarding-offboarding-and-third-parties; 04.02-access-request-changes-and-offboarding | access-register | ISO 27001:2022/A.6-people-controls/A.6.5-responsibilities-after-termination-or-change-of-employment.md |
| A.6.6 | Confidentiality or Non-disclosure Agreements | Y | | Implemented | Timo Andreas Bejan | 04.01-people-onboarding-offboarding-and-third-parties | Employment contracts; NDAs | ISO 27001:2022/A.6-people-controls/A.6.6-confidentiality-or-non-disclosure-agreements.md |
| A.6.7 | Remote Working | Y | | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy; 03.02-access-control-policy | | ISO 27001:2022/A.6-people-controls/A.6.7-remote-working.md |
| A.6.8 | Information Security Event Reporting | Y | | Implemented | Timo Andreas Bejan | 03.07-incident-management-policy; 04.05-incident-response | incident-register | ISO 27001:2022/A.6-people-controls/A.6.8-information-security-event-reporting.md |
| A.7.1 | Physical Security Perimeters | Y | Physical premises managed by DP COWORKING SRL (related entity); private offices with access control. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | DP COWORKING SRL agreement | ISO 27001:2022/A.7-physical-controls/A.7.1-physical-security-perimeters.md |
| A.7.2 | Physical Entry | Y | Digital locks and access control managed by DP COWORKING SRL; access granted to DP WAT personnel. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | DP COWORKING SRL agreement | ISO 27001:2022/A.7-physical-controls/A.7.2-physical-entry.md |
| A.7.3 | Securing Offices, Rooms, and Facilities | Y | Private locked offices at DP COWORKING SRL premises. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | | ISO 27001:2022/A.7-physical-controls/A.7.3-securing-offices-rooms-and-facilities.md |
| A.7.4 | Physical Security Monitoring | Y | Security camera on office door managed by DP COWORKING SRL. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | | ISO 27001:2022/A.7-physical-controls/A.7.4-physical-security-monitoring.md |
| A.7.5 | Protecting Against Physical and Environmental Threats | Y | Building protection (fire, flood) managed by DP COWORKING SRL as landlord. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | | ISO 27001:2022/A.7-physical-controls/A.7.5-protecting-against-physical-and-environmental-threats.md |
| A.7.6 | Working in Secure Areas | Y | Private office is secure area; visitor escort rules in place. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | | ISO 27001:2022/A.7-physical-controls/A.7.6-working-in-secure-areas.md |
| A.7.7 | Clear Desk and Clear Screen | Y | | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy; 03.01-acceptable-use-policy | | ISO 27001:2022/A.7-physical-controls/A.7.7-clear-desk-and-clear-screen.md |
| A.7.8 | Equipment Siting and Protection | Y | Laptops with FileVault encryption; do not leave unattended in public. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy; 03.01-acceptable-use-policy | | ISO 27001:2022/A.7-physical-controls/A.7.8-equipment-siting-and-protection.md |
| A.7.9 | Security of Assets Off-premises | Y | Remote work covered by AUP; encryption, screen lock, sane networks required. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy; 03.01-acceptable-use-policy | | ISO 27001:2022/A.7-physical-controls/A.7.9-security-of-assets-off-premises.md |
| A.7.10 | Storage Media | Y | External storage (USB/HDD) prohibited without CISO approval. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy; 03.01-acceptable-use-policy | | ISO 27001:2022/A.7-physical-controls/A.7.10-storage-media.md; [2025→2026 change: was N/A in old SoA; now Y with prohibition policy approach] |
| A.7.11 | Supporting Utilities | N | No DP WAT-owned infrastructure requiring utility protection; cloud-first model. | N/A | Timo Andreas Bejan | 03.11-physical-security-policy | | ISO 27001:2022/A.7-physical-controls/A.7.11-supporting-utilities.md; [2025→2026 change: was Y in old SoA; now N/A — justified by transition to fully cloud-first model with no owned server infrastructure] |
| A.7.12 | Cabling Security | N | No DP WAT-owned network infrastructure; network managed by DP COWORKING and treated as zero trust. | N/A | Timo Andreas Bejan | 03.11-physical-security-policy | | ISO 27001:2022/A.7-physical-controls/A.7.12-cabling-security.md |
| A.7.13 | Equipment Maintenance | Y | Apple warranty for hardware issues; devices are expendable and replaced if damaged/stolen. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | asset-register | ISO 27001:2022/A.7-physical-controls/A.7.13-equipment-maintenance.md |
| A.7.14 | Secure Disposal or Re-use of Equipment | Y | Full wipe via Apple device management before disposal or reassignment. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | asset-register | ISO 27001:2022/A.7-physical-controls/A.7.14-secure-disposal-or-re-use-of-equipment.md |
| A.8.1 | User End Point Devices | Y | Company-owned devices: Apple MDM + FileVault; BYOD: written acknowledgement of encryption/screen lock; customer-owned: risk-assessed as third-party assets. | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy; 03.11-physical-security-policy; 04.01-people-onboarding-offboarding-and-third-parties | asset-register | ISO 27001:2022/A.8-technological-controls/A.8.1-user-end-point-devices.md |
| A.8.2 | Privileged Access Rights | Y | Privileged roles restricted to named individuals; MFA required; annual access reviews. | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 03.15-segregation-of-duties-and-dual-control-policy | access-register | ISO 27001:2022/A.8-technological-controls/A.8.2-privileged-access-rights.md |
| A.8.3 | Information Access Restriction | Y | Least privilege; access request/approval process; private repos and restricted folders. | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 04.02-access-request-changes-and-offboarding | access-register | ISO 27001:2022/A.8-technological-controls/A.8.3-information-access-restriction.md |
| A.8.4 | Access to Source Code | Y | Private GitHub repos; MFA required; least privilege with project-scoped access. | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy; 03.02-access-control-policy | access-register | ISO 27001:2022/A.8-technological-controls/A.8.4-access-to-source-code.md |
| A.8.5 | Secure Authentication | Y | MFA mandatory; unique accounts per user; passwords in approved managers (iCloud Keychain, 1Password). | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 03.04-cryptography-and-secrets-policy | | ISO 27001:2022/A.8-technological-controls/A.8.5-secure-authentication.md |
| A.8.6 | Capacity Management | Y | DP WAT SaaS tools: cloud providers handle capacity. Customer environments: monitoring and alerts in place; recommendations provided. | Implemented | Timo Andreas Bejan | 03.06-supplier-management-policy | | ISO 27001:2022/A.8-technological-controls/A.8.6-capacity-management.md |
| A.8.7 | Protection Against Malware | Y | Apple devices with built-in protections (XProtect, Gatekeeper, MRT); no additional endpoint protection (risk accepted R-0005). | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | 02.02-risk-register (R-0005) | ISO 27001:2022/A.8-technological-controls/A.8.7-protection-against-malware.md |
| A.8.8 | Management of Technical Vulnerabilities | Y | Automated patching via MDM; Dependabot alerts on all repos; AWS alerting for customer environments. Alert-based response; no proactive scanning. | Implemented | Timo Andreas Bejan | 03.10-vulnerability-management-policy; 04.08-vulnerability-and-patching | | ISO 27001:2022/A.8-technological-controls/A.8.8-management-of-technical-vulnerabilities.md |
| A.8.9 | Configuration Management | Y | Infrastructure as code on all projects; no plaintext credentials (AWS Secrets Manager, Azure KeyVault, etc.); developer credentials in iCloud Keychain. | Implemented | Timo Andreas Bejan | 03.04-cryptography-and-secrets-policy; 03.05-secure-development-policy | | ISO 27001:2022/A.8-technological-controls/A.8.9-configuration-management.md |
| A.8.10 | Information Deletion | Y | Equipment disposal: full wipe via MDM; offboarding: confirm deletion from BYOD; customer data: deleted per contract requirements at contract end. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy; 04.01-people-onboarding-offboarding-and-third-parties | Customer contracts | ISO 27001:2022/A.8-technological-controls/A.8.10-information-deletion.md |
| A.8.11 | Data Masking | Y | Prefer synthetic/anonymized test data; minimize production data on local machines; customer masking requirements followed per contract. | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | | ISO 27001:2022/A.8-technological-controls/A.8.11-data-masking.md |
| A.8.12 | Data Leakage Prevention | Y | No formal DLP tooling (proportionate to size; risk accepted R-0006); controls via AUP, private repos, MFA, least privilege, external storage prohibited. | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy; 03.02-access-control-policy | 02.02-risk-register (R-0006) | ISO 27001:2022/A.8-technological-controls/A.8.12-data-leakage-prevention.md |
| A.8.13 | Information Backup | Y | Deliberate choice: SaaS provider replication + local copies on dev machines; no independent backup system (risk accepted). | Implemented | Timo Andreas Bejan | 04.04-backup-and-restore; 03.08-business-continuity-and-availability-policy | 07-records/2026/risk-acceptance/RA-2026-0001-no-independent-backups.md | ISO 27001:2022/A.8-technological-controls/A.8.13-information-backup.md |
| A.8.14 | Redundancy of Information Processing Facilities | Y | DP WAT tools: SaaS provider redundancy (risk accepted). Customer environments: automatic backups (S3, DB snapshots, time travel, etc.). | Implemented | Timo Andreas Bejan | 03.08-business-continuity-and-availability-policy | 07-records/2026/risk-acceptance/RA-2026-0001-no-independent-backups.md | ISO 27001:2022/A.8-technological-controls/A.8.14-redundancy-of-information-processing-facilities.md; [2025→2026 change: was N/A in old SoA; now Y — addressed via SaaS provider redundancy reliance with documented risk acceptance] |
| A.8.15 | Logging | Y | DP WAT systems: audit logs enabled (Google Workspace, GitHub, Cloudflare). Customer environments: logging implemented per customer requirements/budget. | Implemented | Timo Andreas Bejan | 03.02-access-control-policy | | ISO 27001:2022/A.8-technological-controls/A.8.15-logging.md |
| A.8.16 | Monitoring Activities | Y | DP WAT tools: audit logs spot-checked during periodic access reviews and quarterly log reviews. Customer environments: alerts in place (especially AWS). | Implemented | Timo Andreas Bejan | 03.02-access-control-policy; 04.07-log-review | | ISO 27001:2022/A.8-technological-controls/A.8.16-monitoring-activities.md |
| A.8.17 | Clock Synchronization | Y | macOS uses NTP by default; SaaS and cloud providers handle their own clock synchronization. | Implemented | Timo Andreas Bejan | | OS default; cloud provider managed | ISO 27001:2022/A.8-technological-controls/A.8.17-clock-synchronization.md |
| A.8.18 | Use of Privileged Utility Programs | Y | Developers have admin rights (required for dev work; risk accepted R-0004); source of truth is cloud/GitHub. | Implemented | Timo Andreas Bejan | 03.11-physical-security-policy | 02.02-risk-register (R-0004) | ISO 27001:2022/A.8-technological-controls/A.8.18-use-of-privileged-utility-programs.md |
| A.8.19 | Installation of Software on Operational Systems | Y | Dev machines: developers install as needed (risk accepted R-0004). Customer production: change management applies. | Implemented | Timo Andreas Bejan | 04.03-change-management | 02.02-risk-register (R-0004) | ISO 27001:2022/A.8-technological-controls/A.8.19-installation-of-software-on-operational-systems.md |
| A.8.20 | Network Security | Y | Zero trust model (all networks treated as untrusted); no owned infrastructure; TLS for all communications. | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy; 03.11-physical-security-policy | | ISO 27001:2022/A.8-technological-controls/A.8.20-network-security.md |
| A.8.21 | Security of Network Services | Y | Network services provided by SaaS vendors and DP COWORKING; treated as zero trust; no DP WAT-managed network services. | Implemented | Timo Andreas Bejan | 03.01-acceptable-use-policy; 03.06-supplier-management-policy | | ISO 27001:2022/A.8-technological-controls/A.8.21-security-of-network-services.md |
| A.8.22 | Segregation of Networks | N | No owned network infrastructure; zero trust model treats all networks as untrusted, making network segregation irrelevant. | N/A | Timo Andreas Bejan | 03.01-acceptable-use-policy | | ISO 27001:2022/A.8-technological-controls/A.8.22-segregation-of-networks.md |
| A.8.23 | Web Filtering | Y | No technical web filtering (impractical for dev work; risk accepted R-0007); addressed via security awareness training. | Implemented | Timo Andreas Bejan | 01.07-competence-awareness-and-training | training-register; 02.02-risk-register (R-0007) | ISO 27001:2022/A.8-technological-controls/A.8.23-web-filtering.md |
| A.8.24 | Use of Cryptography | Y | FileVault (AES-256) for devices; secrets in approved managers (AES-256-GCM); TLS 1.2+ for transit; relies on provider-implemented cryptography. | Implemented | Timo Andreas Bejan | 03.04-cryptography-and-secrets-policy | | ISO 27001:2022/A.8-technological-controls/A.8.24-use-of-cryptography.md |
| A.8.25 | Secure Development Life Cycle | Y | Secure development policy in place; risk-based code review (R-0008); MFA on repos; dependency management; security testing per project risk. | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | 02.02-risk-register (R-0008) | ISO 27001:2022/A.8-technological-controls/A.8.25-secure-development-life-cycle.md |
| A.8.26 | Application Security Requirements | Y | Project security checklist captures requirements; customer requirements addressed per project. | Implemented | Timo Andreas Bejan | template-project-security-checklist; 03.05-secure-development-policy | 07-records/ (completed checklists) | ISO 27001:2022/A.8-technological-controls/A.8.26-application-security-requirements.md |
| A.8.27 | Secure System Architecture and Engineering Principles | Y | Defense in depth; secure defaults; least privilege via IaC; fail secure; input validation; standard stack (AWS/Terraform/ECS). | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | | ISO 27001:2022/A.8-technological-controls/A.8.27-secure-system-architecture-and-engineering-principles.md |
| A.8.28 | Secure Coding | Y | Static code analysis; IDE/GitHub dependency alerts; risk-based code review (R-0008); input validation; secrets handling. | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | 02.02-risk-register (R-0008) | ISO 27001:2022/A.8-technological-controls/A.8.28-secure-coding.md |
| A.8.29 | Security Testing in Development and Acceptance | Y | Static analysis; pen testing (FOX SYSTEMS); unit/integration/e2e/manual QA; coverage per project risk (R-0009); third-party dependencies chosen based on experience (reputable libraries only). | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | supplier-register (SUP-0016); 02.02-risk-register (R-0009) | ISO 27001:2022/A.8-technological-controls/A.8.29-security-testing-in-development-and-acceptance.md |
| A.8.30 | Outsourced Development | Y | DP WAT engages contractors (PFAs/companies) for development; contractors sign policy acknowledgements and NDAs/DPAs; subject to onboarding/offboarding procedure; access time-bound and reviewed. | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy; 04.01-people-onboarding-offboarding-and-third-parties | 07-records/2026/policy-acknowledgements/ (contractor ACKs) | ISO 27001:2022/A.8-technological-controls/A.8.30-outsourced-development.md |
| A.8.31 | Separation of Development, Test, and Production Environments | Y | Separate AWS accounts where feasible; at minimum separate data layer; IaC defines environments; production credentials/data not used in non-production; audit gap accepted (R-0010). | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | 02.02-risk-register (R-0010) | ISO 27001:2022/A.8-technological-controls/A.8.31-separation-of-development-test-and-production-environments.md; [2025→2026 change: was N/A in old SoA; now Y — properly documented with separation practices and risk acceptance for gaps] |
| A.8.32 | Change Management | Y | Change management procedure covers standard/normal/emergency changes; risk assessment; rollback plans; SoD for high-risk changes; post-implementation review; stakeholder communication via Slack/email. | Implemented | Timo Andreas Bejan | 04.03-change-management; 03.15-segregation-of-duties-and-dual-control-policy | 07-records/ (change records) | ISO 27001:2022/A.8-technological-controls/A.8.32-change-management.md |
| A.8.33 | Test Information | Y | Prefer synthetic/anonymized test data; production data access minimized; test environments ephemeral (CI/Docker) - data disposed when torn down; access controls apply; environment separation per A.8.31. | Implemented | Timo Andreas Bejan | 03.05-secure-development-policy | | ISO 27001:2022/A.8-technological-controls/A.8.33-test-information.md |
| A.8.34 | Protection of Information Systems During Audit Testing | Y | Audit scope agreed in advance; external auditors get supervised side-by-side access only (CISO shows what's needed); no unsupervised system access; pen testing scoped per customer project. | Implemented | Timo Andreas Bejan | 04.09-internal-audit | | ISO 27001:2022/A.8-technological-controls/A.8.34-protection-of-information-systems-during-audit-testing.md |