BY NEURABYTE
FRAMEWORKS/SECURITY/ISO 27001
27001
SECURITY · ISO / IEC

ISO 27001

The international standard for an information security management system.

ISO 27001 certifies that you run an information security management system (ISMS): a documented, risk-driven process for choosing and operating controls. Annex A lists 93 controls across organizational, people, physical, and technological themes. Certification comes from an accredited body after a two-stage audit.

AT A GLANCE
ISSUERISO / IEC REGIONInternational CATEGORYSecurity CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Companies selling into Europe, the UK, APAC, or the public sector
02Vendors whose customers require a certificate rather than an attestation report
03Organizations that want one management system to feed several frameworks
02. KEY REQUIREMENTS

The parts of ISO 27001 that touch what agents do.

Clause 6 Risk assessment
Risks are identified, scored, and tied to the controls selected to treat them.
A.5.15 Access control
Rules for logical and physical access are defined and enforced based on business and security requirements.
A.8.15 Logging
Logs recording activities, exceptions, and events are produced, protected, and reviewed.
A.8.10 Information deletion
Information is deleted when no longer required, and deletion can be demonstrated.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against ISO 27001. Where there is no evidence, the report says gap.

LORE CONTROL ISO 27001 REFERENCE
Blocking authorization gateA.5.15, A.8.3
Maker–checker approvalA.5.3, A.8.32
Signed, hash-chained receiptsA.8.15, A.8.16
Provable deletionA.8.10
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

The ISMS itself, including policy documents, management review, and internal audit, is an organizational obligation.
Physical and people controls (A.6, A.7) are outside the platform.
05. QUESTIONS
How does this differ from SOC 2?
SOC 2 is an auditor's opinion on controls; ISO 27001 certifies a management system. Many organizations do both. The Lore evidence serves both crosswalks.
Do we need a Statement of Applicability?
Yes, and it is yours to write. The crosswalk shows which Annex A controls have Lore evidence behind them, which makes the SoA faster to justify.
Is the 2022 revision covered?
The crosswalk is written against ISO/IEC 27001:2022 and its 93-control Annex A.
← PREVIOUSSOC 2 ALL FRAMEWORKS NEXT →NIST CSF 2.0
ISO 27001 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for ISO 27001 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.