ISO/IEC 27001

What ISO/IEC 27001 is

ISO/IEC 27001:2022 is the international standard for an information security management system(ISMS) — the governance scaffolding an organization puts around protecting information, wherever it lives. It is a certifiable management-system standard, structured as management clauses 4–10 plus a set of reference controls in Annex A, organized into four themes: organizational, people, physical, and technological.

In practice the standard asks an organization to define its security policy, assign accountable roles, control access, protect its people and premises, secure its technology (networks, cryptography, logging, secure development), and manage its suppliers — then to keep evidence that it actually does these things, and to improve the system over time. It is a governance and assurance lens, not a threat taxonomy: where OWASP and MITRE ATLAS tell you what can go wrong, ISO 27001 asks whether you are running a system that would catch and manage it.

How Helmwart maps to it

Helmwart is a design-time threat-modeling tool, not an audit. It cannot make you certified to ISO 27001 — certification is an audited outcome of operating a management system, awarded by an accredited body. What Helmwart can do is show, control by control, which Annex A controls your threat model and placed mitigations actually bear on, and which are gaps — a coverage map you can fold into a Statement of Applicability, never a compliance verdict.

To turn this reference into a live coverage read against a specific system, model it on thecanvas and open the Compliance view — it scores each Annex A control as covered, at-risk, or not-present from the findings your design actually raises, and lists the mitigations that close each gap.

Annex A reference controls

The 93 Annex A:2022 controls across 4 themes (A.5–A.8). Controls that carry a design-time threat surface are tagged mappable and list the agentic threats they bear on; the rest are tagged organizational — real controls, but your process, not a Helmwart control.

The management-system clauses (4–10)

Annex A is only half the standard. The management-system requirements — the part you are actually certified against — live in clauses 4 through 10, and they are organizational by nature. Helmwart does not assess these; they are audited process, not design-time surface. They are listed here so you can see the whole shape of an ISMS, not just its reference controls.

• Clause 4Context of the organizationUnderstand the organization, interested parties and the scope of the ISMS.
• Clause 5LeadershipTop-management commitment, an information-security policy, and assigned roles and responsibilities.
• Clause 6PlanningActions to address risks and opportunities, security objectives, and the risk-assessment/treatment process.
• Clause 7SupportResources, competence, awareness, communication, and documented information.
• Clause 8OperationOperational planning and control, and running the risk-assessment and risk-treatment process.
• Clause 9Performance evaluationMonitoring, measurement, internal audit, and management review.
• Clause 10ImprovementHandling nonconformity and driving continual improvement of the ISMS.

Sources

• ISO/IEC 27001:2022 — Information security, cybersecurity & privacy protection ↗ · ISO · the authoritative standard (paywalled; purchase from ISO)
• Run the coverage against your model → · Helmwart Compliance · live per-control read from your canvas findings