Frameworks · Global
Annex A asks for change management, secure development and directed outsourced development. Aspian Cloud keeps the records for A.8.32, A.8.9, A.8.25 to A.8.31 and A.8.15 as the work happens.
- Instrument
- ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements (Annex A, with guidance in ISO/IEC 27002:2022)
- In force
- Published October 2022; transition from the 2013 edition ended 31 October 2025
- For
- Organisations with, or working towards, ISO/IEC 27001 certification.
| Clause | What it requires | Evidenced by |
|---|---|---|
| A.8.32 | Changes to information processing facilities and systems follow change management procedures.Source: isms.online | Change records for every production change, with approvals, evidence and the backout plan. |
| A.8.9 | Security configurations of hardware, software, services and networks are established, documented, implemented, monitored and reviewed.Source: ce.prod.cloudaware.com | Environment snapshots and repository baselines: what is configured and running, and any regression as a failing check. |
| A.8.25 / A.8.28 | Rules for securely developing software and systems are set and applied, and secure coding principles are applied in development.Source: isms.online | The policy pack version applied to each change, and the guard results from git hooks and agent tool calls. |
| A.8.30 / A.8.31 / A.8.15 | Outsourced development is directed, monitored and reviewed; development, test and production environments are separated; activity logs are produced, protected and analysed.Source: isms.online | Engagement records, phase-gate sign-offs and the handover pack for outsourced work; separated environments by promotion order; the signed audit chain. |
Clause references and requirements were read on 8 November 2026. The standard is paywalled or the official site refused access, so references were confirmed from reputable secondary sources. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.