Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control and ISO 27001

Physical enforcement of Annex A controls.

ISO 27001 requires organisations to implement appropriate controls from Annex A. Control adds physical enforcement for segmentation, access control and business continuity.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The problem

Demonstrating control effectiveness is difficult.

Annex A controls are judged at audit, but they have to hold every day in between.

  1. Annex A controls for segmentation and access are enforced physically.

  2. Authorisations, sessions and revocations are logged in tamper-evident form.

  3. Automated logging supports Statement of Applicability controls between surveillance audits.

The mapping

Where Annex A controls meet Control modules.

ISO/IEC 27001:2022 Annex A controls, each mapped to the modules that enforce or evidence it.

Annex A control Control modules How Control helps
A.5.14Information transfer
  • Transfer
  • Validate
 Inter-zone data movement is a governed Transfer event with inventory and evidence.
A.5.15Access control
  • Lock
  • Relay
 Reach is named, scoped and time-bound, not standing.
A.5.16Identity management
  • Unlink
 Departures and changes revoke standing trust at the boundary.
A.6.8Information security event reporting
  • Anchor
  • Validate
 Reportable events are recorded in tamper-evident form and sealed offline.
A.8.13Information backup
  • Anchor
  • Transfer
 Backups sit in an offline vault, off the live network.
A.8.16Monitoring activities
  • Validate
 Conduit and vault state is continuously attested, signed and stored offline.
A.8.20Network security
  • Fracture
  • Isolate
 Zone boundaries are physically severed by default.
A.8.22Segregation of networks
  • Isolate
  • Relay
 Cross-zone reach is a named Relay session, not a permanent route.

Alignment, not certification. Control can help support these measures; your assessor decides what satisfies them.

The scenario

Scenario: a surveillance audit with physical evidence.

Firewall rules are a configuration. Boundary state logs are a record. Step through it, or play it through.

Step 1 of 2

Without physical evidence

An auditor examines network segmentation under A.8.22.

The evidence offered is the current firewall rule set: a snapshot of intent, not a record of what held.

Boundaries
Logical, configured in software
Evidence
Point-in-time, at each audit

An illustrative scenario.

Capabilities

What you get with every deployment.

Six things Control gives a ISO 27001 programme, from the first boundary to the audit afterwards.

ISO 27001

Physical control enforcement

Annex A controls for segmentation and access are enforced physically.

ISO 27001

Access control evidence

Authorisations, sessions and revocations are logged in tamper-evident form.

ISO 27001

Continuous ISMS evidence

Automated logging supports Statement of Applicability controls between surveillance audits.

ISO 27001

Segmentation assurance

Physical segmentation provides evidence of zone separation for A.8.22.

ISO 27001

Audit-ready documentation

Logs and automated reports support certification and surveillance audits.

ISO 27001

Recovery assurance

Verified control-plane baselines support ICT readiness for business continuity.

Adoption guide

From gap assessment to continuous evidence.

  1. 1

    SoA mapping assessment

    Map your Statement of Applicability against Control module capabilities.

  2. 2

    Control architecture design

    Design physical enforcement for priority controls, starting with segmentation and access control.

  3. 3

    Pre-audit validation

    Deploy and validate evidence generation before your next surveillance audit.

  4. 4

    ISMS integration

    Integrate fully, with continuous evidence, automated reporting and tamper-evident record preservation.

Questions

What teams ask about Control and ISO 27001

The mapping lists the main ones: A.5.14, A.5.15, A.5.16, A.6.8, A.8.13, A.8.16, A.8.20 and A.8.22.

No. Your ISMS stays. Control provides physical enforcement and evidence for the controls it maps to.

Instead of a snapshot, you show the boundary state log for the whole period, with every conduit activation and its approval.

The mapping uses the 2022 Annex A numbering, so the evidence lines up with the controls you are transitioning to.

All questions

Map Control to your regulator’s language.

Walk through ISO 27001 with the Firevault team and see where physical evidence fits your programme. Alignment, not certification.