Operate and evidence ISO/IEC 27001:2022 controls
An ISMS stands on controls that run every day, not just in audit season. Ciyora runs many of the technological and organizational controls in Annex A and keeps the records your certification body will ask to see.
About the standard
ISO/IEC 27001:2022 specifies the requirements for an information security management system. Its Annex A lists 93 controls in four themes: organizational, people, physical and technological. Certification is granted by an accredited certification body after an audit of your ISMS; software cannot grant it.
The table below lists the Annex A controls where Ciyora provides the most direct support.
How Ciyora maps to the requirement areas
Each row names a control area, what Ciyora does for it, and the evidence it can produce. Your own policies, people and processes still matter: the platform helps you operate and evidence the controls.
| Requirement area | How Ciyora helps | Evidence you can produce | Modules |
|---|---|---|---|
| 5.3 Segregation of duties | SoD policies, preventive checks on requests, detective scans and exceptions. | SoD violation and exception reports. | Fortress |
| 5.9 Inventory of information and other associated assets | Asset inventory from agents, scans and cloud accounts, with owners; SaaS catalogue. | Asset inventory with owner, source and risk. | Discover |
| 5.15 to 5.18 Access control, identity management, authentication information, access rights | Identity lifecycle from HR, access requests and approvals, periodic access reviews, credential vault and rotation. | Access review evidence packs, joiner-mover-leaver reports, rotation history. | Fortress, Comply |
| 5.23 Information security for use of cloud services | Cloud posture checks and cloud entitlement analysis. | Posture findings, control pass rates and right-sizing decisions. | Armor |
| 5.7 Threat intelligence | Threat feeds, indicator search and matches against your telemetry. | Feed status and indicator matches. | Detect |
| 5.24 to 5.28 Information security incident management | Incident queue, correlation, timelines, response actions and evidence collection. | Incident records with timelines and actions. | Detect |
| 8.2 Privileged access rights | Just-in-time elevation, break-glass with multiple approvers, recorded privileged sessions. | Privileged access reports and session recordings. | Fortress |
| 8.5 Secure authentication | Single sign-on with your identity provider; security-key step-up for revealing credentials. | SSO configuration and step-up records. | Fortress |
| 8.8 Management of technical vulnerabilities | Vulnerabilities ranked by CVSS, EPSS and CISA KEV; scans and attack-surface discovery. | Vulnerability status over time. | Discover |
| 8.9 Configuration management | Cloud configuration checks against CIS benchmarks with remediation steps. | Posture history and findings workflow. | Armor |
| 8.12 Data leakage prevention | Endpoint events for file transfers, USB devices and AI tools, with employee notices built in. | Data-protection events and violations. | Monitor |
| 8.15 Logging and 8.16 Monitoring activities | Central log collection and search, detection rules mapped to ATT&CK, hash-chained audit log. | Log search, detection coverage, audit chain verification. | Detect, Comply |
| 8.20 Networks security and 8.22 Segregation of networks | Zero-trust network access with deny-by-default policy by identity, group and device tag. | Versioned network policy and route approvals. | VPN |
Please note. Ciyora is not a certification and does not make an organization compliant on its own. This page describes how Ciyora capabilities map to requirement areas and help you produce evidence. Always read the current text of the regulation or standard and take advice from your compliance team, auditors or legal counsel.
Walk through your control set with us
Bring your latest audit observations or gap assessment, and we will show where Ciyora fits and where it does not.