ISO/IEC 27001:2022 control mapping

Where each Annex A control is satisfied in the product, and where the evidence lives. This is the page you hand to the auditor first.

18 demonstrated5 partial2 production scope

Scope of this mapping

25 of the 93 Annex A controls are in scope for this product. The rest — awareness training, physical security, business continuity, secure development — belong to the wider ISMS and no file-transfer tool can claim them. Controls marked production scope are real requirements that a prototype without a backend cannot demonstrate; they are listed so nothing is quietly omitted.

How this replaces consumer cloud storage

A Dropbox link fails audit on five points: no recorded recipient identity, no classification, no approval, no expiry or revocation, and no immutable log. Each row below closes one of those gaps and points to the screen that demonstrates it.

Who received it

A.5.15 · A.5.19 · A.8.15

Recipients are named individuals in the vendor registry, identity-verified by OTP before access. Every open and download is attributed to a person, IP and device.

Whether they should have

A.5.12 · A.5.14 · A.5.20 · A.8.3

Classification ceilings per vendor tier and NDA validity are checked before the link exists. Confidential and above require a documented manager approval.

What happens afterwards

A.5.18 · A.8.10 · A.8.12 · A.8.16

Links expire, downloads are capped, access is revocable in one click, and retention schedules drive disposal. Forward and print attempts are refused and logged.

Control	Annex A title	Implementation in SecureTrace	Evidence	Demo
A.5.10	Acceptable use of information and other associated assets	Handling acknowledgement gate before any vendor download	1 event	Open
A.5.11	Return of assets	Destruction of vendor-side copies is requested at expiry and tracked to confirmation	1 event	Open
A.5.12	Classification of information	Classification is mandatory at upload — files cannot exist unclassified	1 event	Open
A.5.13	Labelling of information	Persistent classification badge plus identity watermark on every preview	1 event	Open
A.5.14	Information transfer	Transfer wizard enforcing purpose, recipient rules, agreement and approval	12 events	Open
A.5.15	Access control	Per-recipient policy: view-only, download ceiling, domain lock, expiry	1 event	Open
A.5.16	Identity management	Recipients are named, verified individuals in the vendor registry — never a shared link	1 event	Open
A.5.18	Access rights	Expiry, download ceilings and one-click revocation of an issued link	3 events	Open
A.5.19	Information security in supplier relationships	Vendor registry with risk tier and scheduled security review	1 event	Open
A.5.20	Addressing information security within supplier agreements	NDA validity checked before a transfer can be created — expired NDA blocks the send	3 events	Open
A.5.21	Managing information security in the ICT supply chain	Applies to the platform's own hosting and sub-processors, not to the design vendors — production scope, not shown here	—	Open
A.5.22	Monitoring, review and change management of supplier services	Per-vendor transfer history, blocked-event attribution and review scheduling	1 event	Open
A.5.23	Information security for use of cloud services	The reason this product exists: a sanctioned, governed channel that removes the need for unapproved consumer cloud storage, with endpoint DLP signals ingested as evidence	1 event	Open
A.5.28	Collection of evidence	Hash-sealed evidence pack export per transfer and across the whole log	1 event	Open
A.5.32	Intellectual property rights	Proprietary design data is classified, watermarked to the recipient and released only under a current agreement	1 event	Open
A.5.33	Protection of records	Append-only audit log, integrity-sealed and not deletable by any role	1 event	Open
A.5.34	Privacy and protection of PII	PII flag on classification; PII files restricted from release to lower-tier vendors	1 event	Open
A.8.3	Information access restriction	Classification ceiling per vendor tier; releases above the ceiling are refused unless an ISMS exception is recorded	1 event	Open
A.8.5	Secure authentication	One-time code to the registered address before a recipient can open anything	1 event	Open
A.8.7	Protection against malware	Files scanned on upload and on the vendor return channel before release	1 event	Open
A.8.10	Information deletion	Retention schedule per file and post-expiry disposal queue	1 event	Open
A.8.12	Data leakage prevention	Forward, print and out-of-policy send attempts are refused and logged	1 event	Open
A.8.15	Logging	Every event captures actor, timestamp, IP, device and location	1 event	Open
A.8.16	Monitoring activities	Anomaly detection on download velocity and geography, surfaced on the dashboard	1 event	Open
A.8.24	Use of cryptography	Encryption in transit and at rest, and key management — required in production, represented rather than performed in this prototype	—	Open

Management system clauses

Certification audits check Clauses 4–10, not only Annex A. These are the clauses this product produces evidence for.

Clause 7.5Documented informationClassification, retention and version history are captured as records, not as habits Clause 9.1Monitoring, measurement, analysis and evaluationTransfer, exception and blocked-event metrics produced continuously Clause 9.2Internal auditFilterable append-only log with signed extracts for the internal audit programme Clause 9.3Management reviewDraft management review narrative generated from the log, no manual collection

Mapping is indicative for this proposal and is not a statement of certification. Control identifiers and titles are quoted from ISO/IEC 27001:2022 Annex A; the claim that a given feature satisfies a control is ours, and final scope and applicability must be confirmed with the organisation's ISMS manager and lead auditor in the Statement of Applicability.