> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Organization: Acme Inc

Contact: legal@acme.com

## Related Documents

- Information Security Policy (`INFORMATIONSECURITYPOLICY.md`)
- Risk Register (`RISK_REGISTER.md`)
- Access Control Policy (`ACCESSCONTROLPOLICY.md`)

> Disclaimer: This checklist is generated based on automated code analysis and is intended as a starting point for ISO 27001 compliance. It is not a substitute for a formal ISO 27001 certification audit or professional guidance. Engage a qualified certification body for your official assessment.

## 1. Overview

This checklist helps Acme Inc prepare for ISO 27001 certification by mapping detected services and infrastructure to the Annex A controls defined in ISO/IEC 27001:2022. Each section contains actionable items tailored to your project's technology stack.

ISO 27001 requires an Information Security Management System (ISMS) that addresses risks through a combination of organizational, people, physical, and technological controls.

Detected services: 8

Applicable Annex A domains: Technological Controls (A.8), Organizational Controls (A.5), People Controls (A.6), Physical Controls (A.7)

## 2. Service-to-Control Mapping

The following table maps each detected service to the applicable ISO 27001 Annex A control domains:

Detected Service | Category | Applicable Annex A Domains
--- | --- | ---
@sentry/node | Error Monitoring | Technological Controls (A.8), Organizational Controls (A.5)
@supabase/supabase-js | Authentication | Organizational Controls (A.5), Technological Controls (A.8)
openai | AI Service | Organizational Controls (A.5), People Controls (A.6), Technological Controls (A.8)
posthog | Analytics | Organizational Controls (A.5), Technological Controls (A.8)
prisma | Database | Technological Controls (A.8), Organizational Controls (A.5)
resend | Email Service | Organizational Controls (A.5), Technological Controls (A.8)
stripe | Payment Processing | Organizational Controls (A.5), Technological Controls (A.8)
stripe-ios | Payment Processing | Organizational Controls (A.5), Technological Controls (A.8)

## 3. Annex A Controls Checklist

### A.5 — Organizational Controls

Objective: Establish management direction and support for information security in accordance with business requirements and relevant laws and regulations.

#### A.5.1 — Policies for Information Security

- Establish an Information Security Management System (ISMS) policy
- Define and communicate the scope of the ISMS
- Obtain management commitment and sign-off
- Review information security policies at planned intervals (at least annually)

#### A.5.2 — Information Security Roles and Responsibilities

- Assign information security roles and responsibilities
- Appoint an Information Security Officer or equivalent
- Define segregation of duties for critical operations
- Document the organizational security structure

#### A.5.10 — Acceptable Use of Information and Assets

- Define acceptable use policies for information assets
- Communicate policies to all employees and contractors
- Include provisions for remote work and BYOD

#### A.5.12 — Classification of Information

- Define an information classification scheme (e.g., Public, Internal, Confidential, Restricted)
- Label all information assets according to the classification scheme
- Define handling procedures for each classification level

#### A.5.34 — Privacy and Protection of PII

Data-collecting services detected: posthog, openai

- Conduct a Privacy Impact Assessment (PIA/DPIA) for personal data processing
- Maintain a Record of Processing Activities (ROPA)
- Define lawful bases for personal data processing
- Implement data subject rights procedures (access, rectification, erasure)

#### A.5.19 — Information Security in Supplier Relationships

Payment services detected: stripe, stripe-ios

- Assess information security risks for all supplier relationships
- Include security requirements in supplier agreements
- Monitor and review supplier service delivery
- Maintain a supplier risk register

#### A.5.24 — Information Security Incident Management Planning

- Define an incident response plan with clear escalation procedures
- Assign incident response roles and responsibilities
- Conduct regular incident response drills
- Maintain an incident register with lessons learned

#### A.5.29 — Information Security During Disruption

- Develop a business continuity plan addressing information security
- Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
- Test business continuity plans at least annually

#### A.5.31 — Legal, Statutory, Regulatory, and Contractual Requirements

- Identify all applicable legal, regulatory, and contractual requirements
- Maintain a compliance register with obligation tracking
- Review compliance status at planned intervals

### A.6 — People Controls

Objective: Ensure that employees and contractors understand their responsibilities and are suitable for their roles.

#### A.6.1 — Screening

- Conduct background checks for all employees with access to sensitive systems
- Verify qualifications and references prior to employment
- Define screening requirements proportionate to classification of information accessed

#### A.6.2 — Terms and Conditions of Employment

- Include information security responsibilities in employment contracts
- Require non-disclosure agreements (NDAs) for employees and contractors
- Define acceptable use expectations in employment terms

#### A.6.3 — Information Security Awareness, Education, and Training

- Conduct security awareness training for all employees (at least annually)
- Provide role-specific security training for technical staff
- Track training completion and maintain records
- Include phishing awareness and social engineering exercises

#### A.6.4 — Disciplinary Process

- Define a disciplinary process for information security violations
- Communicate consequences of policy violations to all employees

#### A.6.5 — Responsibilities After Termination or Change of Employment

- Revoke access to all systems within 24 hours of termination
- Recover company assets (devices, badges, tokens) upon departure
- Remind departing employees of continuing confidentiality obligations

### A.7 — Physical Controls

Objective: Prevent unauthorized physical access, damage, and interference to the organization's information and information processing facilities.

#### A.7.1 — Physical Security Perimeters

- Define physical security perimeters for sensitive areas (server rooms, offices)
- Implement access control for secured areas (badge access, biometrics)
- Maintain visitor logs for all secured areas

#### A.7.2 — Physical Entry

- Restrict physical entry to authorized personnel only
- Monitor entry points with CCTV or equivalent
- Review physical access rights periodically

#### A.7.4 — Physical Security Monitoring

- Implement environmental monitoring (temperature, humidity, fire detection)
- Monitor for unauthorized physical access attempts
- Test physical security controls regularly

#### A.7.9 — Security of Assets Off-Premises

- Define policies for protecting equipment used outside the organization
- Encrypt all portable devices (laptops, USB drives)
- Implement remote wipe capability for mobile devices

#### A.7.10 — Storage Media

- Define procedures for secure disposal of storage media
- Maintain chain-of-custody records for media transfers
- Use secure erasure or physical destruction for decommissioned media

### A.8 — Technological Controls

Objective: Ensure that information security is implemented and operated within the technology environment.

#### A.8.1 — User Endpoint Devices

- Define policies for user endpoint devices (laptops, phones)
- Enforce disk encryption on all endpoints
- Implement endpoint detection and response (EDR) solutions
- Manage devices via MDM (Mobile Device Management)

#### A.8.2 — Privileged Access Rights

Authentication services detected: @supabase/supabase-js

- Restrict privileged access using the principle of least privilege
- Enforce multi-factor authentication (MFA) for all privileged accounts
- Review privileged access rights quarterly
- Log all privileged access activity
- Use just-in-time (JIT) access where possible

#### A.8.5 — Secure Authentication

- Enforce strong password policies (minimum 12 characters, complexity requirements)
- Implement account lockout after repeated failed attempts
- Use secure credential storage (hashing with bcrypt/argon2)
- Protect authentication tokens and session IDs

#### A.8.7 — Protection Against Malware

- Deploy anti-malware solutions on all endpoints and servers
- Implement application whitelisting where feasible
- Scan all file uploads for malware

#### A.8.8 — Management of Technical Vulnerabilities

- Run automated dependency vulnerability scanning (e.g., npm audit, Snyk, Dependabot)
- Conduct periodic penetration testing (at least annually)
- Maintain a vulnerability remediation SLA (critical: 24h, high: 7d, medium: 30d, low: 90d)
- Subscribe to vulnerability notification feeds for all technology in use

#### A.8.9 — Configuration Management

- Maintain hardened baseline configurations for all systems
- Automate configuration management (Infrastructure as Code)
- Monitor for configuration drift
- Review and update configurations at planned intervals

#### A.8.10 — Information Deletion

Data storage services detected: prisma

- Define data retention and deletion policies per data category
- Implement automated data purge processes for expired retention periods
- Verify deletion is complete and irreversible (including backups)
- Maintain deletion logs for compliance evidence

#### A.8.15 — Logging

- Enable logging on all critical systems and applications
- Protect log files from tampering and unauthorized access
- Centralize log collection (SIEM)
- Configure alerting in: @sentry/node
- Define log retention periods (minimum 12 months recommended)
- Review logs regularly for security events

#### A.8.20 — Networks Security

- Segment networks to isolate sensitive systems
- Implement firewall rules following the principle of least privilege
- Monitor network traffic for anomalies
- Use encrypted channels (TLS 1.2+) for all network communications

#### A.8.24 — Use of Cryptography

- Enforce TLS 1.2+ for all data in transit
- Enable encryption at rest for: prisma
- Document encryption standards and key management procedures
- Store encryption keys in a dedicated key management service (KMS)
- Rotate encryption keys on a defined schedule

#### A.8.25 — Secure Development Life Cycle

- Define a secure software development lifecycle (SSDLC) policy
- Require code review for all production changes
- Implement automated security testing in CI/CD pipelines (SAST, DAST)
- Separate development, staging, and production environments
- Conduct security architecture reviews for significant changes

#### A.8.28 — Secure Coding (AI-Specific)

AI services detected: openai

- Validate AI model inputs and outputs for safety and correctness
- Implement guardrails for AI-generated content (safety filters, output validation)
- Log AI processing decisions for auditability
- Document AI model provenance and training data lineage
- Conduct bias and fairness assessments for AI models

## 4. Implementation Roadmap

Phase | Duration | Activities
--- | --- | ---
Gap Analysis | 2-4 weeks | Assess current controls against ISO 27001 requirements
Risk Assessment | 2-4 weeks | Identify, analyze, and evaluate information security risks
ISMS Design | 4-8 weeks | Define ISMS scope, policies, and control objectives
Implementation | 8-16 weeks | Implement controls, procedures, and documentation
Internal Audit | 2-4 weeks | Conduct internal audit to verify ISMS effectiveness
Management Review | 1-2 weeks | Review ISMS performance and approve for certification
Stage 1 Audit | 1-2 weeks | Certification body reviews documentation and readiness
Stage 2 Audit | 1-2 weeks | Certification body verifies implementation and effectiveness

## 5. Statement of Applicability (SoA) Template

The Statement of Applicability documents which Annex A controls are applicable to your ISMS and the justification for inclusion or exclusion.

Control Domain | Applicable | Justification
--- | --- | ---
Organizational Controls (A.5) | Yes | Relevant services and data processing detected
People Controls (A.6) | Yes | Relevant services and data processing detected
Physical Controls (A.7) | Yes | Relevant services and data processing detected
Technological Controls (A.8) | Yes | Relevant services and data processing detected

> Note: All Annex A domains should be evaluated regardless of detected services. This template provides a starting point — your organization must assess applicability based on the full risk assessment.

## 6. Next Steps

1. Appoint an ISMS owner responsible for driving the certification process.
2. Define the ISMS scope — which business units, locations, and systems are included.
3. Conduct a risk assessment to identify threats and vulnerabilities to your information assets.
4. Prioritize controls starting with A.5 (Organizational) and A.8 (Technological) — these have the broadest impact.
5. Begin documentation — ISO 27001 requires documented policies, procedures, and evidence of control operation.
6. Engage a certification body early to align on scope and expectations.

This ISO 27001 Compliance Checklist was generated by Codepliant based on automated code analysis. It should be reviewed by a qualified professional before use in certification preparation.