ISO 27001
An accredited certification body audits your management system and issues a certificate. Recognised in most countries.
This pageISO/IEC 27001:2022 · certifiable ISMS
ISO 27001 asks you to select controls and prove they run. Quox is the record that the ones it touches fired.
ISO 27001 is a standard an accredited body certifies you against. Quox is not certified: it is the evidence layer for the Annex A controls an agent platform touches.
What it isa certifiable ISMSAnnex A93 controls · 4 themesCertificatevalid 3 yearsQuox statusnot certified, evidence layerStart here
A management system, plus 93 controls you choose
ISO 27001 is not about one tool. It is a way of running information security (clauses 4 to 10) and a menu of 93 controls (Annex A). You pick from the menu, and write down what you picked and why.
SOC 2
An independent CPA firm examines your controls and signs a report. There is no certificate and no certifying body.
Read the SOC 2 pageNIST AI RMF
A framework you adopt on your own. Nobody certifies it and nobody issues a report.
Read the NIST AI RMF pageThe Statement of Applicability is where the two halves meet.
Risk assessment
Clause 6.1.2. You find the information security risks to your scope and rate them.
Risk treatment, clause 6.1.3
You decide what to do about each risk, and which controls you need to do it. Annex A is the checklist you compare against.
The Statement of Applicability
One document listing all 93 Annex A controls: does it apply, why or why not, and is it implemented. Clause 6.1.3 makes it mandatory.
The control surface
Every cell is a control. In or out is your Statement of Applicability
This is the whole of Annex A: 93 controls in four themes. Each one either applies to your scope or is excluded with a reason. Select a cell to flip it, and watch the justifications you owe add up.
- In scope
- Excluded, justification owed
- Quox evidences it
- Partly Quox
- Yours, a known gap
93 of 93in scope0excluded, so 0 justifications to write
A.8.15TechnologicalIn scope
Logging
Quox evidences thisThe witnessed, hash-chained record of governed agent actions is the log: timestamped, in order, and verifiable offline. Logs from your other systems are yours.
Read the green and amber rings honestly. Of the 93 controls, Quox bears on 9. The other 84 are yours, which is normal: most of ISO 27001 is policy, people, premises and your wider technology.
The four themes
Four themes, and how the 93 split
The 2022 edition groups Annex A by what kind of thing a control is, not by department. The shares are very uneven, and the one an agent platform lives in is the second largest.
37Organizational8People14Physical34Technological
A.537
Organizational
Policies, roles, suppliers, asset inventory, access rules, incident handling and legal duties. Mostly paper and process, and the biggest theme.
Where Quox fits2 of 37 controls, shown on the grid above.
A.68
People
Screening, contracts, awareness training, discipline, remote working and reporting events. About your staff, not your software.
Where Quox fitsNone of these controls. They are yours.
A.714
Physical
Perimeters, entry, equipment, cabling, utilities and disposal. If you run in a data centre or a cloud, much of this is a supplier’s, but you still own the decision.
Where Quox fitsNone of these controls. They are yours.
A.834
Technological
Endpoints, privileged access, malware, backup, logging, monitoring, cryptography, secure development and change. The theme an agent platform lives in.
Where Quox fits7 of 34 controls, shown on the grid above.
Clauses 4 to 10
The management system around the controls
Seven clauses, the same Annex SL backbone ISO 42001 uses, and all mandatory. Annex A hangs off clause 6.1.3. An honest read of the seven: mostly your job.
- Yours
Context of the organisation
What the ISMS covers: your scope, who cares about it and what they expect.
- Yours
Leadership
Top management owns it: a policy, named roles and real commitment.
- Yours
Planning
Risk assessment, risk treatment and objectives. Clause 6.1.3 is where the SoA is born and Annex A comes in.
- Yours
Support
Resources, competence, awareness, communication and the documented information you must keep.
- Partly Quox
Operation
Carry out the risk assessment and treatment plan, and run the controls day to day.
Where Quox fitsWhere agents run, the record shows the controls in front of them actually fired.
- Partly Quox
Performance evaluation
Monitor and measure, run an internal audit, hold a management review.
Where Quox fitsA tamper-evident record for the internal audit and management review to draw on.
- Partly Quox
Improvement
Fix nonconformities, take corrective action and keep improving.
Where Quox fitsA replayable trace shows what happened when something went wrong. The corrective action is yours.
What changed in 2022
114 became 93, and 11 are new
The 3rd edition was published on 25 October 2022. The transition from the 2013 edition ended on 31 October 2025, so 2022 is the only edition you can certify against today.
2013 edition114controls, 14 domains
2022 edition93controls, 4 themes
Brand new11controls that did not exist
Threat intelligence
YoursInformation security for use of cloud services
YoursICT readiness for business continuity
YoursPhysical security monitoring
YoursConfiguration management
Partly QuoxInformation deletion
YoursData masking
Partly QuoxData leakage prevention
Partly QuoxMonitoring activities
Quox evidencesWeb filtering
YoursSecure coding
YoursFour of the eleven new controls touch an agent platform directly: configuration management, data masking, data leakage prevention and monitoring activities. Threat intelligence and information deletion are the two Quox does not cover, and the page says so.
Getting certified
Two audits, then three years of staying certified
The certificate is issued by an accredited certification body, not by you and not by a tool. Here is the cycle it puts you in.
- Readiness
Stage 1
The certification body reviews your documentation, scope and SoA, and checks you are ready for the real audit.
- Conformance
Stage 2
The auditor assesses whether the controls in your SoA are implemented and working, and looks at your evidence.
- Valid 3 years
Certificate
If you pass, the certificate is valid for three years. The clock does not stop between audits, and neither does the evidence.
- Surveillance
Year 1
A lighter audit that samples part of the system and checks you are keeping it alive.
- Surveillance
Year 2
Another sampling audit, usually covering the parts the first did not reach.
- Full audit again
Recertification
At the end of the three years a full recertification audit opens the next cycle.
The honest map
Four questions an auditor asks, and where the answer stops
ISO 27001 asks you to select controls and prove they run. Quox is the record that shows the ones it touches actually fired, to an auditor, offline. Each card below says what the record shows and, just as plainly, where it stops.
A.8.15LoggingA.8.16Monitoring activities
Show me the logs, and show me you were watching them.
The record showsA witnessed, hash-chained record of every governed agent action, with blocks, denials and approvals in the same chain. The auditor can verify it offline, with no Quox account.
Where it stopsIt records governed agent actions. Your servers, network devices, applications and the monitoring around them are separate evidence you produce.
A.5.15Access controlA.5.18Access rightsA.8.2Privileged access rights
Who could do this, and with what authority?
The record showsAn identity on every governed action, a scoped capability token rather than a shared credential, and governed SSH through Bastion for privileged work.
Where it stopsYour joiners, movers and leavers process, your identity provider and admin rights outside the agent platform are yours.
A.8.9Configuration managementA.8.32Change management
Did the rules change, and who agreed to it?
The record showsAn append-only history of governance policy changes, and a second person required for audit-required changes.
Where it stopsIt covers Quox’s policy configuration. Configuration baselines and change records for the rest of your estate are yours.
A.8.11Data maskingA.8.12Data leakage prevention
Can sensitive data leave for an external model?
The record showsA policy gate in front of the call that can block it, with the block recorded as evidence that it fired.
Where it stopsThis is a policy gate on one path, not a full data loss prevention product. It does not watch email, endpoints or file shares.
A.5.7Threat intelligenceA.8.10Information deletion
Two new controls an agent platform sounds like it covers, and does not.
YoursThreat intelligence feeds are yours, and so is secure deletion in your underlying data stores. Quox supplies neither. The other 82 controls outside the nine are also yours.
Keep it through the cycle
A certificate lasts three years, with surveillance audits in years 1 and 2. The evidence has to be there for whichever day an auditor samples, and ISO 27001 sets no retention number, so your risk assessment, contracts and legal duties decide. Our guide walks through how to choose.
Quox is self-hosted, so the record of what your agents did lives on your servers, which is where you will be asked for it. The auditor page shows what the other side of the table can verify without a Quox account, and the compliance suite covers report exports. Related frameworks: SOC 2, ISO 42001 and the NIST AI RMF.
Honest maturity
What ships today, what does not, and what is yours
Quox is one layer. The certification itself is a human engagement with an accredited body. Here is the line, drawn plainly.
Ships today
- Witnessed, hash-chained, tamper-evident record of every governed agent action (WARD and VOLT, the evidence protocols), timestamped and ordered as the work happens.
- Policy gate enforced at execution, which can block sensitive data reaching an external model, with the block recorded.
- Scoped capability tokens, an identity on every governed action and governed SSH through Bastion.
- Two-person approval for audit-required policy changes, with an append-only history.
- Exportable evidence bundles an auditor verifies offline, and replayable traces of governed runs.
- An ISO 27001 report export and a SoA Builder, as described on the compliance suite page. They help you assemble your document; the choices in it are yours.
Not shipped
- A policy simulator, so you can test a policy before it goes live. Planned, not shipped.
- A published control-level crosswalk covering all 93 Annex A controls. Not published; this page maps the nine where an agent platform genuinely bears on the control.
Still your job
- The certification engagement itself: choosing the accredited body, Stage 1, Stage 2 and the surveillance audits. Quox does not do this and cannot.
- The ISMS scope, the risk assessment and risk treatment, and the Statement of Applicability, including every justification for an exclusion.
- Most of the 93 controls. Quox bears on 9; the other 84 are policy, people, premises, suppliers and your wider technology.
- Internal audit, management review and the corrective actions that follow.
- Deciding what evidence to keep through the three-year cycle, and for how long.
The path
Your first ISO 27001, in seven moves
Timelines vary with size and how much you already run. The order is the useful part.
Scope the ISMS
Decide what the system covers: which products, sites and teams. A narrow, honest scope is cheaper to certify than a vague one.
Assess your risks
List what could go wrong with information in scope, and rate it. Everything after this follows from your risks, not from the standard.
Write the SoA
Go through all 93 controls. Mark each in or out, justify every exclusion and note what is implemented. This is the document the auditor reads first.
Implement and collect evidence
Put the controls in place and make evidence as you go, so it exists on the days an auditor might sample rather than being rebuilt later.
Audit yourself
Run an internal audit, then a management review. Fix what they find before an outsider does.
Stage 1, then Stage 2
The certification body checks readiness, then checks the controls really run. Then you receive the certificate.
Keep it alive
Surveillance audits in years 1 and 2, then recertification. The system has to keep working between audits.
Questions people actually ask
ISO 27001: the FAQ
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a set of clauses describing how to run information security as a managed process, plus an Annex A of controls you choose from. An accredited certification body can audit you against it and issue a certificate.
Can you be certified against ISO 27001?
Yes. ISO 27001 is a standard, and unlike SOC 2, which is an attestation report, and the NIST AI RMF, which is voluntary, it is certifiable. An accredited certification body audits your ISMS and issues the certificate. A tool, including Quox, cannot issue or replace one.
What is the Statement of Applicability?
The mandatory document at the centre of an ISO 27001 certification. It lists all 93 Annex A controls and says, for each, whether it applies to your ISMS, why you included or excluded it, and whether it is implemented. It links your risk treatment under clause 6.1.3 to specific controls.
How many Annex A controls are there?
In ISO/IEC 27001:2022 there are 93, in four themes: Organizational (37), People (8), Physical (14) and Technological (34). The 2013 edition had 114 controls in 14 domains.
What changed in the 2022 edition?
The 3rd edition was published on 25 October 2022. Annex A went from 114 controls to 93 by merging many and reorganising them into four themes, and 11 controls are new: A.5.7 threat intelligence, A.5.23 cloud services, A.5.30 ICT readiness for business continuity, A.7.4 physical security monitoring, A.8.9 configuration management, A.8.10 information deletion, A.8.11 data masking, A.8.12 data leakage prevention, A.8.16 monitoring activities, A.8.23 web filtering and A.8.28 secure coding.
Can I still certify against the 2013 edition?
No. The transition period to the 2022 edition ended on 31 October 2025, so ISO/IEC 27001:2022 is the only current certifiable edition.
How long does the certificate last?
Three years. The certification body returns for surveillance audits in years 1 and 2, then a full recertification audit at the end of the cycle.
Is Quox ISO 27001 certified, and does it make me compliant?
No to both. Quox holds no ISO 27001 certificate, and no tool can give you one: only an accredited certification body can. Quox is the evidence layer for the controls an agent platform touches, such as logging, monitoring, access, change and the policy gate, with a record an auditor can verify offline. Most of the 93 controls are yours.
How does this relate to SOC 2 and ISO 42001?
SOC 2 is an attestation report from a CPA firm and covers security through its own criteria. ISO 27001 is the certifiable global standard for the information security management system. ISO 42001 uses the same clause structure (Annex SL), so teams often add it to an existing ISMS. 27001 protects the information, and 42001 governs the AI system. Read the ISO 42001 page.
How long should I keep AI agent logs for ISO 27001?
The standard does not set a number. Your risk assessment, contracts and legal duties decide it, and the evidence needs to survive the three-year cycle and its surveillance audits. Our guide to AI agent log retention walks through how to choose. How long to keep AI agent logs.
Sources
Related frameworks
Self-hosted · free · governed
Prove the controls in your Statement of Applicability ran
Your Statement of Applicability says which controls apply. Keep a witnessed record that the ones your agents touch actually ran, verifiable offline.