ISO/IEC 27001:2022 — Information Security Management Annex A + Clauses 4-10

ISO/IEC 27001:2022 — Information Security Management Annex A + Clauses 4-10

ISO/IEC 27001:2022 — Information Security Management Annex A + Clauses 4-10 — 79% covered.

118 requirements · 83 enforced · 6 designed · 29 advisory · 0 deferred.

Source: ISO/IEC 27001:2022 Annex A (93 controls, 4 themes): mirrors ISO/IEC 27002:2022 control catalogue. Main-body clauses 4-10 (Context, Leadership, Planning, Support, Operation, Performance evaluation, Improvement) added 2026-05-29 (Wave-Ralph-B) for a regulator-grade ISMS-level deep-mapping. · License: ISO — control text is copyrighted; KYE registry paraphrases each control's intent and cites the official identifier for mapping purposes only.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
A.5 Organisational controls 37 32 1 4 0 91%
A.6 People controls 8 3 1 4 0 56%
A.7 Physical controls 14 2 0 12 0 36%
A.8 Technological controls 34 26 3 5 0 85%
Clause 4 Context of the organisation 4 2 0 2 0 63%
Clause 5 Leadership 3 3 0 0 0 100%
Clause 6 Planning 5 4 0 1 0 85%
Clause 7 Support 5 4 0 1 0 85%
Clause 8 Operation 3 3 0 0 0 100%
Clause 9 Performance evaluation 3 2 1 0 0 83%
Clause 10 Improvement 2 2 0 0 0 100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
iso-27001.A.5.1 Policies for information security enforced audit_events: kye.signal.tool.compiled.v1
engines: internal
workers: kye-rules-gateway-worker
constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.2 Information security roles and responsibilities enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.3 Segregation of duties enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.4 Management responsibilities enforced audit_events: kye.governedui.approval.v1, kye.evidence.pack.v1
engines: internal, internal
constitution_refs: constitution/36-GOVERNEDUI.md
iso-27001.A.5.5 Contact with authorities advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.6 Contact with special interest groups advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.7 Threat intelligence enforced audit_events: kye.signal.drift.detected.v1, kye.signal.stable_drift.detected.v1
engines: internal
workers: kye-drift-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.5.8 Information security in project management enforced audit_events: kye.governedui.approval.v1, kye.evidence.pack.v1
engines: internal, internal
constitution_refs: constitution/36-GOVERNEDUI.md
iso-27001.A.5.9 Inventory of information and other associated assets enforced audit_events: kye.risk.authority_register.v1, kye.evidence.decision_map.v1
engines: internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.A.5.10 Acceptable use of information and other associated assets enforced audit_events: kye.purpose.permission.v1, kye.evidence.decision_map.v1
engines: internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.11 Return of assets enforced audit_events: kye.revocation.event.v1, kye.signal.revocation.cascaded.v1
engines: internal
workers: kye-authority-revocation-orchestrator
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.12 Classification of information enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.5.13 Labelling of information enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.5.14 Information transfer enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.5.15 Access control enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.16 Identity management enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.17 Authentication information enforced audit_events: kye.signing.multisig_envelope.v1
engines: internal, internal, internal
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.5.18 Access rights enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.5.19 Information security in supplier relationships enforced audit_events: kye.federation.cross_org_delegation.v1
engines: internal
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.5.20 Addressing information security within supplier agreements enforced audit_events: kye.federation.cross_org_delegation.v1
engines: internal
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.5.21 Managing information security in the ICT supply chain advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.22 Monitoring, review and change management of supplier services enforced audit_events: kye.federation.cross_org_delegation.v1
engines: internal
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.5.23 Information security for use of cloud services enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.5.24 Information security incident management planning and preparation enforced audit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1
engines: internal
workers: kye-incident-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.5.25 Assessment and decision on information security events enforced audit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1
engines: internal
workers: kye-incident-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.5.26 Response to information security incidents enforced audit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1
engines: internal
workers: kye-incident-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.5.27 Learning from information security incidents enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.5.28 Collection of evidence enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.5.29 Information security during disruption enforced audit_events: kye.spof.path_to_full.v1
constitution_refs: constitution/51-NO-SPOF.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.5.30 ICT readiness for business continuity designed audit_events: kye.spof.path_to_full.v1
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.5.31 Legal, statutory, regulatory and contractual requirements enforced audit_events: kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.32 Intellectual property rights advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.33 Protection of records enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.5.34 Privacy and protection of PII enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.5.35 Independent review of information security enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.5.36 Compliance with policies, rules and standards for information security enforced audit_events: kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/00-INDEX.md
iso-27001.A.5.37 Documented operating procedures enforced audit_events: kye.risk.authority_register.v1, kye.evidence.decision_map.v1
engines: internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.A.6.1 Screening advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.6.2 Terms and conditions of employment advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.6.3 Information security awareness, education and training designed audit_events: kye.training.completion.v1
constitution_refs: constitution/10-PARTNER.md
iso-27001.A.6.4 Disciplinary process advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.6.5 Responsibilities after termination or change of employment enforced audit_events: kye.revocation.event.v1, kye.signal.revocation.cascaded.v1
engines: internal
workers: kye-authority-revocation-orchestrator
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.6.6 Confidentiality or non-disclosure agreements advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.6.7 Remote working enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.6.8 Information security event reporting enforced audit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1
engines: internal
workers: kye-incident-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.7.1 Physical security perimeters advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.2 Physical entry advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.3 Securing offices, rooms and facilities advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.4 Physical security monitoring advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.5 Protecting against physical and environmental threats advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.6 Working in secure areas advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.7 Clear desk and clear screen advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.8 Equipment siting and protection advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.9 Security of assets off-premises advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.10 Storage media enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.7.11 Supporting utilities advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.12 Cabling security advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.13 Equipment maintenance advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.7.14 Secure disposal or re-use of equipment enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.8.1 User end point devices advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.8.2 Privileged access rights enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.8.3 Information access restriction enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.8.4 Access to source code enforced audit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.A.8.5 Secure authentication enforced audit_events: kye.signing.multisig_envelope.v1
engines: internal, internal, internal
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.8.6 Capacity management advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.8.7 Protection against malware designed audit_events: kye.evidence.tool_call_pin.v1, kye.agent.mcp_allow_list.v1
constitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md
iso-27001.A.8.8 Management of technical vulnerabilities enforced audit_events: kye.signal.drift.detected.v1, kye.signal.stable_drift.detected.v1
engines: internal
workers: kye-drift-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.8.9 Configuration management enforced audit_events: kye.signal.drift.detected.v1
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.10 Information deletion enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.8.11 Data masking enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.8.12 Data leakage prevention enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.8.13 Information backup enforced audit_events: kye.compliance.attestation.v1
engines: internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.A.8.14 Redundancy of information processing facilities enforced audit_events: kye.spof.path_to_full.v1
constitution_refs: constitution/51-NO-SPOF.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.15 Logging enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
rule_packs: kye:rule-pack:public-sector-governance
iso-27001.A.8.16 Monitoring activities enforced audit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1
engines: internal
workers: kye-incident-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.A.8.17 Clock synchronisation advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.8.18 Use of privileged utility programs designed audit_events: kye.evidence.tool_call_pin.v1, kye.agent.mcp_allow_list.v1
constitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md
iso-27001.A.8.19 Installation of software on operational systems enforced audit_events: kye.signal.drift.detected.v1
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.20 Networks security enforced audit_events: kye.evidence.decision_map.v1, kye.signal.decision.admitted.v1
engines: internal, internal
workers: kye-gateway, kye-edge-arbiter
constitution_refs: constitution/25-EDGE-GOVERNANCE.md
iso-27001.A.8.21 Security of network services enforced audit_events: kye.evidence.decision_map.v1, kye.signal.decision.admitted.v1
engines: internal, internal
workers: kye-gateway, kye-edge-arbiter
constitution_refs: constitution/25-EDGE-GOVERNANCE.md
iso-27001.A.8.22 Segregation of networks enforced audit_events: kye.evidence.decision_map.v1, kye.signal.decision.admitted.v1
engines: internal, internal
workers: kye-gateway, kye-edge-arbiter
constitution_refs: constitution/25-EDGE-GOVERNANCE.md
iso-27001.A.8.23 Web filtering advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.8.24 Use of cryptography enforced audit_events: kye.signing.multisig_envelope.v1
engines: internal, internal, internal
constitution_refs: constitution/51-NO-SPOF.md
iso-27001.A.8.25 Secure development life cycle enforced audit_events: kye.ci.failure.classified.v1
constitution_refs: constitution/00-INDEX.md, constitution/42-CONSTITUTION-KIT.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.26 Application security requirements enforced audit_events: kye.ci.failure.classified.v1
constitution_refs: constitution/00-INDEX.md, constitution/42-CONSTITUTION-KIT.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.27 Secure system architecture and engineering principles enforced audit_events: kye.ci.failure.classified.v1
constitution_refs: constitution/00-INDEX.md, constitution/42-CONSTITUTION-KIT.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.28 Secure coding designed audit_events: kye.ci.failure.classified.v1
constitution_refs: constitution/00-INDEX.md, constitution/42-CONSTITUTION-KIT.md
iso-27001.A.8.29 Security testing in development and acceptance enforced audit_events: kye.ci.failure.classified.v1
constitution_refs: constitution/00-INDEX.md, constitution/42-CONSTITUTION-KIT.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.30 Outsourced development advisory constitution_refs: constitution/00-INDEX.md
iso-27001.A.8.31 Separation of development, test and production environments enforced audit_events: kye.ci.failure.classified.v1
constitution_refs: constitution/00-INDEX.md, constitution/42-CONSTITUTION-KIT.md
engines: internal, internal
workers: kye-gateway
iso-27001.A.8.32 Change management enforced audit_events: kye.governedui.approval.v1, kye.evidence.pack.v1
engines: internal, internal
constitution_refs: constitution/36-GOVERNEDUI.md
iso-27001.A.8.33 Test information enforced audit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
iso-27001.A.8.34 Protection of information systems during audit testing enforced audit_events: kye.audit.event.appended.v1, kye.evidence.pack.v1, kye.compliance.attestation.v1
engines: internal, internal
workers: kye-audit-archiver
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
iso-27001.cl-4.1 Understanding the organisation and its context — determine external and internal issues relevant to the ISMS purpose that affect its ability to achieve the intended outcomes. advisory audit_events: kye.risk.authority_register.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-4.2 Understanding the needs and expectations of interested parties — determine relevant interested parties and their requirements that relate to information security. advisory audit_events: kye.compliance.attestation.v1, kye.subprocessor.v1
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-27001.cl-4.3 Determining the scope of the information security management system — determine the boundaries and applicability of the ISMS taking the context, interested parties and interfaces into account. enforced audit_events: kye.compliance.attestation.v1
registries: internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-4.4 Information security management system — establish, implement, maintain and continually improve an ISMS, including the processes needed and their interactions, in accordance with the requirements of this document. enforced audit_events: kye.compliance.attestation.v1, kye.reconciliation.verdict.v1
engines: internal
constitution_refs: constitution/00-INDEX.md, constitution/34-RECONCILIATION-ENGINE.md
iso-27001.cl-5.1 Leadership and commitment — top management demonstrates leadership and commitment with respect to the ISMS. enforced audit_events: kye.governedui.approval.v1, kye.compliance.attestation.v1
governedui_modules: kye.governedui.module.action_approval.v1, kye.governedui.module.approval_queue.v1
constitution_refs: constitution/36-GOVERNEDUI.md
iso-27001.cl-5.2 Policy — top management establishes an information security policy appropriate to the purpose of the organisation, including objectives or framework for setting objectives, commitment to satisfy applicable requirements, and commitment to continual improvement. enforced audit_events: kye.compliance.attestation.v1
registries: internal
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-5.3 Organisational roles, responsibilities and authorities — top management assigns and communicates roles and authorities relevant to information security. enforced audit_events: kye.authority.grant.v1, kye.risk.authority_register.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
iso-27001.cl-6.1.1 Actions to address risks and opportunities — general — plan actions to address risks and opportunities to ensure the ISMS can achieve its intended outcomes and to achieve continual improvement. enforced audit_events: kye.risk.score.v1, kye.risk.authority_register.v1, kye.risk_assessment.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.cl-6.1.2 Information security risk assessment — define and apply an information security risk-assessment process that establishes and maintains risk criteria, ensures repeatability of results, identifies risks, analyses and evaluates them. enforced audit_events: kye.risk_assessment.v1, kye.risk.score.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.cl-6.1.3 Information security risk treatment — define and apply an information security risk-treatment process to select appropriate options, determine controls, compare to Annex A, produce a Statement of Applicability, and obtain risk-owner approval. enforced audit_events: kye.compliance.attestation.v1, kye.governedui.approval.v1
engines: internal, internal
constitution_refs: constitution/36-GOVERNEDUI.md, constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-6.2 Information security objectives and planning to achieve them — establish information security objectives at relevant functions and levels, consistent with the policy and measurable. advisory audit_events: kye.compliance.attestation.v1
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-6.3 Planning of changes — when the organisation determines the need for changes to the ISMS, the changes shall be carried out in a planned manner. enforced audit_events: kye.change_calendar.v1, kye.governedui.approval.v1, kye.reconciliation.verdict.v1
engines: internal
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md, constitution/53-COHESION-CASCADE.md
iso-27001.cl-7.1 Resources — determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS. advisory audit_events: kye.compliance.attestation.v1
constitution_refs: constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-7.2 Competence — determine the necessary competence of persons doing work under the organisation's control that affects the ISMS performance, ensure competence on the basis of education, training or experience, and retain documented information as evidence of competence. enforced audit_events: kye.training.completion.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/10-PARTNER.md, constitution/49-UNIVERSAL-ENGAGEMENT-RAIL.md
iso-27001.cl-7.3 Awareness — persons doing work under the organisation's control are aware of the information security policy, their contribution to the effectiveness of the ISMS, and the implications of not conforming. enforced audit_events: kye.training.completion.v1, kye.comms.dispatch.v1
engines: internal
constitution_refs: constitution/38-COMMS-RAIL.md, constitution/39-LEARN-RAIL.md
iso-27001.cl-7.4 Communication — determine the need for internal and external communications relevant to the ISMS, including what, when, with whom, and how to communicate. enforced audit_events: kye.comms.dispatch.v1
engines: internal
constitution_refs: constitution/38-COMMS-RAIL.md
iso-27001.cl-7.5 Documented information — the ISMS shall include documented information required by this document and documented information determined by the organisation as being necessary; documented information shall be controlled regarding distribution, access, retrieval, use, storage, preservation, change control and disposition. enforced audit_events: kye.audit_retention_policy.v1, kye.audit.event.v1
engines: internal, internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/43-MACHINE-READABLE-BY-DEFAULT.md
iso-27001.cl-8.1 Operational planning and control — plan, implement and control the processes needed to meet requirements and to implement the actions to address risks and opportunities; control planned changes and review unintended changes. enforced audit_events: kye.evidence.decision_map.v1, kye.reconciliation.verdict.v1, kye.signal.drift.detected.v1
engines: internal, internal
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md
iso-27001.cl-8.2 Information security risk assessment — perform information security risk assessments at planned intervals or when significant changes are proposed or occur, retaining documented information of the results. enforced audit_events: kye.risk_assessment.v1, kye.signal.scenario_run.completed.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
iso-27001.cl-8.3 Information security risk treatment — implement the information security risk-treatment plan and retain documented information of the results. enforced audit_events: kye.compliance.attestation.v1, kye.reconciliation.verdict.v1
engines: internal
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md, constitution/40-IMPLEMENTATION-CANONICAL.md
iso-27001.cl-9.1 Monitoring, measurement, analysis and evaluation — evaluate the information security performance and the effectiveness of the ISMS; determine what to monitor, the methods, when, by whom, and when results are analysed. enforced audit_events: kye.audit.event.v1, kye.signal.drift.detected.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/35-STREAMING-LOGS.md
iso-27001.cl-9.2 Internal audit — conduct internal audits at planned intervals to provide information on whether the ISMS conforms to the requirements and is effectively implemented and maintained. enforced audit_events: kye.assurance.audit_pilot.v1, kye.assurance.audit_replay_report.v1
engines: internal, internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
iso-27001.cl-9.3 Management review — top management shall review the ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. designed audit_events: kye.governedui.approval.v1, kye.compliance.attestation.v1
governedui_modules: kye.governedui.module.action_approval.v1, kye.governedui.module.evidence_timeline.v1
constitution_refs: constitution/36-GOVERNEDUI.md
iso-27001.cl-10.1 Continual improvement — continually improve the suitability, adequacy and effectiveness of the ISMS. enforced audit_events: kye.reconciliation.verdict.v1, kye.signal.drift.detected.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md, constitution/53-COHESION-CASCADE.md
iso-27001.cl-10.2 Nonconformity and corrective action — when a nonconformity occurs, the organisation shall react, evaluate the need for action to eliminate the causes, implement the action, review effectiveness, and retain documented information. enforced audit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.ci.failure.classified.v1, kye.signal.revocation.cascaded.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/41-ERROR-HORIZONS.md