ISO 27001 and outside-in evidence
Which ISO/IEC 27001:2022 controls outside-in evidence can support, which findings count against each, and what it cannot tell you.
Last reviewed
ISO/IEC 27001:2022
10controls with outside-in evidence
Everything else in the framework needs evidence from inside the organisation.
ISO/IEC 27001:2022 sets out how to run an information security management system, and its Annex A lists 93 controls. A handful of them are technological controls whose effect is visible from outside: how services are encrypted, how configuration is managed, whether threat intelligence would have caught what public feeds already list.
TrustSek maps its findings to those controls. That gives an auditor, a customer or your own team concrete, dated evidence for a small part of the standard, with the reasoning for each mapping shown below.
What it does not cover
Most of ISO 27001 is about the management system itself: scope, risk assessment, policies, roles, internal audit and management review. None of that can be seen from the outside, and neither can most organisational, people and physical controls. TrustSek does not certify anything and does not replace an audit.
Controls with outside-in evidence (10)
Controls not listed here depend on policies, people and internal systems, so they need evidence from inside the organisation. Each finding links to its full explanation.
The mapping comes from the scoring engine and is being extended. In a few places it names the milder form of a finding and not the more serious one, for example 50 or more subdomains but not 100 or more.
A.5.7
Threat intelligence
Threat intelligence collection and analysis is contradicted by uncaught hits in OTX/URLhaus/threat feeds.
Findings that count against it
A.8.7
Protection against malware
Malware protection is contradicted by Google Safe Browsing or URLhaus matches against the domain.
Findings that count against it
A.8.8
Management of technical vulnerabilities
Technical vulnerability management is observable as outdated TLS, expired certs, and missing baseline web headers.
Findings that count against it
A.8.9
Configuration management
Configuration management of security baselines is contradicted by missing headers, missing HSTS, and weak DMARC policy.
Findings that count against it
A.8.16
Monitoring activities
Monitoring activities are contradicted by uncaught threat-intel matches and ransomware claims surfaced externally.
Findings that count against it
A.8.20
Networks security
Network security shows up externally as exposed high-risk hostnames and weak TLS on those endpoints.
Findings that count against it
A.8.21
Security of network services
Security of network services requires HTTPS with modern TLS and forced redirection.
Findings that count against it
A.8.23
Web filtering
Web filtering effectiveness is contradicted by external phishing/malicious URL matches against the domain.
Findings that count against it
A.8.24
Use of cryptography
Cryptography use requires HTTPS with valid trusted cert, modern TLS, and HSTS to enforce.
Findings that count against it
A.8.29
Security testing in development and acceptance
Security testing in development is observable when production lacks the baseline web security headers and HSTS.
Findings that count against it