Prepare your ISO 27001 audit with Annex A and the evidence in front of you.
For whoever builds or maintains an ISMS: HodeiShield scores the 93 Annex A controls (2022 edition), collects the evidence for each one and tells you what is missing before the certification audit.
- Hodeitek’s ISMS is certified to ISO/IEC 27001:2023 (no. 34/5700/26/10159); its scope includes the systems that support the HodeiShield SaaS. It is not a product certification
- Data in the EU (OVH, Gravelines); Cloudflare (US) handles DNS, CDN and TLS on the request path
What ISO 27001 asks, in brief
The standard sets the requirements of an information security management system. Annex A is a reference catalogue of controls, not a list you must satisfy in full.
Informational summary, not advice. Certification depends on your scope, your risk decisions and the judgement of the certification body.
- Context, scope and leadership
- The organisation determines its context, interested parties and the scope of the ISMS, and top management sets the policy and the roles (clauses 4 and 5).
- Assess and treat the risks
- Risks are assessed, a treatment is chosen, the necessary controls are compared with Annex A and every inclusion or exclusion is justified in the Statement of Applicability (clauses 6.1.2 and 6.1.3).
- Operate, measure and audit
- The ISMS runs on documented information, its performance is measured, and internal audits and management reviews take place (clauses 7 to 9).
- Improve continually
- Nonconformities are corrected and the system is improved continually (clause 10).
The four Annex A themes and where HodeiShield fits
The 2022 Annex A groups 93 controls into four themes. The platform lists all of them as a checklist, but only works on part of them.
A.5
Organizational (37)
Suppliers, incidents, policies and risks have their own module; the rest is tracked as a checklist with your evidence.
PartialA.6
People (8)
Screening, awareness and confidentiality agreements happen outside the platform. You can record their status and upload the evidence.
Not coveredA.7
Physical (14)
Security of premises and equipment sits outside the platform. You can record its status and upload the evidence.
Not coveredA.8
Technological (34)
Daily CVEs and per-component alerts from the SBOM; the endpoint agent contributes checks as evidence.
Partial
From each ISO 27001 requirement to a HodeiShield capability
With cycle phase and scope. Only what the platform backs.
Direct: the platform does it. Partial: it supplies evidence or one part, the rest is yours. Not covered: outside HodeiShield.
- Obligation:
Organisation context, interested parties and ISMS scope
Cl. 4
What HodeiShield does:Outside HodeiShield. Defining the scope and the interested parties is work for management.
PhaseOutside the cycleScopeNot covered - Obligation:
Assess information security risks
Cl. 6.1.2
What HodeiShield does:Risk register with a 5×5 inherent and residual matrix and a declared risk appetite. For suppliers, FAIR ALE in euros with a simulated (uncalibrated) uncertainty band. The assessment criteria and methodology are yours to define.
Docs · Risk engine (opens in a new tab)PhasePREDICTScopePartial - Obligation:
Treat the risks and produce the Statement of Applicability
Cl. 6.1.3
What HodeiShield does:Each risk carries its treatment and notes. An Annex A control can be marked "not applicable", with the reason in the notes, and stops counting in the score. HodeiShield does not generate the Statement of Applicability as a document.
Docs · Compliance (opens in a new tab)PhaseOutside the cycleScopePartial - Obligation:
Implement and track the Annex A controls
Annex A (93)
What HodeiShield does:Checklist of the 93 controls of the 2022 edition: status, owner, due date, notes and evidence per control. The score is implemented controls over applicable controls.
Demo · ISO 27001 viewPhaseSENSEScopeDirect - Obligation:
Policies and documented information
A.5.1; Cl. 7.5
What HodeiShield does:Evidence with an owner, a validity date and a status, which you upload or link; expired evidence stops counting. A policy library with versions and a record of every change. The content of the policies is yours.
Docs · Compliance (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Security in supplier relationships and the ICT supply chain
A.5.19 to A.5.22
What HodeiShield does:Token-based questionnaires with reminders, periodic external scanning, daily CVEs and supplier SBOMs. Contract clauses and service monitoring are yours.
Docs · Risk engine (opens in a new tab)PhaseSENSEPREDICTScopePartial - Obligation:
Information security incident management
A.5.24 to A.5.28
What HodeiShield does:A single incident register, each incident classified once and with evidence attached. Response procedures and lessons learned are documented by you.
Demo · incident registerPhaseOutside the cycleScopePartial - Obligation:
Management of technical vulnerabilities
A.8.8
What HodeiShield does:Daily CVE sync and per-component alerts over the SBOMs you ingest. The endpoint agent reports per cycle and its checks do not enter the compliance score.
Docs · SBOM, CVE and alert chain (opens in a new tab)PhaseSENSEScopePartial - Obligation:
Monitoring, measurement and evidence for the auditor or a customer
Cl. 9.1
What HodeiShield does:Posture per framework and an ATTEST attestation with the ISO 27001 band, signed with ML-DSA-65 and verifiable offline. It proves integrity, origin and time, not truth.
Docs · ATTEST verifier (opens in a new tab)PhaseATTESTScopePartial - Obligation:
Internal audit and management review
Cl. 9.2 and 9.3
What HodeiShield does:Outside HodeiShield. The score and the evidence can feed them, but you carry them out and document them.
PhaseOutside the cycleScopeNot covered
What HodeiShield does not do with ISO 27001
What stays outside, said before the demo.
It does not certify your organisation
ISO/IEC 27001 certification is granted by an accredited body after an audit. HodeiShield measures your posture with the evidence you provide and does not replace that audit. Hodeitek SL's certified ISMS is the company's own and does not carry over to your organisation.
It does not generate the Statement of Applicability
You can mark a control as not applicable and note why, but the platform neither produces that document nor decides which controls apply to you.
It does not model the management-system clauses
The catalogue is the Annex A one. Context, objectives, competence, internal audit and management review have no module of their own; the risk register and the evidence can feed them.
Evidence does not collect itself
It is uploaded or linked by hand. Cloud collectors are planned and do not exist today, and the endpoint agent reports per cycle, not in real time.
Questions about ISO 27001
Answers with the exact scope.
Does HodeiShield certify me to ISO 27001?
No. Certification is granted by an accredited body after auditing your management system. HodeiShield measures your posture with the evidence you provide and points out what is missing; being ready for the audit depends on your evidence and your decisions.
How is Annex A scored?
Each of the 93 controls has a status that you set. The score is the percentage of implemented controls over applicable ones. A control nobody has assessed does not raise the score: only "not applicable" leaves the calculation. It is a self-assessment, not an audit.
Does it generate the Statement of Applicability?
No. You can mark controls as not applicable and note the reason, but the Statement of Applicability as a document, with its justification for each inclusion and exclusion, is written by you.
Does the same evidence work for ENS or NIS2?
The crosswalk links ISO 27001 controls with their equivalents in ENS, NIS2, SOC 2, ISO 42001 and NIST CSF 2.0 so you do not evidence the same thing twice. An equivalence guides the work, but it does not replace the judgement of each standard's auditor.
Which edition of the standard does it use?
ISO/IEC 27001:2022. The catalogue holds the 93 controls of its Annex A: A.5.1 to A.5.37, A.6.1 to A.6.8, A.7.1 to A.7.14 and A.8.1 to A.8.34.
Need help closing the gaps?
HodeiShield shows you where they are. If you need a team to close them, Hodeitek offers governance, risk and compliance consulting.
Are you an MSSP? Partner program
Walk through Annex A with your evidence in front of you
In the demo we mark the controls that apply to you and see what evidence you already have, what expires and what is missing before the audit.
No commitment. Sample data.