ISO 27001:2022 in the cloud, control by control.
Annex A has 93 controls, and most are about how you run security, not how a setting is configured. NxSCORE shows which ones your cloud already answers, and collects the rest once.
You will recognise this if
- Your certification audit is booked, and the cloud part is a folder of screenshots.
- The same access review is gathered for ISO 27001, for PCI DSS and for a customer’s questionnaire.
- Technological controls look covered by your CNAPP, until the auditor asks for the policy behind them.
- The move from the 2013 controls left evidence filed under numbers that no longer exist.
What a CNAPP covers, and what it leaves.
The product team reviewed one widely used CNAPP’s AWS policies against every requirement in ISO 27001 2022, and kept only the policies that really evidence it. Each requirement is counted once.
- A CNAPP policy counts towards it26
The CNAPP has a policy that tests what the requirement asks. NxSCORE checks it too, and counts each failing resource once.
- Only NxSCORE checks cover it26
A setting can be tested, but the CNAPP has no policy for it, or one that tests something else.
- Only evidence can show it41
Policies, reviews, records and systems outside the cloud. A person has to show it was done.
ISO 27001 is a management system. Even a technological control in A.8 needs the documented policy and proof that it runs, so checks count towards a control without settling it.
Four requirements, and what each one takes.
For every requirement NxSCORE says how it can be met, and why checks are not enough where they are not.
| Requirement | Covered by | What it takes |
|---|---|---|
| A.8.4 Access to source code | CNAPP policy and NxSCORE checks | Checks cover code in the cloud account; most source code lives in external repositories, shown by their access lists and reviews. |
| A.5.7 Threat intelligence | NxSCORE checks only | Checks show threat-feed detection is on; evidence shows intelligence is analysed and acted on. |
| A.8.6 Capacity management | NxSCORE checks only | Checks see monitoring and quota headroom; the capacity plan shows the rest. |
| A.5.1 Information security policy and topic-specific policies | Evidence only | The approved policies, with their latest review. |
Every requirement in one record. Now, proved once.
How NxSCORE keeps ISO 27001 current.
The daily assessment settles what checks can settle. Your team and your analyst handle the rest, and the record shows who did what.
- 01
A status for every requirement, with the reason.
Each requirement shows how it is met, the checks behind it and whether each ran, the CNAPP policies that count towards it, and its failing resources, with a resource failing in both tools counted once.
Requirement statusSix states- Met
The checks pass, and any evidence it needs is accepted
- Met by compensating control
Met another way, reviewed by your analyst
- Failing
A check fails on at least one resource
- Evidence needed
No accepted evidence, or it has lapsed
- In review
Evidence waiting for your analyst
- Not assessed
The checks behind it could not run
- 02
Evidence prepared by your team, accepted by someone else.
Your team writes up the evidence and attaches the files. Your NxSCORE analyst accepts it, returns it with a reason, or rejects it, and whoever returned it cannot accept the resubmission. Accepted evidence counts to the end of the quarter, plus 30 days, and the daily assessment says when it falls due.
Evidence, one requirementCounted- PreparedYour team writes it up and attaches the files.
- ReviewedYour analyst accepts it, returns it with a reason, or rejects it.
- CountedTo the end of the quarter, plus 30 days.
- Due againThe daily assessment says when, and asks for it fresh.
- 03
Upload once, counted everywhere it applies.
One artifact often answers several frameworks. An approved information security policy counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01. Before accepting, the analyst sees every requirement the upload will meet.
NxSCORE keeps 2022, and 2013 with all 114 of its Annex A controls for history. Evidence carries to the same control in the other version.
Information security policy, approvedOne uploadRequirement Status ISO 27001 A.5.1 Met PCI DSS 12.1.1 Met NIST CSF GV.PO-01 Met - 04
The fixes that clear the most, first.
Every failing check behind a requirement is ranked by how many requirements it is the only failure in, and how many more it contributes to. The fix kit is written for your engineers to run; NxSCORE’s access stays read-only.
Fix these first, ISO 27001 2022ExampleFailing check Alone holds back Contributes to CloudTrail log file validation off in 3 accounts Clears 9 14 Root account used in the last 90 days Clears 6 11 Security groups open to the internet on admin ports Clears 4 17 - 05
An evidence pack your assessor can read.
ISO 27001 2022 downloads as one Excel workbook, laid out requirement by requirement with the evidence beside it. Its first sheet says plainly that it is not a report on compliance: that comes from your independent assessor or auditor.
Evidence pack, ISO 27001 2022Excel, three sheetsSummary Requirements by status, as of the latest assessment Requirements Status, how each is met, failing resources, checks and CNAPP policies Evidence and compensating Status, when last accepted, when due again, and the files
Questions about ISO 27001 in the cloud.
How much of ISO 27001 Annex A can a CNAPP check?
In the product team’s review of one widely used CNAPP, its AWS policies counted towards 26 of the 93 controls in ISO 27001:2022. NxSCORE checks count towards another 26. The other 41 are met only with evidence: policies, people, premises and suppliers.
Does NxSCORE certify us against ISO 27001?
No. Certification comes from an accredited certification body. NxSCORE keeps the record your auditor reviews: each control, how it is met, and the evidence with who accepted it and when it falls due.
Can one piece of evidence count for ISO 27001 and other frameworks?
Yes. An approved information security policy, for example, counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01. Accepted once, it counts for all three until it falls due.
See which Annex A controls your cloud already answers.
Connect one cloud account and choose ISO 27001:2022. After the first assessment, your analyst takes you through each control’s status, what one upload would cover, and what will be out of date by the audit.