ISO/IEC 27001 readiness

What ISO 27001 is

ISO/IEC 27001 is the international standard for running an information security management system (ISMS). Certification is granted by an accredited certification body after a two-stage audit, then renewed through yearly surveillance audits. It is widely expected by buyers in Australia, the UK and the EU.

How Encased maps today

• Access control (Annex A 5.15–5.18, 8.2–8.5): role-based workspace access and revocable hashed keys.
• Cryptography (8.24): TLS in transit, encryption at rest.
• Logging and monitoring (8.15–8.16): immutable audit log and live agent activity feed.
• Data masking (8.11): personal data masked in review screens.
• Secure development (8.25–8.29): automated security scanning of code and dependencies before publishing.

Steps remaining

• Define the ISMS scope, risk assessment and Statement of Applicability.
• Formal policies, internal audit and management review.
• Stage 1 (documentation) and Stage 2 (implementation) audits by an accredited body.

Related standard: ISO/IEC 42001

We also plan to pursue ISO/IEC 42001, the standard for managing AI systems responsibly, which closely fits Encased's purpose.