Reference · ISO/IEC 27001:2022

ISO 27001 coverage map

Every clause and Annex A control family below links to where in Security Flare it lives. Useful when a certifier asks "where is your management review?" or when you're onboarding a new customer and need to point them at the right register. 39 clause entries mapped.

Headings are factual references to the standard; full normative text is licensed by ISO/IEC and is not reproduced here.

Clauses 4–6 · Context, leadership, planning

Scope, leadership commitment, and the planning machinery (risk assessment + treatment, SoA). The first place an auditor lands.

Clause	Topic	Where in Security Flare
4.1	Understanding the organisation and its context	ISMS scope statement Internal / external issues recorded in the scope statement boundaries field.
4.2	Understanding the needs and expectations of interested parties	Interested parties register Per-row addressed enum (fully / partially / not_yet / N/A) maps directly to §4.2(c).
4.3	Determining the scope of the ISMS	ISMS scope statement (append-only versions) Single record per org with version history; editing publishes a new version.
5.1	Leadership and commitment	Audits / management reviews Use type = "management review" to log §9.3 review meetings.
5.2	Information security policy	Policies (templates + cloned) 14 master templates clone into the org and round-trip to .docx.
6.1.1	Actions to address risks and opportunities	Risk register
6.1.2	Information security risk assessment	Risk register (likelihood × impact)
6.1.3	Information security risk treatment	Risk register → control links Each risk links to the Annex A controls that treat it. Statement of Applicability Derived live from the risk → control links; .xlsx export.
6.2	Information security objectives + planning to achieve them	Objectives register Title + measurement (target) + owner + due date + lifecycle (planned → in_progress → achieved/missed/cancelled). Closed objectives stay on the books. Tasks queue Break objectives down into trackable work items.

Clause 7 · Support

Resources, competence, awareness, communication, and documented information — the operational backbone of the ISMS.

Clause	Topic	Where in Security Flare
7.2	Competence	Training register (course catalogue)
7.3	Awareness	Training completions Validity windows auto-computed from course frequency.
7.5	Documented information	Documents register Controlled documents with status, version, approval, review cadence. Policies Policy-shaped documents with full markdown bodies + docx export.

Clause 8 · Operation

Operational planning + execution of the risk treatment plan.

Clause	Topic	Where in Security Flare
8.1	Operational planning and control	Controls catalogue 93 Annex A controls with per-org implementation status + evidence. Tasks queue Break operational work into trackable items linked to controls + risks.
8.2	Information security risk assessment (operational)	Risk register
8.3	Information security risk treatment (operational)	Risk register → control links Statement of Applicability

Clause 9 · Performance evaluation

Monitoring, measurement, internal audit, and management review.

Clause	Topic	Where in Security Flare
9.1	Monitoring, measurement, analysis, evaluation	Dashboard (readiness summary) At-a-glance control readiness percentage, drift signals. Evidence-collection runs Per-control evidence history from the Slice 4B Cron + Queue.
9.2	Internal audit	Audits register (type: internal) Plan, conduct, complete; planned/started/completed timeline auto-stamped.
9.3	Management review	Audits register (type: management_review) Same table parametrised by type so 9.2 and 9.3 share one workflow.

Clause 10 · Improvement

Continual improvement and the corrective-action loop for nonconformities — the §10.1/§10.2 surface.

Clause	Topic	Where in Security Flare
10.1	Continual improvement	Findings register Tracks observations + improvement opportunities alongside nonconformities. Audits + management reviews Outputs (improvement decisions) recorded in the summary field.
10.2	Nonconformity and corrective action	Findings register Open → corrective_planned → in_progress → verified → closed; verifiedAt + verified_by_user_id pin the §10.2.g requirement.

Annex A.5 · Organisational controls

The 37 organisational controls. Most live in policies, risks, the asset register, or the supplier / incident registers.

Clause	Topic	Where in Security Flare
A.5.1	Policies for information security	Policies
A.5.2 / A.5.4	Information security roles + management responsibilities	Team
A.5.9	Inventory of information and other associated assets	Asset register
A.5.10	Acceptable use of information and other associated assets	Documents register Capture the Acceptable Use Policy as a controlled document.
A.5.12	Classification of information	Asset classification field public / internal / confidential / restricted on every asset.
A.5.15	Access control	Team Per-user invitations + role management (admin / member).
A.5.19 – A.5.23	Supplier relationships + the ICT supply chain + cloud services	Supplier register Criticality, data classification, contract reference, review cadence.
A.5.24 – A.5.27	Information security incident management	Incident register Severity, status transitions auto-stamp resolved/closed; resolutionNotes captures §A.5.27 learnings.
A.5.29 / A.5.30	ICT continuity, BC, recovery	Documents register BCP + DRP + tabletop-exercise records as controlled documents.
A.5.36	Compliance with policies, rules and standards	Controls catalogue + state Audit log viewer Append-only record of ISMS actions.
A.5.37	Documented operating procedures	Documents register

Annex A.6 · People controls

The 8 people-related controls. Most flow through the training + team surfaces.

Clause	Topic	Where in Security Flare
A.6.1 / A.6.2	Screening + terms and conditions of employment	Team Onboarding via per-user invitations. Documents register Screening + employment-T&Cs procedures.
A.6.3	Information security awareness, education and training	Training register Course catalogue + per-user completions with validity windows.
A.6.8	Information security event reporting	Incident register

Annex A.7 · Physical controls

The 14 physical controls (perimeter, entry, equipment). Mostly site-level; the asset register tracks them as type = "site".

Clause	Topic	Where in Security Flare
A.7.x (all)	Physical perimeter, entry, equipment	Asset register (type = site / hardware) Sites + hardware tracked with classification + owner. Controls catalogue Per-control implementation status.

Annex A.8 · Technological controls

The 34 technological controls. Most map to control state + evidence; some have dedicated surfaces.

Clause	Topic	Where in Security Flare
A.8.1 – A.8.34 (all)	Technological controls	Controls catalogue + per-org state + evidence Status, notes, evidence files (R2 Object Lock 7-year retention).
A.8.13	Information backup	Asset register Documents register Backup + restoration procedure as a controlled document.
A.8.15	Logging	Audit log viewer Append-only audit trail of ISMS actions — required by 8.15.
A.8.16	Monitoring activities	Evidence-collection runs Dashboard