Clerk.io

Statement of Applicability (SoA) – ISO/IEC 27001:2022

This SoA lists each control from ISO/IEC 27001 Annex A (2022 edition), indicates whether it is applicable to Clerk.io's ISMS, and if so, summarises implementation status or justification for exclusion.

NOTE: This document is a living record. Control ownership, implementation evidence and links to policies/procedures are updated continuously. Rows with TODO require internal input not publicly available.

A.5 Organisation

No. Control Applicable? Implementation / Justification
5.1 Policies for information security Yes Implemented – see Information Security Policy.
5.2 Information security roles & responsibilities Yes See Roles & Responsibilities; communicated via onboarding.
5.3 Segregation of duties Yes Enforced in production access & code review.
5.4 Management responsibilities Yes CEO & ISM oversee ISMS; minutes in ISMS repo.
5.5 Contact with authorities Yes GDPR DPO maintains register of authorities.
5.6 Contact with special interest groups Yes Not currently a member of any security SIGs; monitor CERT-EU/CISA feeds; TODO evaluate memberships.
5.7 Threat intelligence Yes Subscribed to CISA, CERT-EU feeds.
5.8 Information security in project management Yes Integrated into SDLC checklist.
5.9 Inventory of information & other associated assets Yes Asset inventory maintained – see Asset Inventory.
5.10 Acceptable use of information Yes See Acceptable Use Policy.
5.11 Return of assets Yes HR off-boarding checklist.
5.12 Classification of information Yes See Information Classification Policy.
5.13 Labelling of information Yes Classification enforced via system-based access controls; explicit labels currently not used.
5.14 Information transfer Yes TLS 1.2+, SFTP; DLP rules.
5.15 Access control Yes See Access Control Policy, enforced via Google Workspace SSO.
5.16 Identity management Yes Google Workspace SSO; MFA mandatory.
5.17 Authentication information Yes Password & API-key standards; secret rotation.
5.18 Access rights Yes JIT elevated access; bi-monthly reviews.
5.19 Information security in supplier relationships Yes See Supplier Security Policy.
5.20 Addressing information security within supplier agreements Yes DPAs, SCCs signed; review schedule.
5.21 Managing information security in the ICT supply chain Yes Cloud vendor audits; SOC 2 / ISO certs collected.
5.22 Monitoring, review & change of supplier services Yes Annual vendor assessments.
5.23 Information security for use of cloud services Yes Cloud Security Posture Management (CSPM) tool enabled – see Business Continuity & DR Plan.
5.24 Information security incident management planning & preparation Yes See Incident Response Procedure.
5.25 Assessment & decision on information security events Yes Better Stack runbooks.
5.26 Response to information security incidents Yes SLA: <30 min acknowledgment.
5.27 Learning from information security incidents Yes Post-mortem RCA template used.
5.28 Collection of evidence Yes Chain-of-custody procedure.
5.29 ICT readiness for business continuity Yes See Business Continuity & DR Plan; DR tests.
5.30 Legal, statutory, regulatory & contractual requirements Yes Compliance register maintains GDPR, DPF, tax.
5.31 Intellectual property rights Yes Licence management & copyright policy.
5.32 Protection of records Yes Immutable buckets & tamper-evident logs.
5.33 Privacy & protection of personally identifiable information (PII) Yes Data Processing Addendum; privacy program.
5.34 Independent review of information security Yes Annual ISO 27001 internal/external audit.

A.6 People

No. Control Applicable? Implementation / Justification
6.1 Screening Yes ID and reference checks performed for critical personnel.
6.2 Terms and conditions of employment Yes Employment and contractor agreements include confidentiality, IP ownership, and return-of-assets clauses.
6.3 Information security awareness, education and training Yes Security training delivered at onboarding and upon critical changes; completion tracked.
6.4 Disciplinary process Yes HR disciplinary procedure defined for policy violations.
6.5 Responsibilities after termination or change Yes Off-boarding workflow disables access on last working day; assets returned.
6.6 Confidentiality or non-disclosure agreements Yes All employees and contractors sign confidentiality/NDA clauses.
6.7 Remote working Yes Zero-trust device stance; remote work guided by rules treating all company devices as untrusted regardless of location.

A.7 Physical

No. Control Applicable? Implementation / Justification
7.1 Physical security perimeter Yes Office entrance protected by password lock; devices treated as untrusted regardless of location (zero-trust).
7.2 Physical entry controls Yes Shared door code; no entry logging – TODO evaluate stronger access control & visitor logging.
7.3 Securing offices, rooms and facilities Yes All infrastructure is cloud-hosted; physical security provided by AWS data-centre controls.
7.4 Physical security monitoring Yes Reliance on cloud providers' CCTV and security monitoring; no on-prem monitoring.
7.5 Protecting against physical & environmental threats Yes Safeguards provided by AWS data-centre infrastructure (fire suppression, power, HVAC, flood protection).
7.6 Working in secure areas Yes Managed remotely; Clerk.io personnel do not access cloud provider secure areas.
7.7 Clear desk and clear screen Yes Automatic screen-lock enforced via MDM; staff instructed not to leave sensitive info unattended.
7.8 Equipment siting and protection Yes Cloud-provider safeguards plus employees secure laptops (screen lock, encrypted storage) when unattended.
7.9 Security of assets off-premises Yes Sensitive data stored exclusively in cloud services; laptops hold minimal local data and use default OS encryption.
7.10 Storage media Yes Removable media (USB, external drives) are prohibited for sensitive data; any permitted media must be encrypted and wiped before reuse/disposal.
7.11 Supporting utilities Yes Supporting utilities (power, cooling, networking) provided by AWS data centres with redundancy.
7.12 Cabling security No (N/A) No dedicated on-prem cabling; production traffic encrypted over internet (TLS/VPN).
7.13 Equipment maintenance Yes Cloud infrastructure only; laptops maintained by users & internal IT with vendor warranty service.

A.8 Technological

No. Control Applicable? Implementation / Justification
8.1 User endpoint devices Yes No central MDM; users follow standard good computer practices (OS auto-updates, full-disk encryption defaults).
8.2 Privileged access rights Yes Root privileges restricted to a small set of predefined users; other access assigned per-system and no unapproved root rights granted.
8.3 Information access restriction Yes Role-based access controls enforced across production systems and SaaS tools to uphold least-privilege.
8.4 Access to source code Yes GitHub repos restricted to authorised engineers with MFA; branch protection and PR review required.
8.5 Secure authentication Yes Google SSO used; MFA currently optional (not enforced for all accounts) – improvement roadmap item.
8.6 Capacity management Yes Cloud resource metrics monitored; autoscaling & capacity planning processes ensure sufficient capacity.
8.7 Protection against malware Yes EDR agents installed on laptops; container images scanned for vulnerabilities and malware in CI pipeline.
8.8 Management of technical vulnerabilities Yes Vulnerability scans run every 2 months; remediation timelines follow defined SLAs (critical ≤72 h, high ≤14 days).
8.9 Configuration management Yes TODO – adopt Infrastructure-as-Code for standardised secure configs.
8.10 Information deletion Yes Data deletion via cloud lifecycle policies and crypto-shredding; retention periods defined in policies.
8.11 Data masking Yes TODO – implement masking/anonymisation of PII in non-production environments.
8.12 Data leakage prevention Yes TODO – evaluate and implement DLP controls in Google Workspace and cloud storage.
8.13 Information backup Yes Backups run per policy; restore tests performed every 2 months to verify integrity.
8.14 Redundancy of information processing facilities Yes TODO – implement multi-region/zone redundancy and automated failover for critical services.
8.15 Logging Yes Logs from production systems are centralised to cloud SIEM; tamper-evident storage with alerting on anomalies and defined retention.
8.16 Monitoring activities Yes SIEM alerts forwarded to Better Stack; SRE/Security teams review dashboards and investigate alerts 24/7.
8.17 Clock synchronisation Yes Cloud and endpoint systems synchronise via NTP to reliable time sources (Google time service).
8.18 Use of privileged utility programs Yes Only authorised SREs may execute privileged utilities; usage is logged and reviewed.
8.19 Installation of software on operational systems Yes Installation controlled via infrastructure-as-code and immutable containers; direct installs prohibited.
8.20 Network security Yes VPC firewall rules, AWS WAF, and zero-trust TLS connections secure network traffic.
8.21 Security of network services Yes Third-party network services assessed for encryption and SLA; connections restricted to secure protocols.
8.22 Segregation of networks Yes Production, staging, and development VPCs are logically separated with firewall segmentation.
8.23 Web filtering TODO Evaluate implementation of web filtering for malicious sites/phishing protection.
8.24 Use of cryptography Yes TLS 1.2+ in transit; AES-256 at rest with CMEK; key management via cloud KMS.
8.25 Secure development life cycle Yes Secure coding guidelines, threat modelling, and security reviews integrated into SDLC.
8.26 Application security requirements Yes OWASP ASVS used to define security requirements captured in user stories/tickets.
8.27 Secure system architecture & engineering principles Yes Microservice architecture follows least-privilege, defense-in-depth, and zero-trust principles.
8.28 Secure coding Yes Developers trained on OWASP Top 10; static analysis and linters enforced in CI.
8.29 Security testing in development & acceptance Yes Automated SAST/DAST in CI/CD; annual third-party penetration tests.
8.30 Outsourced development No (N/A) Clerk.io does not outsource software development.
8.31 Separation of development, test & production environments Yes Separate cloud projects/environments with restricted access and data segregation.
8.32 Change management Yes GitHub pull-request workflow with peer review and automated deployments enforces change control.
8.33 Test information Partial TODO – implement consistent use of anonymised or synthetic data in tests (linked to 8.11).
8.34 Protection of information systems during audit & testing Yes Audit scans and testing are scheduled and isolated to avoid production impact; backups in place.

Controls A.6-A.8 (People, Physical, Technological) continue on next pages. TODO complete mapping for all 93 controls.