Why now – Palantir alternatives for Europe: what 'sovereign' actually means, and how European public bodies are decidingRegister →
ISO/IEC 27001

Security controls your auditor can watch running

ISO/IEC 27001 is the international benchmark for an information security management system. Scrydon gives your ISMS enforced controls over AI and data workloads — and the audit evidence to prove them — while certification of your programme stays yours.

Written for the security, risk and data protection teams who have to evidence this — not just describe it.

Book a briefingCommon Questions
What it is

ISO/IEC 27001 (ISO 27001)

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a governed, risk-driven way of protecting the confidentiality, integrity and availability of information. The current edition, ISO/IEC 27001:2022, requires an organisation to define the scope and context of its ISMS, assess and treat information security risks, and operate, monitor and continually improve its controls. Annex A provides a reference set of 93 controls in four themes — organisational, people, physical and technological. Certification is granted by accredited certification bodies after audit and maintained through surveillance audits and a three-year recertification cycle; the transition period from the 2013 edition ended on 31 October 2025. Because ISO 27001 is a management-system standard, it certifies an organisation's ISMS and its declared scope, never a product. Scrydon runs its own ISMS aligned with ISO/IEC 27001 and reports its status openly on the compliance hub; this page is about how the platform supports the ISMS you operate.
At a glance
Jurisdiction
International
Applies to
Any organisation that operates an information security management system — routinely required of software vendors, service providers and regulated enterprises by customers, regulators and procurement.
Talk to us
How we help

How Scrydon helps you comply

Controls are built into the runtime, so compliance is something you can demonstrate with evidence drawn from the platform itself — not assembled after the fact.

Access control and least privilege

Three-tier access control — organisation roles, workspace membership and team grants — with a single policy-as-code decision point and fail-closed defaults gives you enforced least privilege over AI and data workloads. This maps to Annex A's access-control, identity-management and privileged-access controls, and every decision is recorded so you can evidence that the control operates as designed.

Cryptography and key custody

LOCAL, BYOK and HYOK key strategies let you decide who holds the keys, and an mTLS service mesh encrypts every service-to-service call. Together these address Annex A's cryptography and information-transfer controls and let you keep key management inside your own ISMS boundary rather than delegating it to an operator.

Logging, monitoring and audit evidence

The immutable, queryable audit log captures actor, IP, decision and agent action with redaction and retention controls. It supports Annex A's logging and monitoring controls directly and, because it is queryable, gives internal and external auditors sampled evidence of control operation instead of screenshots and attestations.

Classification and data leakage prevention

Document clearance and classification govern which information can reach which context, and the DLP guardrails engine can block or redact sensitive data in model inputs and outputs. This supports Annex A's information-classification and labelling controls and the data-leakage-prevention control introduced in the 2022 edition.

Shared responsibility and framework evidence packs

Evidence packs map platform controls to ISO 27001 Annex A alongside ISO 42001, SOC 2 and the EU frameworks, and set out which controls the platform enforces and which remain yours in a given deployment. Combined with Scrydon's published ISMS status, this gives you the supplier due-diligence evidence Annex A's supplier-relationship controls expect.

Key requirements

What ISO 27001 asks of you

  • Define the ISMS scope, context and interested parties, with visible leadership commitment.
  • Run a documented risk assessment and risk-treatment process and maintain a Statement of Applicability.
  • Select and implement controls, using Annex A's 93 controls as the reference set.
  • Assign roles, competence and awareness, and manage documented information.
  • Monitor, measure and internally audit the ISMS, with regular management review.
  • Handle information security incidents and govern supplier relationships.
  • Continually improve, and pass certification, surveillance and recertification audits where certification is sought.
Where the line sits

What we provide, and what stays yours

No vendor can be compliant on your behalf. We build the controls into the platform and produce the evidence; the assessment of your own deployment stays with you. Here is the split, stated plainly, so it does not surface late in a security review.

Scrydon provides

  • Controls enforced in the runtime by default, rather than left to configuration.
  • An immutable, queryable record of what ran, on whose authority, and against which data.
  • Evidence packs mapped to the obligations set out on this page.
  • Documented architecture and data flows your assessors can read.
  • Deployment inside your own perimeter — up to fully disconnected.

You remain responsible for

  • Classifying your own systems and data under the framework.
  • Your risk assessment, data protection impact assessment and conformity assessment.
  • Who you grant access to, and on what basis.
  • Your incident response and reporting obligations.
  • The operational security of the environment you run it in.
Our security postureRead the documentation
FAQ

Frequently asked questions

Is Scrydon ISO 27001 certified?+
Not yet, and we say so plainly. Scrydon operates an ISMS aligned with ISO/IEC 27001, monitors its controls continuously and publishes the programme's status — internal audit, then external certification audits — on the compliance hub. We publish status, not promises; a certification claim will appear only once external audits are complete. Either way, your ISO 27001 certificate covers your ISMS and its declared scope, and no vendor's certificate substitutes for it. What Scrydon adds is enforced controls and evidence inside your scope.
How do Scrydon's controls map to Annex A?+
The platform's controls fall mainly under the technological and organisational themes: three-tier access control and policy-as-code for access control and privileged access, BYOK/HYOK and the mTLS service mesh for cryptography and information transfer, the immutable audit log for logging and monitoring, document classification and DLP guardrails for classification and data leakage prevention, and retention controls for information deletion. Framework evidence packs list the mapping control by control so you can reference it from your Statement of Applicability.
What evidence can we hand to our auditor?+
The audit log is immutable and queryable, so you can pull time-bounded samples showing who accessed what, which policy decision was taken and how a guardrail acted. Access-control configuration, key strategy and classification rules are inspectable, and evidence packs summarise the control mapping. This gives auditors evidence of control operation drawn from the system itself, which is what an ISO 27001 audit is looking for.
How does shared responsibility work for the Statement of Applicability?+
It depends on where the platform runs. In a self-hosted or sovereign deployment you operate the physical and infrastructure controls and Scrydon enforces the application, data and AI controls above them; evidence packs make that split explicit. You then decide, control by control, whether an Annex A control is applicable, who operates it and how it is evidenced — the platform's role is to make the controls it owns enforceable and demonstrable, not to make the decision for you.
Does the platform support the 2022 edition specifically?+
Yes. ISO/IEC 27001:2022 restructured Annex A into 93 controls and added controls such as data leakage prevention, monitoring activities, data masking and information deletion. Scrydon's DLP guardrails, queryable audit log, redaction and retention controls speak directly to those additions, and the transition period from the 2013 edition ended on 31 October 2025, so the 2022 control set is now the one your programme is measured against.
Can we keep our own encryption keys, and does that matter for ISO 27001?+
Yes on both counts. BYOK and HYOK keep key custody in your hands, so the cryptography and key-management controls in your ISMS remain yours to operate and evidence rather than being delegated to an operator you cannot audit. For regulated and sovereign deployments this often decides whether the platform can sit inside the ISMS scope at all.
How does ISO 27001 relate to ISO 42001, NIS2 and SOC 2?+
ISO 42001 shares ISO 27001's harmonised structure, so the two are commonly run as one integrated management system, with 27001 covering information security and 42001 covering AI-specific risk and impact. NIS2 and SOC 2 draw on largely the same technical measures. Scrydon's evidence packs map its controls to all four at once, so a control evidenced for ISO 27001 does not need to be re-evidenced separately for each framework.

Related

Trust & Security→Sovereign Foundations→NIS2→ISO/IEC 42001→All compliance frameworks→

Or write to us

Tell us what you are working on and who should reply. A person reads it and replies within one business day.

We only use these details to reply to you. Privacy policy

Prefer to write? Email hello [at] scrydon.com and we will get back to you.

Back to all compliance frameworks