Skip to main content

Compliance · ISO/IEC 27001

ISO/IEC 27001: contribution to the Annex A measures

Annex A of ISO/IEC 27001:2022 contains 93 measures grouped into four themes. An information security management system is built first and foremost on processes; Kayzen can contribute to some of the technical measures.

General information, not legal advice. Your situation and obligations are to be validated by a professional. Kayzen contributes to certain measures; it does not make any organisation compliant.

Kayzen Security is under development: no module is on sale yet. The contributions described here are based on K-Comply's technical mapping and on the actual status of each module as of 31 October 2026.

ISO/IEC 27001

45 of the 93 Annex A measures have at least one Kayzen capability linked to them. This does not mean they are covered: each one retains an organisational component.

The four themes of Annex A

  • Organisational measures (5.x)

    Policies, roles, suppliers, incidents, continuity: Kayzen contributes mainly to asset inventory, access control and incident management.

  • People measures (6.x)

    Recruitment, awareness, remote work: Kayzen contributes mainly to the security of remote working.

  • Physical measures (7.x)

    Premises and equipment: Kayzen only contributes to the protection of storage media, off-premises devices and erasure before reuse.

  • Technological measures (8.x)

    Endpoints, privileged access, malware, vulnerabilities, logging, web filtering: this is where Kayzen's contribution is greatest.

Annex A measures concerned, by module

The ISO/IEC 27001 standard is protected by copyright: only the measure numbers are reproduced here. Refer to your copy of the standard for their titles.

Annex A measures concerned, by module
Module or componentAnnex A measures
  • 5.2
  • 5.3
  • 5.9
  • 5.15
  • 5.16
  • 5.17
  • 5.18
  • 5.28
  • 5.33
  • 6.7
  • 7.9
  • 8.1
  • 8.2
  • 8.3
  • 8.5
  • 8.9
  • 8.15
  • 8.32
  • 5.3
  • 5.10
  • 8.7
  • 8.18
  • 8.19
  • 8.32
  • 5.7
  • 5.10
  • 6.7
  • 8.1
  • 8.7
  • 8.21
  • 8.23
  • 5.7
  • 5.24
  • 5.25
  • 5.26
  • 5.27
  • 5.28
  • 8.7
  • 8.15
  • 8.16
  • 5.9
  • 5.11
  • 5.21
  • 5.32
  • 8.1
  • 8.8
  • 8.9
  • 8.19
  • 5.14
  • 6.8
  • 8.12
  • 5.17
  • 5.18
  • 8.2
  • 8.18
  • 8.19
  • 5.26
  • 6.7
  • 8.20
  • 8.22
  • 5.33
  • 5.35
  • 5.36
  • 5.37
  • 7.9
  • 7.10
  • 7.14
  • 8.1
  • 8.9
  • 8.12
  • 8.24

Limits

  • Kayzen provides neither certification nor audits: certification is issued by an accredited body.
  • Kayzen itself does not claim any ISO/IEC 27001 certification to date.
  • Physical, legal, contractual and people-related measures remain overwhelmingly organisational.

See also