EPIC: ISO/IEC 27001 engineering readiness for vsms

[stephane-segning]

Goal

Make vsms technically ready to operate inside a VAAM ISO/IEC 27001:2022-certified ISMS by producing enforceable product controls and repeatable audit evidence.

ISO/IEC 27001 certification applies to the organisation's scoped ISMS, not to this repository alone. This epic therefore covers vsms engineering controls/evidence only and feeds the organisation's risk assessment, risk-treatment plan and Statement of Applicability (SoA).

The control set must ultimately be selected through the organisation's risk process; Annex A is a reference set, not a checklist that this repo can declare applicable by itself.

Stories

Recommended order:

• ISO 27001: maintain vsms security asset, data-flow and control-evidence map #378 — maintain security asset, data-flow and control-evidence map
• ISO 27001: formalise secure SDLC, vulnerability management and release provenance #379 — formalise secure SDLC, vulnerability management and release provenance
• npm Trusted Publishing is still bound to the old owner: v0.3.1 shipped without provenance #354 — restore trusted-publishing provenance and treat the unprovenanced release as an explicit supply-chain gap
• ISO 27001: harden privileged access, system identities and secrets lifecycle #380 — harden privileged access, system identities and secrets lifecycle
• Evaluate auth().isSystem() (cratestack 0.7.10) against the seven-times-repeated hasRole(system) gap and #155's golden test #176 — resolve/accept the existing structurally-unforgeable system-principal question
• ISO 27001: prove backup, restore and service-recovery controls for vsms #381 — prove backup, restore and service-recovery controls
• ISO 27001: make security logging, monitoring and incident evidence audit-ready #382 — make security logging, monitoring and incident evidence audit-ready
• GDPR: add personal-data breach evidence and incident export for vsms #376 — reuse GDPR incident-evidence/export work for personal-data incidents rather than duplicating it

Definition of done

This epic is complete when:

• vsms assets, trust boundaries, carrier/provider dependencies and implemented controls have maintainable evidence references;
• changes/releases follow a documented secure-SDLC path with vulnerability handling, provenance and auditable exceptions;
• privileged access, system identities and cryptographic/secrets lifecycles are least-privilege, revocable and reviewable;
• backup/restore and recovery are proven through repeatable drills against organisation-approved objectives;
• security-relevant events are logged, protected, monitored and usable to reconstruct representative incidents;
• existing overlapping issues (npm Trusted Publishing is still bound to the old owner: v0.3.1 shipped without provenance #354, Evaluate auth().isSystem() (cratestack 0.7.10) against the seven-times-repeated hasRole(system) gap and #155's golden test #176, GDPR: add personal-data breach evidence and incident export for vsms #376) are resolved or explicitly represented as residual risks/gaps rather than duplicated;
• every claimed control has a repeatable evidence source (test, CI result, configuration, log, runbook or drill);
• the repository never claims that completing this epic equals ISO/IEC 27001 certification.

Out of scope / required organisation-wide ISMS work

Separate VAAM-level work is still required for certification, including: ISMS scope/context and interested parties; information-security policy and objectives; risk methodology/register and treatment plan; Statement of Applicability; organisation-wide asset and supplier registers; HR/onboarding/offboarding controls; access-review governance; legal/contractual requirements; security awareness; incident-management governance; business impact analysis/continuity objectives; internal audit; management review; nonconformity/corrective-action process; certification-body Stage 1/Stage 2 audits and ongoing surveillance.