ISO 27001 Compliance

Note: ISO 27001 policy framework requires Enterprise Edition.

The ISO 27001:2022 policy framework implements information security management controls with a focus on data leakage prevention.

Overview

ISO 27001:2022 is the international standard for information security management. Aquilon DLP’s ISO 27001 policy implements key controls:

• A.8.12: Data leakage prevention (NEW in 2022 revision)
• A.5.12: Classification of information
• A.8.11: Data masking

Note: Control A.8.12 explicitly mandates DLP capabilities, making this a core requirement for ISO 27001:2022 certification.

Data Classification Levels

The ISO 27001 policy uses a four-level classification system:

Scanner Classifications

All 50+ scanners are automatically classified:

Restricted (Critical)

• private_key, api_key, jwt, aws_access_key
• credit_card, cvv
• ssn (in certain contexts)

Confidential (High)

• ssn, passport, drivers_license
• bank_account, iban
• health_record, medical_record_number

Internal (Medium)

• email, phone, address
• date_of_birth
• employee_id

Public (Low)

• Generic patterns without sensitive details

Global PII Coverage

ISO 27001 is an international standard. Organizations operating across multiple jurisdictions need comprehensive national ID detection. Aquilon DLP includes 28 country-specific national ID scanners with checksum validation.

Europe (14 scanners)

Americas (4 scanners)

Asia-Pacific (8 scanners)

Middle East & Africa (2 scanners)

Note: All national ID scanners use country-specific context keywords to increase detection confidence and reduce false positives.

See Policy Frameworks for detailed scanner documentation.

Configuration

Basic Configuration

[policies]
enabled_policies = ["iso27001"]

Advanced Configuration

[policies.policy_configs.iso27001]
settings = { confidence_threshold = "0.7", enforce_data_masking = "true", classification_level = "confidential" }

Configuration Options

Control Implementation

Control A.8.12 - Data Leakage Prevention

Aquilon DLP directly implements A.8.12 by:

1. Monitoring data at rest: Scans file systems for sensitive data
2. Classification: Automatically classifies detected data
3. Alerting: Generates violations for inappropriate storage
4. Reporting: Provides audit trails for compliance

Control A.5.12 - Classification of Information

Each finding includes classification metadata:

{
  "classification_level": "confidential",
  "classification_reason": "Contains SSN (direct identifier)",
  "handling_requirements": ["encryption_at_rest", "access_logging"]
}

Control A.8.11 - Data Masking

When enforce_data_masking is enabled, detected values are masked:

Original: 122-45-6789
Masked: ***-**-6789

Violation Metadata

Each ISO 27001 violation includes:

{
  "policy": "ISO27001",
  "severity": "high",
  "classification": "confidential",
  "iso_control": "A.8.12",
  "control_name": "Data leakage prevention",
  "handling_requirements": [
    "encrypt_at_rest",
    "restrict_access",
    "audit_logging"
  ]
}

Compliance Reporting

Query by Classification Level

-- All restricted data exposures (immediate action)
SELECT path, scanner, timestamp
FROM aquilon_dlp_alerts
WHERE policy = 'ISO27001'
  AND severity = 'critical';

-- Classification distribution
SELECT severity as classification, COUNT(*) as count
FROM aquilon_dlp_alerts
WHERE policy = 'ISO27001'
GROUP BY severity
ORDER BY count DESC;

-- Control A.8.12 compliance status
SELECT
  date(timestamp) as date,
  COUNT(*) as findings
FROM aquilon_dlp_alerts
WHERE policy = 'ISO27001'
GROUP BY date
ORDER BY date DESC
LIMIT 30;

Certification Audit Support

Generate reports for ISO 27001 auditors:

-- Data leakage prevention evidence (Control A.8.12)
SELECT
  'Files with Findings' as metric,
  (SELECT COUNT(DISTINCT path) FROM aquilon_dlp_alerts WHERE policy = 'ISO27001') as value
UNION ALL
SELECT
  'Total Findings',
  (SELECT COUNT(*) FROM aquilon_dlp_alerts WHERE policy = 'ISO27001')
UNION ALL
SELECT
  'Critical Findings',
  (SELECT COUNT(*) FROM aquilon_dlp_alerts
   WHERE policy = 'ISO27001' AND severity = 'critical');

Best Practices

Monitoring Strategy

1. Immediate alert: Restricted classification findings
2. Daily review: Confidential data exposures
3. Weekly audit: Internal data, classification accuracy

Information Security Management System (ISMS)

Use Aquilon DLP findings to support ISMS:

1. Risk Assessment: Identify data exposure risks
2. Risk Treatment: Implement controls based on classification
3. Monitoring: Continuous compliance monitoring
4. Improvement: Refine policies based on findings

Statement of Applicability (SoA)

Document control implementation:

Certification Support

Pre-Audit Checklist

• ISO 27001 policy enabled and configured
• All data locations included in watch_paths
• Classification levels match organization’s scheme
• Historical findings retained for audit period
• Remediation process documented

Evidence Collection

Collect evidence for auditors:

-- Export findings for audit period
SELECT * FROM aquilon_dlp_alerts
WHERE policy = 'ISO27001'
  AND timestamp BETWEEN '2024-01-01' AND '2024-12-31'
ORDER BY timestamp;

Related Resources

• Compliance Overview
• Configuration Guide
• Monitoring