Annex A of ISO 27001:2022 defines 93 controls across four themes. ZeroTB maps each one to the same five enforcement domains used by SOC 2 and HIPAA. Same engine. Different lens.
ISO 27001:2022 organizes Annex A controls into four themes: Organizational, People, Physical, Technological. Each theme overlays the ZeroTB enforcement domains and inherits the same engine.
Certification requires both the ISMS and Annex A controls to be in place and working. ZeroTB provides the controls and the evidence. The ISMS is your governance layer; ZeroTB is the operational substrate underneath.
Surveillance audits each year and recertification on a three-year cycle. ZeroTB carries the evidence chain across each cycle without a quarter-end scramble.
Scope at a glance
ISO 27001:2022 Annex A controls map directly to the same enforcement domains. The integration substrate is the same. The lens is different.
Policies, governance, third-party management, supplier relationships.
Awareness, training, screening, disciplinary processes.
Endpoint, infrastructure, cryptography, vulnerability management.
Information security policy attestation per role and per material update
Access management with joiner-mover-leaver, periodic review, MFA, and privileged access controls
Cryptography policy applied to data at rest and in transit
Supplier security with due diligence cadence enforced
Asset inventory continuously reconciled across cloud, identity, and endpoint
Vulnerability detection with severity-tiered remediation and tracked SLAs
Configuration baselines on every cloud resource
Endpoint encryption, posture, and patch verified before SSO access
Audit logs preserved, signed, and retrievable by your certification body
ISMS-aligned evidence chain produced as a byproduct of enforcement