The infrastructure side of ISO 27001: open-source and self-hosted tools that run controls and keep evidence, GRC tools with ISO 27001 libraries, building on AWS or Azure and using their certificates, and infrastructure as code as evidence.
Which open-source tools cover Annex A controls auditors test often (identity and MFA, logging and monitoring, access reviews, secrets, vulnerability scanning, asset inventory, documentation and GRC), their licenses and edition limits, and the evidence each keeps.
Running the ISO 27001 risk register, Statement of Applicability and audits in a self-hosted GRC tool: what CISO Assistant's framework library includes for ISO 27001, what eramba Community does, their licenses and the features held back for paid editions.
Building an ISO 27001 ISMS on AWS: what AWS's ISO 27001, 27017 and 27018 certificates cover and who issued them, finding in-scope services and regions, why you are not certified by association, and the cloud services control you still own.
Building an ISO 27001 ISMS on Azure: which Microsoft clouds and services the certificate covers, getting audit documents from the Service Trust Portal, the Azure Policy ISO 27001 initiative and its limits, and the assessment work that stays with you.
How infrastructure as code, Kubernetes admission policies and CI pipelines provide evidence for configuration management (A.8.9) and change management (A.8.32), container and dependency scanning, and the audit-log limits of free editions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.