How Collabora Online supports ISO 27001 Annex A controls
Collabora Online helps an organization meet technological and access-related Annex A controls through configuration and evidence, but it does not make the organization compliant or certified. A regulated organization that must keep document editing inside its ISMS scope should treat the editor as one component of a documented system, with its own configuration baseline, access rules, logs and update records. ISO/IEC 27001:2022 Annex A lists 93 controls in four themes, and the editor touches only part of them. The platform's configuration, the WOPI host that decides who can open a document, the logs each component writes, and the update process for the editor and its packages are the areas where a deployment produces controllable evidence.
The main areas the deployment touches are secure configuration, access through the WOPI host, logging, patching and supplier management. Secure configuration covers the server settings, TLS, and the restriction of WOPI requests to known Collabora server addresses, as the Nextcloud administration manual recommends. Access control is largely set in the WOPI host: which groups may use the editor and which may edit rather than only view. Logging and patching depend on the operator collecting logs from the reverse proxy and Collabora server and applying advisories from the release notes. Supplier management covers Collabora's own practices, such as signed packages and security advisories, which you should review against your own supplier criteria. Ownership of the ISMS, risk assessment, policies, staff training, incident response and internal audit stays with the client.
Before you rely on this mapping, confirm with your certification body how it expects the Annex A controls to be evidenced, because auditors assess the operation of your management system rather than a product. DeployOpen can plan the configuration baseline, set up the systems and prepare the evidence an auditor will request, but it does not issue audit reports, attestations or certificates. Accredited certification bodies perform that assessment under ISO/IEC 17021-1 and ISO/IEC 27006-1, and the ISO certification page is a useful starting point for understanding who certifies what.
Mapping Annex A control areas to Collabora Online configuration
This table maps each Annex A theme of ISO/IEC 27001:2022 to the Collabora Online capability, the configuration step and the party who owns it. Read it as a starting point for your Statement of Applicability, since the control applicability decisions remain yours and your certification body's. The main takeaway is that most of the evidence sits in the WOPI host and the Collabora server configuration, so both teams need named owners.
| Annex A theme | Collabora Online capability and configuration step | Owner and evidence to keep |
|---|---|---|
| Organizational controls | Record Collabora Online as a supplier and as a component in the asset inventory, including the version and release branch in use | Information security or IT asset owner; asset register entry, supplier file and version record |
| Organizational controls | Choose between CODE and a supported Business or Enterprise subscription, based on whether your supplier terms need long term support and signed security updates | Procurement with the security lead; signed order or subscription terms and the support scope written into them |
| People controls | Limit who can open and edit documents through Nextcloud Office group settings, separating view-only users from editors | WOPI host administrator; group configuration export and periodic review records |
| People controls | Confirm that administrators with access to the Collabora server and the WOPI host are trained and that their access is approved | HR and IT operations; training records and admin access approvals |
| Physical controls | Where Collabora Online runs in your own data center or air-gapped network, the server sits inside your physical security perimeter; for cloud hosting, rely on the provider's controls | Infrastructure owner; hosting location record and provider attestations you obtained |
| Technological controls | Restrict WOPI requests to the IP addresses of the Collabora servers, as the Nextcloud administration manual recommends | WOPI host and network team; firewall rule export and a test showing requests from other addresses are refused |
| Technological controls | Use HTTPS for the Collabora server URL and match the protocol of the Nextcloud installation, as the Nextcloud administration manual recommends | Platform engineering; reverse proxy and TLS configuration, certificate inventory |
| Technological controls | Restrict editing and logging to the access model in your WOPI host, and record configuration baselines for the Collabora server | Platform owner; configuration baseline in version control and change records for each edit |
| Technological controls | Apply Collabora security advisories and signed package updates on a defined schedule, verifying signing keys for RPM and DEB installs | Operations team; patch log, advisory tracking record and package signature check results |
What evidence a Collabora Online deployment produces for auditors
An ISO 27001 auditor will ask for records, not explanations. The six items below are the records a self-hosted Collabora Online deployment produces most often, and each one needs an owner, a refresh rhythm and a named approver. Keep them in the same change record so the auditor can trace a setting to a version and a person.
Configuration baseline records
Keep a versioned copy of the loolwsd configuration and the ingress or reverse proxy settings for each environment, stored with the deployment code. Record the Collabora Online version, the TLS settings and the host platform's WOPI URL. Review the baseline at every upgrade and after every change to the server or proxy, and have the platform owner approve each revision before it reaches production.
WOPI allow list settings
Export the WOPI host allow list that Collabora Online accepts, and the IP restriction applied to WOPI requests on the host side. The Nextcloud administration manual recommends restricting WOPI requests to the Collabora server addresses, so the export should show that restriction in place. Compare it with the list of hosts the organization has approved, and have the security owner sign off on any difference.
Group access permission exports
Export which groups may open the editor and which may edit rather than only view, from the host platform. In Nextcloud Office, administrators set these limits by group, so the export is the access control evidence for the editing function. Run the export at each quarterly access review, and have the data owner for the document repository approve the group membership changes behind it.
Version and release records
Record each running Collabora Online version and the date it was deployed, with the branch and point release. The 25.04 branch was first released on June 19, 2025, and point releases continued into 2026, so an auditor will expect the running version to appear on the list of released fixes. Security fix 25.04.7.5, released January 29, 2026, fixed CVE-2026-23623. Show when each fix was applied and how long the gap was.
Package signing key change records
Keep a dated record of package signing key updates for the RPM and DEB packages used to install Collabora Online, along with the verification step that confirmed each new key. Collabora's 25.04 release notes record such a key update, so the change should appear in your change log as an event that needed verification, not as a routine install. Have the platform engineer who verified the key sign the entry, and keep the fingerprint with it.
Supplier documentation from the Business plan
If the deployment uses a paid Business subscription, keep the subscription terms, the service level agreement and the signed security update notices. The pricing page lists long term support, a service level agreement, signed security updates and customer portal access for this plan. Confirm the current terms in writing before relying on them, and file them with the supplier assessment so that ISO 27001 supplier controls can point to specific evidence.
Why the WOPI host carries most access control evidence
Collabora Online does not hold the user accounts that decide who can open a document. The WOPI host, such as Nextcloud, authenticates the user, checks their permissions on the file and then hands Collabora Online a session to edit or view it. For ISO 27001 purposes, this means the evidence an auditor will ask for (who was granted access, who could edit, and who changed those rights) is mainly generated by the host platform and its identity provider, not by the editor. Your access control narrative for Annex A should therefore start from the host, with Collabora Online described as the component that renders and edits content inside a session the host has already authorized.
Three settings work together here. First, the WOPI host restriction: the Nextcloud administration manual recommends limiting WOPI requests to the IP addresses of the Collabora servers and using HTTPS for the Collabora server URL, so that only your editor can call back into the host. Second, WOPISrc-aware routing: load balancers must send every session for one document to the same pod, which keeps collaborative editing consistent but also means routing rules are part of how sessions are attributed to a document. Third, the editor group settings in Nextcloud Office, which limit which groups can use the editor and which can edit rather than only view. Document these three settings as one access design, with a named owner for each and a record of who approved the group membership that drives them.
Before you rely on this model in an audit, confirm what your host platform logs for each event: file opens, edit sessions, permission changes and group membership changes, and how long those logs are retained. Ask whether the host can export them to your central logging system and whether it records the originating IP address. Also confirm how your load balancer logs WOPISrc-based routing, since that is often the only place a session can be traced to a pod. If any of these gaps exist, plan compensating evidence or a host-side change before the audit window opens.
What Collabora Online does not cover in your ISMS
Collabora Online handles document editing inside your environment, but it does not run your information security management system. The cards below mark the parts of ISO/IEC 27001:2022 that remain with your organization, your host platform, your suppliers and an accredited certification body.
The ISMS itself
Scope, the risk assessment, policies and management review are obligations of the organization, not of the editor. Collabora Online can be a documented component in your scope statement and risk register, but it cannot define your scope or accept your risks. Check that the risk treatment plan names the editing service, its owner and the data it touches, and that management review covers its incidents and changes.
Host platform authentication and logging
Collabora Online does not decide who may open a document. The WOPI host, such as Nextcloud, authenticates users, issues access tokens and records activity. Confirm that the host enforces your identity policy, that group rules limit who can edit, and that its audit logs reach your central logging. Editor-side logs alone will not show who opened which file.
Backup and restoration of documents
The editor works on documents in memory and does not hold your document store. Backups, retention and restore testing belong to the storage layer of the WOPI host. Define recovery point and recovery time targets for documents, test restoring a file that was edited during an upgrade, and record the results as evidence for the control owner.
Supplier management of your own contracts
Your ISMS must control suppliers you rely on, including Collabora and your hosting provider. Using the free CODE edition for production leaves you without a service level agreement, long term support or signed security updates, and the CODE page does not recommend it for production. Check that your supplier agreement provides the Business or Enterprise terms you need, and keep the contract in your supplier register.
Climate-related clauses from the 2024 amendment
ISO/IEC 27001:2022/Amd 1:2024 adds clause 4.1 wording that asks you to decide whether climate change is a relevant issue, and a note to clause 4.2 that interested parties may have climate-related requirements. Collabora Online has no role in that determination. Record your decision in the context of the organization, and note whether any customer or regulator has asked for climate-related information about your hosting.
The certification decision
ISO does not certify organizations, and neither does Collabora. An accredited certification body audits your ISMS and decides whether to certify it, under ISO/IEC 17021-1 and ISO/IEC 27006-1. Using Collabora Online does not make your organization certified, and the vendor's own certification does not transfer to you. Ask the body which evidence it will sample for the editing service, and check the certificate in the IAF CertSearch database.
Configuration sequence for an ISO 27001 aligned deployment
This sequence turns a Collabora Online deployment into controlled, documented configuration that an ISMS can scope, operate and evidence. It is a planning outline to confirm against your own environment, your certification body's expectations and your Collabora and host platform documentation.
Define the ISMS scope and boundaries
Start by writing down which systems fall inside the information security management system: the Collabora Online servers, the WOPI host (for example Nextcloud), the identity source, the storage holding documents, and the network paths between them. Record who owns each component and where documents are processed and stored. The step is done when the scope statement names every editor and host instance, and the owners have signed off on it. Confirm the boundary with your certification body before the scope is fixed.
Choose a supported Collabora Online edition
Decide between CODE and a subscription edition for production use, and pin a release branch that is still receiving point releases. CODE is described by Collabora as suited to testing, home use or small teams and not recommended for production, so the production decision needs a supported edition and a documented support contract. Record the branch, the exact build version and the support end expectation in the asset register. The step is done when the chosen edition and version are approved in writing and linked to the scope statement.
Restrict WOPI requests to Collabora addresses
Configure the WOPI host to accept WOPI traffic only from the known IP addresses of your Collabora servers, following the Nextcloud administration guidance. Confirm the allow list with your network team, including any load balancer or reverse proxy addresses that sit in front of the servers. Test that a request from an address outside the list is refused, and keep the test output. The step is done when the allow list matches the approved asset register and the negative test is recorded.
Match HTTPS protocols across host and editor
Set the Collabora server URL to use the same protocol as the Nextcloud installation, preferably HTTPS, so that documents and tokens do not travel over a weaker channel than the host uses. Check certificate validity, chain and hostnames on both sides, and confirm that plain HTTP endpoints are disabled where your design does not need them. The step is done when a configuration review shows matching protocols and a scan or manual check confirms that the editor is reachable only over the intended scheme.
Set group-based editing permissions
In the host, limit which groups can open the editor and which groups can edit rather than only view, as the Nextcloud Office settings allow. Map these groups to your access control policy and to the roles that need edit rights, and remove broad default groups where they are not justified. The step is done when the group configuration matches an approved access matrix and a sample of test accounts confirms that view-only users cannot save changes.
Enable logging and monitoring on both sides
Turn on access and error logging in the WOPI host and in Collabora Online, and forward both to a central log store under your retention rules. Define the events you need to investigate, such as failed WOPI requests, allow list rejections, authentication errors and administrative changes, and set alerts for the most important ones. Confirm that the logs carry timestamps and identifiers that let you link a host event to an editor event. The step is done when a test action produces matching entries in both logs and the alert is confirmed to fire.
Document a patch cadence tied to advisories
Write a patch procedure that names who watches Collabora security advisories and release notes, how quickly a fix is assessed, who approves the change, and how it is tested in a non-production copy before rollout. Include the package signing key checks for RPM and DEB installations, and the rollback step. Agree the review frequency with your risk owner, since no fixed interval is set by the vendor for your organization. The step is done when the procedure is approved and a first advisory has been walked through it as a tabletop exercise.
Collect the first evidence set before the internal audit
Gather the configuration baseline, the allow list and protocol settings, the group permission matrix, sample logs, the patch record and the supplier documentation into one evidence folder mapped to the relevant Annex A controls. Ask Collabora for the support and security documents your subscription covers, and note what you could not obtain. Review the folder with the control owners and close gaps before the internal audit. The step is done when each control has an owner, an artifact and a review date. Note that DeployOpen prepares this evidence but does not issue audit reports or certifications.
Questions buyers ask about ISO 27001 and Collabora Online
Is Collabora Online ISO 27001 certified?
No, certification does not apply to Collabora Online as software. ISO does not certify products or organizations itself; accredited certification bodies certify an organization's information security management system (ISMS) against ISO/IEC 27001:2022. Your organization is the certified party, and the question is whether your ISMS covers the document editing service and how it is controlled. Ask Collabora for its own certification documentation and confirm its scope and validity with the issuing body before you rely on it in your own audit evidence.
What does an ISO 27001 mapping for Collabora Online cost?
Cost follows the written scope, and DeployOpen does not publish a price list. The main drivers are the number of hosts that embed Collabora Online, how deeply evidence must be produced for each Annex A control, the number of users, and the integration work with your WOPI host such as Nextcloud. Software licensing is a separate line. Collabora's Business plan is listed at 3 euros per user per month for up to 99 users, and it includes long term support, a service level agreement and signed security updates, so ask whether that plan or the community edition fits your evidence needs. The licence recurs monthly, while the mapping and documentation work is typically one-time with later review effort.
How long does the work take?
Duration depends on scope, the number of WOPI hosts, the current state of your ISMS documentation and how many internal reviews are needed before sign-off. Any timeline is agreed in writing as part of a fixed-scope proposal before work starts. Ask for the milestones, the evidence each milestone produces, and which items depend on your own teams, such as access reviews or change approvals. Your certification body's audit calendar may also set a deadline that the plan has to meet.
What must our team provide for the engagement?
Expect to provide three groups of people. ISMS owners supply the policies, risk register, statement of applicability and the scope definition that the Collabora Online deployment must fit into. Host administrators, usually for Nextcloud or another WOPI host, provide access to configuration, logs and the allow lists for WOPI requests. Business sign-off comes from the people who accept risk and approve the controls. Agree in advance who answers questions, how quickly reviews happen and who signs each deliverable, because delays in those roles usually matter more than technical work.
Can our own team do this without a partner?
Yes, a capable internal team can map Annex A controls to a Collabora Online deployment, provided it has people who understand the ISMS and people who run the host platform. The work includes reading the controls, documenting configuration baselines, defining logging and patching routines, and recording supplier management evidence. A partner is most useful when internal staff lack time or experience with the technical controls, or when an independent review before the certification audit is wanted. Compare the internal effort in hours and skills with a written proposal before deciding.
How does the ISO/IEC 27001:2022 transition affect existing certificates?
Under IAF MD 26:2023, all certifications to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. If your organization still references the 2013 edition, it must have moved to the 2022 edition, which restructured Annex A into 93 controls in four themes. Your Collabora Online control mapping should cite the 2022 control IDs and attributes. Confirm your current certificate status with your certification body and check the IAF CertSearch database if you need to verify an accredited certificate.
What about the software updates and supplier evidence the auditor will ask for?
Auditors usually want to see how you learn about security updates, how quickly you apply them, and how you evaluate the supplier. For Collabora Online, that means recording the release branch you run, the advisories you have reviewed, and the patch decisions you made. Collabora publishes security advisories, and its release notes record fixes such as CVE-2026-23623 in 25.04.7.5. Ask the vendor which support terms apply to your version, and keep the written evidence in your supplier management file.
What to confirm with your certification body before the audit
Before the audit, agree the rules with your certification body rather than discovering them at the closing meeting. Accredited ISMS certification bodies work to ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024, and IAF MD 29:2024 required them to apply the latter to all clients by 31 March 2026. Ask which edition and transition rules they apply to your file. A three-year certification cycle under ISO/IEC 17021-1 includes at least one audit, either surveillance or recertification, in every calendar year, so plan your Collabora Online evidence around those annual points, not just the initial audit.
Agree three things early. First, the scope statement: confirm whether the Collabora Online server, the WOPI host (for example Nextcloud), the storage behind it and the administrative access paths are inside the boundary, and document any exclusions with reasons. Second, the evidence formats the auditor will accept, such as exported configuration files, change records from upgrades, access review exports from the WOPI host and vulnerability scan results, so you can produce them without manual reconstruction. Third, the treatment of the editor as a supplier component. Ask how the auditor expects you to assess Collabora as a supplier of software you run, and what Collabora materials you will rely on, such as its Collabora Online product page for component information and its release notes for patch history.
Before you sign an audit contract, check that the body is accredited for ISO/IEC 27001 and that its certificates are verifiable. ISO points to the IAF CertSearch database for checking accredited certificates, and since 1 January 2026 Global ACI has taken over the roles of IAF and ILAC, so confirm the current accreditation status with the body and its accreditation authority rather than relying on older guidance. Also confirm with the auditor which ISO/IEC 27001:2022 Annex A controls they will sample, since the control set is organized into four themes. Write this list down, because it determines which configuration baselines, access logs and patching records must exist on the audit date.
How DeployOpen scopes and delivers ISO 27001 aligned Collabora Online work
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Collabora Online in an ISO 27001 environment, that means preparing the configuration, access, logging, patching and supplier evidence your Information Security Management System needs, while your certification body decides what meets the standard.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope names the WOPI hosts, Collabora Online servers, networks and Annex A control areas in your Statement of Applicability.
- We confirm which evidence you need from the deployment and which items remain your own policies or auditor decisions.
How we build
- We configure Collabora Online against your WOPI host allow list, TLS settings and administrative access model, then record each baseline.
- Logging, monitoring and patch procedures are set up in your infrastructure so that events and version records can be reviewed.
- We test document editing, access rules and failure cases in a staging environment before any production change.
How we hand over
- You receive configuration documentation, a control-to-evidence map and runbooks for patching, backup and access reviews.
- Handover includes a walkthrough with the owners of identity, network, logging and supplier management in your organization.
- Documentation is written in your own environment's terms so your internal auditors and certification body can trace each claim.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers once the initial scope is delivered.
- Retainers can cover advisory reviews when Collabora publishes security advisories or new release branches.
- Support scope, response expectations and service levels are written into the retainer agreement, so you can confirm them before signing.
