> ## Documentation Index
> Fetch the complete documentation index at: https://docs.botbrains.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Statement of Applicability

> How botBrains applies the 93 ISO/IEC 27001:2022 Annex A controls

**R02** · **Version 1.1** · Effective October 25, 2026 · Last CISO review October 25, 2026. Version control records every change and review.

> **[Download as PDF](https://www.botbrains.io/files/legal/botbrains-statement-of-applicability.pdf)**

The Statement of Applicability (SoA) records how botBrains applies each of the 93 ISO/IEC 27001:2022 Annex A controls: whether the control is in scope, which policy governs it, and its implementation status. It's the index that ties the [policies](https://docs.botbrains.io/trust/iso-27001-document-register.md) to the controls they satisfy.

## How to read this

* **Applicable.** Whether the control is in scope. The only exclusion is outsourced development, which botBrains doesn't do.
* **Implemented.** `Yes` (operating), `Inherited` (operated by a certified provider), `Partial; …` (in place, with the action that finishes it), or `No; …` (applicable, with the action that starts it).
* **Policy.** The governing policy, with the specifics that add detail.

## A.5 Organizational controls

| Annex A | Control | Applicable | Implemented | Policy |
| - | - | - | - | - |
| 5.1 | Policies for information security | Yes | Yes | [Information Security](https://docs.botbrains.io/trust/policies/information-security-policy.md) |
| 5.2 | Information security roles and responsibilities | Yes | Yes | [Roles & Responsibilities](https://docs.botbrains.io/trust/policies/roles-and-responsibilities.md) (CISO named; co-founder alternate) |
| 5.3 | Segregation of duties | Yes | No | [Roles & Responsibilities](https://docs.botbrains.io/trust/policies/roles-and-responsibilities.md) (documented compensating controls, accepted risk) |
| 5.4 | Management responsibilities | Yes | Yes | [Information Security](https://docs.botbrains.io/trust/policies/information-security-policy.md); [Code of Conduct](https://docs.botbrains.io/trust/policies/code-of-conduct.md) |
| 5.5 | Contact with authorities | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md) (see internal communication plan) |
| 5.6 | Contact with special interest groups | Yes | Yes | BITS via Slack, SIEM reads NVD, GitHub advisories |
| 5.7 | Threat intelligence | Yes | Yes | [Vulnerability Management](https://docs.botbrains.io/trust/policies/vulnerability-management-policy.md); [Responsible Disclosure](https://docs.botbrains.io/trust/policies/responsible-disclosure-policy.md) (Dependabot advisories, disclosure inputs, SIEM) |
| 5.8 | Information security in project management | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) See design stage |
| 5.9 | Inventory of information and associated assets | Yes | Yes | [Asset Management](https://docs.botbrains.io/trust/policies/asset-management-policy.md) |
| 5.10 | Acceptable use of information and assets | Yes | Yes | [Acceptable Use](https://docs.botbrains.io/trust/policies/acceptable-use-policy.md) |
| 5.11 | Return of assets | Yes | Yes | [Asset Management](https://docs.botbrains.io/trust/policies/asset-management-policy.md); [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) (leaver process, laptop return) |
| 5.12 | Classification of information | Yes | Yes | [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md) (four-level scheme) |
| 5.13 | Labelling of information | Yes | Yes | [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md) (context-based labelling) |
| 5.14 | Information transfer | Yes | Yes | [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md); [Cryptography](https://docs.botbrains.io/trust/policies/cryptography-policy.md) (transfer rules by level; TLS 1.3, min 1.2) |
| 5.15 | Access control | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (least privilege, RBAC) |
| 5.16 | Identity management | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (unique named accounts) |
| 5.17 | Authentication information | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (MFA, password manager, Clerk) |
| 5.18 | Access rights | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (joiner-mover-leaver, access reviews) |
| 5.19 | Information security in supplier relationships | Yes | Yes | [Supplier Management](https://docs.botbrains.io/trust/policies/supplier-management-policy.md) (supplier due diligence) |
| 5.20 | Addressing security within supplier agreements | Yes | Yes | [Supplier Management](https://docs.botbrains.io/trust/policies/supplier-management-policy.md) (Art. 28 DPAs on file) |
| 5.21 | Managing security in the ICT supply chain | Yes | Yes | [Supplier Management](https://docs.botbrains.io/trust/policies/supplier-management-policy.md) (model-subprocessor rules) |
| 5.22 | Monitoring, review and change of supplier services | Yes | Yes | [Supplier Management](https://docs.botbrains.io/trust/policies/supplier-management-policy.md) (annual supplier review defined) |
| 5.23 | Information security for use of cloud services | Yes | Yes | [Supplier Management](https://docs.botbrains.io/trust/policies/supplier-management-policy.md) (EU cloud, DPAs, residency rules) |
| 5.24 | Incident management planning and preparation | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md) (incident lifecycle defined) |
| 5.25 | Assessment and decision on security events | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md) (triage and severity) |
| 5.26 | Response to information security incidents | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md); [Breach Notification](https://docs.botbrains.io/trust/policies/breach-notification-policy.md) |
| 5.27 | Learning from information security incidents | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md) (root-cause analysis) |
| 5.28 | Collection of evidence | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md) (evidence preservation) |
| 5.29 | Information security during disruption | Yes | Yes | [Business Continuity & DR](https://docs.botbrains.io/trust/policies/business-continuity-and-disaster-recovery.md) |
| 5.30 | ICT readiness for business continuity | Yes | Yes | [Business Continuity & DR](https://docs.botbrains.io/trust/policies/business-continuity-and-disaster-recovery.md); [Backup](https://docs.botbrains.io/trust/policies/backup-policy.md) (RTO/RPO, backups, failover) |
| 5.31 | Legal, statutory, regulatory and contractual requirements | Yes | Yes | [Data Protection](https://docs.botbrains.io/trust/policies/data-protection-policy.md) (GDPR met; Article 30 Record of Processing Activities) |
| 5.32 | Intellectual property rights | Yes | Yes | [Code of Conduct](https://docs.botbrains.io/trust/policies/code-of-conduct.md); [Acceptable Use](https://docs.botbrains.io/trust/policies/acceptable-use-policy.md) |
| 5.33 | Protection of records | Yes | Yes | [Data Retention](https://docs.botbrains.io/trust/policies/data-retention-policy.md) (retention and protection of records) |
| 5.34 | Privacy and protection of PII | Yes | Yes | [Data Protection](https://docs.botbrains.io/trust/policies/data-protection-policy.md) (GDPR processor controls; Article 30 Record of Processing Activities) |
| 5.35 | Independent review of information security | Yes | Yes | [Employees Only: Internal Audit Programme](https://app.notion.com/p/404481da93cf80b8bfb6cce5ea9b1ccb) |
| 5.36 | Compliance with policies, rules and standards | Yes | Yes | [Information Security](https://docs.botbrains.io/trust/policies/information-security-policy.md) (enforcement clauses) |
| 5.37 | Documented operating procedures | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md) |

## A.6 People controls

| Annex A | Control | Applicable | Implemented | Policy |
| - | - | - | - | - |
| 6.1 | Screening | Yes | Yes | [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) (proportional checks defined) |
| 6.2 | Terms and conditions of employment | Yes | Yes | [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) (contracts with confidentiality terms) |
| 6.3 | Information security awareness, education and training | Yes | Partial | [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) |
| 6.4 | Disciplinary process | Yes | Yes | [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) |
| 6.5 | Responsibilities after termination or change | Yes | Yes | [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) (offboarding, continuing confidentiality) |
| 6.6 | Confidentiality or non-disclosure agreements | Yes | Yes | [HR Security](https://docs.botbrains.io/trust/policies/human-resource-security-policy.md) (required before access) |
| 6.7 | Remote working | Yes | Yes | [Acceptable Use](https://docs.botbrains.io/trust/policies/acceptable-use-policy.md); [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (fully remote; home-office controls) |
| 6.8 | Information security event reporting | Yes | Yes | [Incident Management](https://docs.botbrains.io/trust/policies/incident-management-policy.md); [Responsible Disclosure](https://docs.botbrains.io/trust/policies/responsible-disclosure-policy.md) |

## A.7 Physical controls

| Annex A | Control | Applicable | Implemented | Policy |
| - | - | - | - | - |
| 7.1 | Physical security perimeters | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (certified data centers) |
| 7.2 | Physical entry | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (provider access control) |
| 7.3 | Securing offices, rooms and facilities | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (no own offices; home-office) |
| 7.4 | Physical security monitoring | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (provider surveillance) |
| 7.5 | Protecting against physical and environmental threats | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (provider fire, power, and climate controls) |
| 7.6 | Working in secure areas | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (data center secure areas) |
| 7.7 | Clear desk and clear screen | Yes | Yes | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md); [Acceptable Use](https://docs.botbrains.io/trust/policies/acceptable-use-policy.md) (idle lock, clean-screen practice) |
| 7.8 | Equipment siting and protection | Yes | Yes | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (devices in trusted locations; servers inherited) |
| 7.9 | Security of assets off-premises | Yes | Yes | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md); [Asset Management](https://docs.botbrains.io/trust/policies/asset-management-policy.md) (full-disk-encrypted laptops, device care) |
| 7.10 | Storage media | Yes | Yes | [Asset Management](https://docs.botbrains.io/trust/policies/asset-management-policy.md); [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md) (no removable media for production data) |
| 7.11 | Supporting utilities | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (data center power and cooling) |
| 7.12 | Cabling security | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (data center cabling) |
| 7.13 | Equipment maintenance | Yes | Inherited | [Physical Security](https://docs.botbrains.io/trust/policies/physical-security-policy.md) (cloud provider maintenance) |
| 7.14 | Secure disposal or re-use of equipment | Yes | Yes | [Asset Management](https://docs.botbrains.io/trust/policies/asset-management-policy.md) (laptop wipe with full-disk encryption; providers destroy server media) |

## A.8 Technological controls

| Annex A | Control | Applicable | Implemented | Policy |
| - | - | - | - | - |
| 8.1 | User endpoint devices | Yes | Yes, no MDM | [Acceptable Use](https://docs.botbrains.io/trust/policies/acceptable-use-policy.md) (full-disk encryption, MFA, updates) |
| 8.2 | Privileged access rights | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (minimal admin access with MFA) |
| 8.3 | Information access restriction | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (multi-tenant logical isolation) |
| 8.4 | Access to source code | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) (private GitHub, role-based, MFA) |
| 8.5 | Secure authentication | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md) (MFA everywhere; Clerk for the product) |
| 8.6 | Capacity management | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md) (CloudWatch and Better Stack monitoring) |
| 8.7 | Protection against malware | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md) (ClamAV on uploads, hardened servers) |
| 8.8 | Management of technical vulnerabilities | Yes | Yes | [Vulnerability Management](https://docs.botbrains.io/trust/policies/vulnerability-management-policy.md) (Dependabot, Wazuh) |
| 8.9 | Configuration management | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md); [Network Security](https://docs.botbrains.io/trust/policies/network-security-policy.md) (hardened, version-controlled infrastructure as code) |
| 8.10 | Information deletion | Yes | Yes | [Data Retention](https://docs.botbrains.io/trust/policies/data-retention-policy.md) (retention and secure deletion) |
| 8.11 | Data masking | Yes | Yes | [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md); [Data Protection](https://docs.botbrains.io/trust/policies/data-protection-policy.md) (tenant isolation, pseudonymization) |
| 8.12 | Data leakage prevention | Yes | Yes | [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md); [Acceptable Use](https://docs.botbrains.io/trust/policies/acceptable-use-policy.md) (access controls and acceptable use), external sharing warnings in Gmail/Calendar/Meets, Secure Communication Guidelines, DNS Malware filtering via 1.1.1.2, no network level warnings |
| 8.13 | Information backup | Yes | Yes | [Backup](https://docs.botbrains.io/trust/policies/backup-policy.md) (Point-in-Time Recovery with Write-Ahead Log, tested restore) |
| 8.14 | Redundancy of information processing facilities | Yes | Yes | [Business Continuity & DR](https://docs.botbrains.io/trust/policies/business-continuity-and-disaster-recovery.md) (hot standby, reproducible-from-code recovery, multi-provider model inference) |
| 8.15 | Logging | Yes | Yes | [Logging & Monitoring](https://docs.botbrains.io/trust/policies/logging-and-monitoring-policy.md) (centralized logs, Wazuh, Better Stack) |
| 8.16 | Monitoring activities | Yes | Yes | [Logging & Monitoring](https://docs.botbrains.io/trust/policies/logging-and-monitoring-policy.md) (Wazuh SIEM, Sentry alerting) |
| 8.17 | Clock synchronization | Yes | Yes | [Logging & Monitoring](https://docs.botbrains.io/trust/policies/logging-and-monitoring-policy.md); [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md) (synchronized to network time) |
| 8.18 | Use of privileged utility programs | Yes | Yes | [Access Control](https://docs.botbrains.io/trust/policies/access-control-policy.md); [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md) (restricted admin tooling) |
| 8.19 | Installation of software on operational systems | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md) (change management, hardened images) |
| 8.20 | Networks security | Yes | Yes | [Network Security](https://docs.botbrains.io/trust/policies/network-security-policy.md) (provider security groups, MFA, company VPN for production server access) |
| 8.21 | Security of network services | Yes | Yes | [Network Security](https://docs.botbrains.io/trust/policies/network-security-policy.md) (private-network isolation or TLS 1.3 for service-to-service) |
| 8.22 | Segregation of networks | Yes | Yes | [Network Security](https://docs.botbrains.io/trust/policies/network-security-policy.md) (environment and tenant segmentation) |
| 8.23 | Web filtering | Yes | No | [Network Security](https://docs.botbrains.io/trust/policies/network-security-policy.md) (spam and virus filtering) |
| 8.24 | Use of cryptography | Yes | Yes | [Cryptography](https://docs.botbrains.io/trust/policies/cryptography-policy.md) (AES-256, TLS 1.3 min 1.2, provider-managed keys) |
| 8.25 | Secure development life cycle | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) |
| 8.26 | Application security requirements | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) (security requirements per change) |
| 8.27 | Secure system architecture and engineering principles | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) (least privilege, defence in depth) |
| 8.28 | Secure coding | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md); [Employees Only: Secure Coding Standards](https://app.notion.com/p/391481da93cf81c4a39cf1ea90ed0079) (OWASP-aligned coding rules, automated checks, review gates) |
| 8.29 | Security testing in development and acceptance | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) (CI tests, dependency scanning) |
| 8.30 | Outsourced development | No | N/A | No outsourced development; all code written in-house |
| 8.31 | Separation of development, test and production environments | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md); [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) (separate local, staging, production) |
| 8.32 | Change management | Yes | Yes | [Operations Security](https://docs.botbrains.io/trust/policies/operations-security-policy.md); [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md) (CI/CD, staging) |
| 8.33 | Test information | Yes | Yes | [Secure Development](https://docs.botbrains.io/trust/policies/secure-development-policy.md); [Data Classification](https://docs.botbrains.io/trust/policies/data-classification-policy.md) (no production data in non-production; synthetic or anonymized) |
| 8.34 | Protection of information systems during audit testing | Yes | Yes | Read only auditer access, no customer data access, NDA for confidential data |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.