ISO 27001
Evidence on access and networks for your management system
ISO/IEC 27001 is an international standard for how an organisation manages information security. It is the organisation that is certified, not the products. XoT helps with several of the controls the standard lists.
The standard
The management system and the 93 controls
The current edition is from 2022. The standard has two parts.
The first part sets requirements for the management system itself. That covers risk assessment, management responsibility and internal audit. You meet those requirements in your own organisation. No product can do it for you.
The second part is called Annex A. It lists 93 controls in four themes: organisational, people, physical and technological. You choose which controls apply to you. You record the choice in a statement of applicability, often called the SoA.
Annex A
The controls XoT helps with
The table shows the Annex A controls that concern access, networks and logging. The last column shows whether XoT helps. The rows where XoT helps are highlighted in green.
| Control | Area | XoT |
|---|---|---|
| 5.15 | Access control | Yes |
| 5.16 | Identity management | Partly |
| 5.17 | Authentication information | Partly |
| 5.18 | Access rights | Yes |
| 5.19 | Information security in supplier relationships | Partly |
| 5.22 | Monitoring of supplier services | Partly |
| 5.28 | Collection of evidence | Partly |
| 6.7 | Remote working | Yes |
| 8.2 | Privileged access rights | Yes |
| 8.3 | Information access restriction | Yes |
| 8.5 | Secure authentication | Yes |
| 8.8 | Management of technical vulnerabilities | Partly |
| 8.15 | Logging | Yes |
| 8.16 | Monitoring activities | Partly |
| 8.20 | Networks security | Yes |
| 8.22 | Segregation of networks | Yes |
| 8.24 | Use of cryptography | Partly |
For nine of the controls, XoT provides the technical part. For eight, XoT contributes, but you also need your own procedures or other tools.
Control by control
How XoT helps
Access – 5.15, 5.18 and 8.3
Everything is denied by default. A policy decides who may connect, to which equipment, from where and when. Access can be limited in time and revoked immediately. The Policy Graph shows who can reach what.
Identity and authentication – 5.16, 5.17 and 8.5
Every person and every device has its own certificate. Users sign in through your directory, such as Entra ID. The key can be stored in the computer's TPM, on a smart card or on a hardware key. The user and the Lock check each other twice a minute. You manage the people in your directory as usual.
Privileged access – 8.2
Access can be temporary and can require approval by an administrator. Administrators in the XMS can be limited to one site or one customer.
Suppliers – 5.19 and 5.22
A vendor only reaches their own machine, for as long as the policy applies. Every connection is logged, and browser sessions are recorded. The agreements with your suppliers are your responsibility. That is control 5.20.
We are also a supplier to you. Our description of how we work with quality, a software bill of materials (SBOM) and penetration test reports are available on request. You can use them when you assess us.
Networks – 8.20 and 8.22
The Lock sits in front of the equipment and only lets through traffic that a policy allows. One Lock can segment a subnet without new addresses or new VLANs. No inbound ports need to be opened towards the Lock.
Logging and monitoring – 5.28, 8.15 and 8.16
The XMS keeps two logs. The event log shows who connected, to which equipment and through which policy. The audit log shows every change to policies and access rights, and it is protected against later changes. XoT-WebAccess sessions are recorded automatically.
You set how long logs are kept. The logs can be sent to your SIEM, for example Splunk, IBM QRadar or Wazuh. The Lock can also send a copy of the traffic to intrusion detection systems. Reviewing the logs is your responsibility.
Technical vulnerabilities – 8.8
Much OT equipment cannot be updated. The Lock makes such equipment invisible to anyone without authorisation. It is a compensating control. It does not replace your procedures for updating what can be updated.
Cryptography – 8.24
Traffic is encrypted with WireGuard. Management runs over an encrypted channel with certificates on both sides. The certificates come from the XMS's built-in certificate authority or from your own. You write your own cryptography policy.
Limits
What remains your responsibility
XoT is part of the technical protection. Much of ISO 27001 is about work in the organisation. XoT does not help with:
- the management system, with risk assessment, objectives, internal audit and management review
- physical security and people security
- protection against malware, and backups
- agreements with suppliers
- procedures for incidents and for keeping the business running during disruptions
Common questions
Is XoT certified to ISO 27001?
No. ISO 27001 certifies an organisation's management system, not a product. XoT provides evidence for several Annex A controls.
What can we show the auditor?
You can show the policies in the XMS, a Policy Graph view of who can reach what, the connection log and the audit log of changes. That shows that access is controlled and followed up.
Does ISO 27001 work together with IEC 62443?
Yes. Many industrial companies use ISO 27001 for the whole organisation and IEC 62443 for the control systems. The Lock fits into both.
This is our interpretation of the standard. It is not a certification.
Ask for material for your SoA
We are happy to describe how XoT contributes to the controls you have chosen.