WisecThe auditor will ask for evidence. Keep the evidence of every build.
For your Annex A controls that concern development, what do you show the auditor?
ISO/IEC 27001:2022 certifies how effective a management system is. For the Annex A controls about the software chain, Wisec records and signs with every build the evidence an auditor can consult.
Records, over time.
What you decided.
Your statement of applicability says which controls apply and how.
What happened.
The auditor samples dated evidence: that is where a CI's traces get lost.
What it achieved.
Indicators followed over time, not a snapshot taken on audit day.
The Annex A controls, and their evidence.
The ISO 27001 report maps these controls to the evidence recorded over the period, and adds the posture figure and the signed monthly records.
| Reference | What is expected | The evidence Wisec produces |
|---|---|---|
| A.8.8 | Management of technical vulnerabilities. | CVEs detected on every build, decisions in a signed VEX, the share fixed within your deadlines. |
| A.5.21 | Managing information security in the ICT supply chain. | A signed SBOM per build, SLSA provenance, detection of suspicious dependencies. |
| A.8.25 | Secure development life cycle. | Scanners built into the pipeline, policies enforced by the gate. |
| A.8.32 | Change management. | Every build notarised and chained to the previous one, with its commit, its author and the approved contributors list. |
| A.5.28 | Collection of evidence. | Signed evidence, anchored on IPFS, kept three years in storage that cannot be altered and timestamped in Rekor. |
An evidence mapping, not a declaration of conformity. Wisec replaces neither your management system, nor your risk assessment, nor your statement of applicability, and it issues no certification: only an accredited body does. It provides evidence for a few Annex A controls.
A PDF to hand over, with its scope.
Covered, partial, to address.
Computed from the share of the period's builds that carry the evidence: at least 90 %, at least 50 %, or less.
Printed on the report.
Every project by default, or those you pick. A report without a stated scope is not usable in an audit.
Your dates.
The report covers the period you choose, and states when it was produced.
Available on the Business and Pro plans. The ISO 27001 report is generated from the Compliance page, with the posture of the period.
Reference: ISO/IEC 27001:2022, Annex A. Control titles are summarised; only the standard is authoritative.