Iso27001

ISO 27001 Assessment

Assess ISO/IEC 27001:2022 Information Security Management System (ISMS) compliance for "$ARGUMENTS". Evaluate ISMS requirements (clauses 4-10), assess all 93 Annex A controls, and draft a Statement of Applicability.

Prerequisites

Read .metapowers/compliance/$ARGUMENTS/00-scope.md. If this file does not exist, tell the user:

Phase 0 (Scope) has not been completed for "$ARGUMENTS". Run /compliance:regulatory-landscape $ARGUMENTS first, or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check.

Process

1. Read context files:

   • Read plugins/compliance/shared/grc-lifecycle-guide.md for GRC methodology reference
   • Read plugins/compliance/shared/assessment-template.md for output structure
   • Read .metapowers/compliance/$ARGUMENTS/00-scope.md for scope and control framework context

2. ISMS requirements assessment (Clauses 4-10):

   • Clause 4: Context of the organization — assess understanding of internal/external issues, interested party requirements, ISMS scope definition
   • Clause 5: Leadership — assess management commitment, information security policy, roles and responsibilities
   • Clause 6: Planning — assess risk assessment methodology, risk treatment plan, information security objectives
   • Clause 7: Support — assess resources, competence, awareness, communication, documented information
   • Clause 8: Operation — assess operational planning, risk assessment execution, risk treatment implementation
   • Clause 9: Performance evaluation — assess monitoring, measurement, internal audit, management review
   • Clause 10: Improvement — assess nonconformity handling, corrective actions, continual improvement
   • Score each clause: Conforming / Minor nonconformity / Major nonconformity

3. Annex A controls assessment (93 controls, 4 themes):

   • Organizational controls (37 controls) — policies, roles, asset management, access control, supplier relationships, incident management, business continuity, compliance
   • People controls (8 controls) — screening, employment terms, awareness, disciplinary, termination, confidentiality, remote working, event reporting
   • Physical controls (14 controls) — physical perimeters, entry controls, securing offices, monitoring, utilities, cabling, equipment maintenance, storage media, clear desk
   • Technological controls (34 controls) — endpoint devices, privileged access, access restriction, source code, authentication, capacity, malware, vulnerabilities, logging, network security, web filtering, cryptography, SDLC, testing, change management, data masking, DLP, monitoring
   • Score each control: Implemented / Partially implemented / Not implemented / Not applicable

4. Statement of Applicability (SoA) draft:

   • For each of the 93 Annex A controls, document: applicability (yes/no), justification for inclusion/exclusion, implementation status, control description
   • Ensure all exclusions have documented justification

5. Risk treatment plan assessment:

   • Assess existing risk assessment methodology
   • Evaluate risk treatment decisions (accept, mitigate, transfer, avoid)
   • Check risk register completeness and currency
   • Assess residual risk acceptance process

6. Documentation requirements check:

   • Verify mandatory documented information exists (policies, procedures, records)
   • Assess document control processes (versioning, review, approval, distribution)
   • Identify missing or outdated documentation

7. Write the artifact to .metapowers/compliance/$ARGUMENTS/01-assess/iso27001.md following the assessment template structure with:

   • ISMS Clauses Assessment — Clauses 4-10 scoring with findings
   • Annex A Controls Assessment — all 93 controls scored by theme
   • Statement of Applicability Draft — full SoA with applicability and status
   • Risk Treatment Plan Review — methodology, register, residual risk
   • Documentation Gaps — missing or outdated mandatory documents
   • Overall Compliance Score — aggregate score with heatmap
   • Remediation Priorities — ranked list of gaps to address

Output

The ISO 27001 assessment written to .metapowers/compliance/$ARGUMENTS/01-assess/iso27001.md. Present a summary to the user highlighting:

• ISMS maturity level across clauses 4-10
• Annex A compliance percentage by theme
• Top 5 control gaps
• Certification readiness assessment (ready / needs work / significant gaps)