The first time a customer sends a security review, the instinct is to treat it as an obstacle. It is more useful to treat it as a specification written by someone who has already lived through the failure.
This piece walks through how we think about it at Paycux, what we have changed our minds about, and where the sharp edges are.
What ISO is, and what "ISO compliance" actually means
What ISO is, and what "ISO compliance" actually means deserves its own treatment. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
The ISO 27000 family
The ISO 27000 family is where this gets concrete. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
- Keep audit events append-only and separate from user records
- Describe each control in one sentence before automating it
- Produce evidence automatically, not by hand
- Decide retention per data category, in writing
ISO 27001 in detail
Consider iso 27001 in detail. Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
The ISMS
The ISMS deserves its own treatment. Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Evidence is the deliverable.
What achieving compliance involves
Consider what achieving compliance involves. Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
How long it takes
That brings us to how long it takes. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Why software companies pursue ISO 27001
Consider why software companies pursue iso 27001. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Where this leaves us
The pattern repeats across every system we have looked at: the hard part is not the mechanism, it is keeping the mechanism honest as the surrounding assumptions change.
If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API.