Mappings to ISO 27001:2022

[cristiklein]

ISO 27001:2022 didn't just add controls, but they came up with completely new controls. It can be seen as a backwards-incompatible change of ISO 27001. Let's map it.

Prerequisites

The following acceptance criteria assumes knowledge with the following concepts and tools:

• https://en.wikipedia.org/wiki/ISO/IEC_27001
• https://en.wikipedia.org/wiki/Security_controls
• mkdocs-ciso-controls plugin
• Table of ISO 27001:2022 Annex A controls

Acceptance criteria

• There is a page at https://elastisys.io/compliantkubernetes/ciso-guide/controls/iso-27001-2022/, which is similar to the ISO 27001:2013 one.
• Said page maps all applicable (as determined by the author) ISO 27001:2022 controls to Compliant Kubernetes features using the mkdocs-ciso-plugin. The tag prefix should be ISO 27001:2022.
• Controls which are not applicable to Compliant Kubernetes are listed in a table at the end, which includes "justification for exclusion", similar to this page. For example, Compliant Kubernetes does not provide any story to A 6.4 Disciplinary Process. Please look at each control and write a good justification for exclusion along the lines of "This control requires a disciplinary process, which is outside the scope of Compliant Kubernetes." Please group controls which have a similar justification for exclusion.
• The page was approved by our CISO (@HansOlofEdblom), Field CTO (@llarsson), Security Engineering (@OlleLarsson) and PO (@cristiklein).

Additional context

Ask @cristiklein , @HansOlofEdblom or @OlleLarsson

Downstream tasks

• https://github.com/elastisys/ck8s-issue-tracker/issues/326

[OlleLarsson]

Would be good to have been done before the iso re-audit. "Before may"

[cristiklein]

The German TSO's information security policy is based on ISO 27001:2022. Also, we passed our ISO 27001:2022 recertification and no finding was related to the documentation of Compliant Kubernetes. Hence, the current value of "4" is correct.

[Ajarmar]

@cristiklein @lucianvlad @OlleLarsson Please update this roadmap item with acceptance criteria. Thanks!

[cristiklein]

@elastisys/product-team I updated the acceptance criteria. PTAL.