ISO 27001

ISO/IEC 27001 sets out requirements for an information security management system, and its Annex A lists reference controls. Pentr's YAML declares it as name ISO/IEC 27001:2022, version 2022, and its controls are Annex A controls.

Controls¶

The Annex A controls the YAML declares, and the tables that reach each one. The Reached by column is explained on Frameworks.

Control	Name	Reached by
A.5.15	Access Control	ATT&CK, WSTG, keywords
A.5.17	Authentication Information	ATT&CK, WSTG, keywords
A.8.5	Secure Authentication	ATT&CK, WSTG, keywords
A.8.6	Capacity Management	none
A.8.7	Protection Against Malware	ATT&CK, WSTG, keywords
A.8.8	Management of Technical Vulnerabilities	ATT&CK, keywords
A.8.9	Configuration Management	WSTG, keywords
A.8.20	Networks Security	ATT&CK, keywords
A.8.21	Security of Network Services	keywords
A.8.24	Use of Cryptography	ATT&CK, WSTG, keywords
A.8.25	Secure Development Life Cycle	ATT&CK, WSTG, keywords
A.8.26	Application Security Requirements	ATT&CK, WSTG, keywords

A.8.6 reads none: no table lists it, so it is reported not_tested on every run.

A.8.21 is reached through the keyword table alone. It is tested only by a finding whose ATT&CK and WSTG ids matched no row, and it never appears among the control ids in a sealed manifest.

ATT&CK technique mappings¶

Each ATT&CK technique id in the framework's table and the controls it maps to. A finding tagged with one of these ids maps to every control in its row.

Technique	Controls
T1190	A.8.25, A.8.26, A.8.8
T1078	A.5.17, A.8.5
T1059	A.8.7, A.8.25
T1068	A.5.15, A.8.8
T1110	A.5.17, A.8.5
T1003	A.5.17, A.8.24
T1046	A.8.20, A.5.15
T1018	A.8.20
T1021	A.5.15, A.8.20
T1083	A.5.15

WSTG mappings¶

Each WSTG id in the framework's table and the controls it maps to. A finding tagged with one of these ids maps to every control in its row.

WSTG id	Controls
WSTG-INPV-05	A.8.7, A.8.25
WSTG-INPV-01	A.8.7, A.8.25
WSTG-INPV-02	A.8.7, A.8.25
WSTG-ATHN-04	A.5.17, A.8.5
WSTG-ATHN-01	A.8.5, A.8.24
WSTG-IDNT-04	A.5.17
WSTG-CRYP-01	A.8.24
WSTG-CONF-01	A.8.9
WSTG-CONF-02	A.8.9
WSTG-ATHZ-01	A.5.15
WSTG-SESS-02	A.8.5
WSTG-ERRH-01	A.8.26

What Pentr does not attest to¶

• tested means at least one finding mapped to the control. It does not mean the control was assessed, met or failed. A mapping made by the keyword step can attach a control the finding does not bear on; see Frameworks.
• not_tested means no finding mapped to the control. It does not mean the control passed, and it says nothing about whether the control is in place.
• The mapping tables are Pentr's, written for the application. They are not published by ISO or IEC.
• An Annex A control that the YAML does not declare has no row in the report.
• Certification under ISO/IEC 27001 covers the management system. Pentr tests systems and maps findings to controls; it does not assess a management system.
• A Pentr report is not an ISO/IEC 27001 certificate and not an audit opinion.

The product page for this framework is ISO 27001.