Frameworks & Standards
ISO/IEC 27001
ISO/IEC 27001 is an information security management system standard. It defines requirements for establishing, implementing, maintaining, and continually improving an ISMS.
Buyer question
"Can Legra help us evidence information-security controls over sensitive knowledge assets?"
Legra fit
| Assessment area | Legra fit | Status |
|---|---|---|
| Asset control | Workspaces, branches, catalogs, nodes, and metadata give assessors a queryable view of data assets. | Native fit |
| Access control | Workspace membership, roles, and access reviews provide evidence of who is authorized to use data. | Native fit |
| Cryptography | Workspace encryption helps protect confidential knowledge assets. | Native fit |
| Logging and monitoring | Events, activity monitoring, tasks, and commit history provide data-layer evidence. | Partial fit |
| ISMS process | Risk treatment, policies, audit process, personnel controls, supplier controls, and certification remain customer responsibilities. | External responsibility |
What Legra can say
Legra helps ISO/IEC 27001 programs by moving core data-control evidence into the data layer:
- Which assets exist and where they are hosted.
- Which identities have access.
- Which changes were made and by whom.
- Which validation rules protect the data.
- Which branches are production, staging, archived, or temporary.
- Which versions and changes were included in an assessment.
Assessment boundary
ISO/IEC 27001 certification applies to an organization's management system. Legra can support control implementation and evidence collection, but certification requires an audited ISMS.
For organizations pursuing ISO/IEC 27001 alignment or certification, Legra provides technical controls and queryable evidence over sensitive knowledge assets.