FrameworkUse cases01 · ISO/IEC 27001

Use case 01 · ISO/IEC 27001 + 27017

Every control, observed every day.

An auditor used to visit once a year, test a sample and leave. Here the selfdriven.observer framework runs with the ISO/IEC 27001 profile loaded. Octonomous systems watch every control in your information security management system. Human observers hold the judgement and sign what matters.

Start with your SoA What the auditor did
ISO/IEC 27001:2022ISO/IEC 27017KERI · ACDC
Observation logexample feed · profile iso27001:2022 + 27017
Observing
    Population observed 100% 0 in view awaiting human sign-off
    93

    Annex A controls in ISO/IEC 27001:2022, each with a named observer

    8

    octonomous observers, one for each selfdriven Area of Focus

    365/yr

    days observed, against four audit visits in a three-year cycle

    1

    human signature on every finding before it reaches the record

    What the human auditor used to do

    An audit is a visit. Between visits, the evidence waits in a folder.

    An ISO/IEC 27001 certificate runs on a three-year cycle: a two-stage certification audit, two surveillance audits, then recertification. Each visit lasts days and tests a sample. selfdriven.observer keeps the same questions open all year, across the whole population.

    The auditor didselfdriven.observer doesPerformed by
    Stage 1 reviewRead the policies and the Statement of Applicability.
    Keeps every policy and SoA version as a signed record, and flags drift on the day it happens.
    Octonomous
    SamplingTested a sample, such as 25 of 400 access reviews.
    Observes all 400, every time one of them changes.
    Octonomous
    InterviewsInterviewed staff and walked the floor.
    Briefs the human observer with what the record shows, so the conversation starts from evidence.
    Human
    FindingsGraded findings as major or minor nonconformities.
    Raises each finding with its evidence attached. A human observer confirms the grade.
    Both
    SurveillanceCame back twelve months later.
    Keeps observing. The surveillance audit reviews the record instead of rebuilding it.
    Both
    ReportWrote the audit report.
    Produces a verifiable evidence package for any date range, signed by observer and reviewer.
    Both

    The eight observers, with the 27001 profile loaded

    Every Annex A control has an observer.

    The framework's eight octonomous observers stay the same for every standard. Loading the ISO/IEC 27001 profile gives each one its clauses and Annex A controls. Human observers review what they find, using the framework's human tools.

    For the ISMS team

    • Statement of Applicability, liveEach applicable control with its observer, criterion and current state. Exclusions keep their justification.
    • Management review packClause 9.3 inputs assembled from the record: results, nonconformities, changes and risks.
    • Corrective actionEach confirmed nonconformity opens a corrective action under clause 10.2, observed until it closes.

    For the certification body

    • Auditor accessA scoped, time-limited credential to read the record for the audit window.
    • Whole-population resultsEach control's results across every item, with the auditor free to pick their own sample to re-test.
    • Interview briefsThe record's open questions, ready for the interviews and walkthroughs that stay human.

    The profile

    ISO/IEC 27001, extended by ISO/IEC 27017.

    The management system comes from 27001. The cloud-specific controls and guidance come from 27017. Both load into the framework as one profile.

    ISO/IEC 27001

    2022 edition · ISMS requirements

    Clauses 4 to 10 define the management system. Annex A lists 93 controls in four themes.

    • Organisational A.537
    • People A.68
    • Physical A.714
    • Technological A.834
    • 4Context of the organisation
    • 5Leadership
    • 6Planning
    • 7Support
    • 8Operation
    • 9Performance evaluation 9.1 · 9.2 · 9.3continuous
    • 10Improvement 10.2continuous

    ISO/IEC 27017

    cloud services · based on 27002

    Controls and guidance for cloud service customers and providers. Observers read these from your cloud accounts directly.

    • Shared roles and responsibilitiesWho owns each control between customer, provider and partners
    • Segregation in virtual computing environmentsTenant isolation, network boundaries, peering exceptions
    • Virtual machine hardening and administrator securityBaselines, privileged operations, break-glass use
    • Monitoring of cloud servicesLog coverage and alerting across every account and region
    • Removal of customer assetsEvidence of return and deletion when a service ends
    • Unauthorised use of cloud servicesAccounts and services running outside the ISMS scope

    The 2026 edition realigns cloud controls to ISO/IEC 27002:2022 and replaces the 2015 edition. Observers map to whichever edition your certificate references.

    From observation to evidence

    Every observation arrives signed.

    An auditor used to take a screenshot on trust. Here each result carries who observed it, what was tested, how much was seen and which human reviewed it, in a form anyone can verify.

    1. Observe

      The observer reads configuration, logs and records from source systems such as AWS CloudTrail, AWS Config and IAM, your identity provider and your ticketing system.

    2. Evaluate

      The result is tested against the control's criterion and graded: conforming, opportunity for improvement, or nonconformity.

    3. Sign

      The observer signs the observation and anchors its digest in its key event log with an ixn event.

    4. Review

      A human observer confirms or regrades the finding and signs with a passkey. A nonconformity opens corrective action under clause 10.2.

    5. Present

      Auditors and management read the record for any window: a surveillance period, a management review or the week of an incident.

    observation record · exampleACDC
    {
  "observation": "obs_7Q2M-0419",
  "profile": "iso27001:2022",
  "requirement": "A.8.13",
  "title": "Information backup",
  "criterion": "Restore tested within 90 days",
  "result": "opportunity-for-improvement",
  "population": { "observed": 412, "of": 412 },
  "detail": "3 volumes last restored 97 days ago",
  "observer": {
    "kind": "octonomous",
    "area": "05 Sustainability",
    "aid": "EJx9pT…r4Qa",
    "delegator": "EKE4g_…kqt"
  },
  "keriEvent": {
    "type": "ixn",
    "sn": 18342,
    "digest": "sha256:9f1c…e07a"
  },
  "review": {
    "by": "human observer",
    "signedWith": "passkey",
    "decision": "confirmed"
  }
}

    Assurance

    The auditor still certifies.

    Certification stays with an accredited certification body working under ISO/IEC 27006-1. What changes is what they walk into: a continuous, signed record in place of a folder of screenshots gathered the week before.

    Verify without trusting us

    Observations are ACDC credentials chained to the control, the observer and the reviewer. An auditor checks the signatures against the key event logs, not against our word.

    Authority traces to a person

    Every observer AID is delegated from a human conductor's AID with a dip event. If an observer misbehaves, its conductor revokes it and the record shows when.

    Auditors read, scoped and dated

    Auditor access is a credential for a defined audit window. It opens the record for that period and expires on its own.

    ISO/IEC 27006-1 · certification bodiesISO/IEC 27007 · ISMS auditingISO 19011 · management system auditing

    Start observing

    Start with your Statement
    of Applicability.