ISO/IEC 27001:2013
Deprecated
Best for: Organizations previously certified to ISO/IEC 27001:2013 that have not yet transitioned to the 2022 revision. This version applied to any organization, regardless of size or industry, seeking internationally recognized ISMS certification. B2B SaaS vendors, financial services firms, healthcare technology companies, and government contractors commonly pursued it because customers and regulators required the certificate.
| Mandatory? | Voluntary — demanded by B2B contracts |
|---|---|
| Who validates? | Accredited certification body (IAF member). No self-assessment. |
| Renewal | 3-year cert; annual surveillance |
| Observation period | Surveillance: years 1 and 2 |
| Governing body | International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC). Certification audits are conducted by accredited certification bodies (e.g., BSI, Schellman, A-LIGN) under national accreditation body oversight., ISO/IEC 27001:2013 (superseded by 2022). Official source |
Get started
Point the module source at the ISO/IEC 27001:2013 endpoint and pin a version range you reviewed:
module "..." {
source = "iso270012013.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}iso270012013.compliance.tf lists every ISO/IEC 27001:2013 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Encryption in Transit | Checks TLS configuration on CloudFront distributions and ELB listeners: HTTPS enforcement, cipher suite selection, recommended security policies, and minimum protocol versions. | Defining an organizational cryptographic policy per A.10.1.1, selecting approved cipher suites, managing TLS certificate lifecycle, and documenting encryption decisions in the Statement of Applicability. |
| Audit Logging and Monitoring | Covers the CloudTrail deployment pattern: multi-region enablement for read and write events, S3 bucket access logging on trail buckets, CloudWatch Logs integration, alarm action configuration, and AWS Config recorder status across all regions. | Log retention periods per A.12.4.1 are your call. You also need to establish incident response procedures triggered by alarms, schedule periodic log reviews, and protect log integrity through immutability controls or a dedicated logging account. |
| Access Control and Least Privilege | Checks five configurations: IAM password policy minimum length, root user usage in ECS task definitions, public accessibility of EBS snapshots and EC2 AMIs, and public access settings on CloudTrail S3 buckets. | Implementing a full access control policy per A.9.1.1, conducting periodic user access reviews per A.9.2.5, managing privileged access provisioning workflows, and enforcing MFA across all accounts. |
| Vulnerability Management | Checks that ECR image scanning on push is enabled. This confirms container images are assessed for known vulnerabilities before deployment reaches production. | Define remediation SLAs, assign triage ownership, and track findings to closure. Extend vulnerability scanning beyond containers to EC2 instances, Lambda functions, and third-party dependencies. |
| Availability and Continuity | Confirms DynamoDB auto scaling is enabled, so database capacity adjusts to demand without manual intervention. | The DynamoDB check is one data point. Full A.17.1 compliance requires tested BCP and DR plans, documented RTO/RPO targets, evidence of regular failover exercises, and multi-AZ or multi-region redundancy for all critical workloads. |
Controls by category
18 of 34 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 16 are Mapped only: ISO/IEC 27001:2013 lists them, no compliance.tf module checks them.
A.10 Cryptography
Auditors verify that a cryptographic policy exists per A.10.1.1 and that encryption in transit uses current, approved protocols and cipher suites. Common findings include outdated TLS versions (1.0, 1.1) still enabled on load balancers and missing HTTPS enforcement on CDN distributions. Evidence includes TLS configuration exports, security policy settings, and documented rationale for cipher suite selection.
A.12.4 Logging and Monitoring
A.12.4.1 requires event logging and A.12.4.2 requires protection of log information. Auditors expect multi-region CloudTrail coverage with logs forwarded to a centralized monitoring system. They check that logging infrastructure itself is monitored for failures and that alarms trigger actionable responses. A gap auditors frequently flag: CloudTrail enabled but not integrated with alerting, making logs reactive rather than detective.
A.12.6 Technical Vulnerability Management
Container image scanning is the primary evidence point for A.12.6.1 conformity. Beyond confirming scan-on-push is enabled, auditors will ask to see documented SLAs for critical CVE remediation and evidence that findings are tracked to closure, not just acknowledged.
| Control | Status |
|---|---|
| ECR repositories should have image scan on push enabled | Enforced |
A.9 Access Control
A.9.4.3 covers password management systems, A.9.2.3 addresses privileged access management, and A.9.1.2 requires controlled access to networks and services. Auditors look for enforced password complexity, least privilege in container task definitions (no root), and prevention of unintended public exposure of snapshots, AMIs, and log buckets. Public access to any of these resources is treated as a significant nonconformity.
| Control | Status |
|---|---|
| IAM password policies should have minimum length set to 14 or greater | Mapped |
Additional controls (25)
AWS IAM (8)
Amazon CloudFront (1)
| Control | Status |
|---|---|
| CloudFront distributions should use the recommended TLS security policy | Enforced |
Amazon RDS (4)
Amazon Redshift (3)
Amazon S3 (3)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SageMaker (1)
| Control | Status |
|---|---|
| SageMaker notebook instances root access should be disabled | Mapped |
Amazon VPC (4)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST SP 800-171 Rev 2 | High 87% | |
| PCI DSS v4.0 | High 86% | |
| ISO/IEC 27001:2022 | High 85% |
Frequently asked questions
Is ISO 27001:2013 certification still valid?
Certification bodies stopped issuing new ISO 27001:2013 certificates when the 2022 revision published. Existing 2013 certificates expire on October 31, 2025. After that date, only ISO 27001:2022 certifications are recognized, so if your current certificate runs to or past that date, you must complete the transition at your next surveillance or recertification audit.
How long does the transition from 2013 to 2022 take?
Plan for 3 to 6 months. The main work involves updating the Statement of Applicability to reflect the restructured 93 controls, performing a gap assessment against the 11 new controls in the 2022 Annex A, and revising risk treatment plans. The transition audit typically adds 1 to 2 days to a standard surveillance or recertification audit.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 specifies requirements for an ISMS and is the certifiable standard. ISO 27002 is implementation guidance for the controls listed in Annex A. You cannot be certified to ISO 27002. Auditors assess conformity against ISO 27001 requirements but reference ISO 27002 to understand expected implementation depth for individual controls.
How do the controls mapped here relate to the full 114 controls in Annex A?
The mapped controls cover AWS infrastructure checks that align with specific Annex A requirements, primarily in A.9 (Access Control), A.10 (Cryptography), A.12 (Operations Security), and A.17 (Business Continuity). Annex A domains like A.5 (Information Security Policies), A.6 (Organization of Information Security), A.7 (Human Resource Security), and A.8 (Asset Management) require procedural and organizational evidence that automated cloud controls cannot address.
Can I use compliance.tf benchmark results as audit evidence?
Yes. PowerPipe benchmark outputs showing control pass/fail status, timestamps, and resource-level detail are accepted by most certification bodies as technical evidence. Export results before each surveillance audit. Auditors will still require complementary evidence: policies, risk assessments, management review minutes, and corrective action records.