Security / Standards & Frameworks / Compliance Detail

Security · Compliance Detail

How entityOS meets each standard.

A standard-by-standard view of the platform mechanisms behind entityOS compliance — from the ISO 27001 information security management system and the staged closed-internet access model to KERI/ACDC identity, the Continuity engine, and Cardano anchoring.

ISMS Closed Internet SSI · KERI/ACDC Serverless AWS Continuity Engine

The Approach

Control by design, evidence by default.

Built into the platform

Controls are properties of the architecture — closed-internet access, per-connection identity, tenant isolation — not bolt-ons. Compliance follows from how the system is built.

Verifiable identity

KERI/ACDC self-sovereign identity makes actions attributable and records tamper-evident, so who did what — human or AI agent — can be demonstrated, not just asserted.

Continual improvement

The Continuity automation engine drives event-driven monitoring, logging, and review — the improvement loop every management-system standard requires.

Standard by Standard

The mechanisms behind each one.

For every standard entityOS aligns with, the specific platform capabilities that address its requirements.

Scope & status. This page describes how entityOS's architecture and operations address each standard's requirements. Formal compliance scope, any independent attestation, and current status are maintained in the compliance documentation at www.entityos.io/security/protect. Status labels below indicate a compliant management system, design alignment, or applied guidance.

ISO 27001
Information security management
Compliant

How entityOS meets it

  • A documented information security management system governs the platform, with risk assessment, risk treatment, and a Statement of Applicability mapped to the ISO 27001:2022 Annex A controls.
  • Access is enforced through the staged closed-internet model — Stage 1 IP allowlisting, Stage 2 mTLS + X.509 — backed by SSI credential-level trust.
  • Continual improvement runs through event logging and the Continuity engine; the current compliance scope is published at www.entityos.io/security/protect.
Evidence Statement of Applicability Director’s Statement Certificates
ISO 27002
Information security controls
Applied guidance

How entityOS meets it

  • Control implementation follows the ISO 27002:2022 themes — organisational, people, physical, and technological — with each selected control mapped to a concrete platform mechanism.
  • Technological controls are delivered by design: network allowlisting, per-connection mTLS, credential-based authentication, encryption, and event logging.
  • These control choices are recorded in the Statement of Applicability that supports the ISO 27001 ISMS.
ISO 27017
Cloud security
Design-aligned

How entityOS meets it

  • A documented shared-responsibility model covers the AWS-hosted, serverless architecture (Lambda + API Gateway), setting out what the provider, entityOS, and the customer each own.
  • Cloud-specific controls include tenant isolation, allowlisted S3 storage, per-connection identity via mTLS, and key management.
  • Aligned to the ISO 27017:2026 edition, which tracks the ISO 27002:2022 control set behind ISO 27001:2022.
ISO 27701
Privacy management
Design-aligned

How entityOS meets it

  • Personal information is handled under a privacy information management extension to the ISMS, defining controller/processor roles and data-subject rights.
  • KERI/ACDC self-sovereign identity supports data minimisation and holder-controlled, verifiable credentials — personal data is shared selectively rather than pooled.
  • The entity model gives individuals and organisations direct control over their own records.
ISO 22301
Business continuity
Design-aligned

How entityOS meets it

  • The Continuity pillar — an event-driven automation and workflow engine — underpins operational resilience and orchestrates recovery processes.
  • The serverless architecture (Lambda with managed scaling) reduces single points of failure; backups and recovery use allowlisted S3, with Cardano anchoring for tamper-evident records.
  • Business impact analysis and recovery objectives (RTO/RPO) are maintained alongside the ISMS.
ISO 42001
AI management
Design-aligned

How entityOS meets it

  • The AI pillar (agent integration) operates under an AI management approach that governs responsible development and use across the platform.
  • AI agents act only within the entityOS permission and identity model; every action is attributable through SSI, so agent activity is logged and accountable.
  • Human oversight, defined boundaries, and audit trails address the standard's core governance requirements.
ISO 9001
Quality management
Design-aligned

How entityOS meets it

  • Consistent delivery is built on an API-first platform of 700+ documented methods with versioned SDKs, so behaviour is predictable and repeatable.
  • Customer requirements are captured and tracked, and a continual-improvement loop feeds fixes and enhancements back into the platform.
  • Issues are surfaced through a structured responsible-disclosure channel and resolved on a defined lifecycle.
ISO 31000
Risk management
Applied principles

How entityOS meets it

  • ISO 31000 risk principles inform the ISMS risk assessment and the design of the staged, defence-in-depth security model.
  • Risk is viewed organisation-wide — across cloud, identity, and on-chain surfaces — rather than in isolated silos.
  • As guidance rather than a certifiable standard, it shapes how decisions are made, not a certificate.
SOC 2
Service-provider assurance
Criteria-mapped

How entityOS meets it

  • Platform controls are mapped to the Trust Services Criteria — security, with selected availability, confidentiality, and privacy criteria.
  • The same access, logging, and continuity mechanisms that support the ISMS provide the evidence base an independent examination draws on.
  • Report type and availability are confirmed in the compliance documentation at www.entityos.io/security/protect.
MappingView the SOC 2 mapping
NIST CSF
Cybersecurity risk management
Framework-mapped

How entityOS meets it

  • Platform capabilities are mapped across the six functions: Govern (the ISMS), Identify (risk assessment, asset inventory), and Protect (allowlisting, mTLS, SSI).
  • Detect is served by event logging and monitoring; Respond and Recover by the Continuity engine and the responsible-disclosure program.
  • Used as an outcome-based lens that complements the ISO control set rather than duplicating it.
MappingView the NIST CSF mapping
ASD Essential Eight
Practical cyberattack mitigation
Baseline-mapped

How entityOS meets it

  • As an Australian platform (ibCom), entityOS maps to the eight mitigations where they apply to a serverless service: multi-factor / strong authentication (SSI + mTLS) and restrict administrative privileges (allowlisting, least privilege).
  • Patch applications and operating systems are handled by managed AWS services; regular backups use allowlisted S3 with recovery tested via the Continuity engine.
  • Mitigations tied to desktop software (application control, macro settings, user-application hardening) are noted as not applicable to the serverless surface, and maturity is assessed against the ASD levels.
MappingView the Essential Eight mapping

Demonstrating It

Evidence, not assertion.

The same platform mechanisms that deliver the controls also produce the evidence that they work.

The management system

The ISO 27001 ISMS — policies, risk register, Statement of Applicability, and review records — is the backbone every other standard on this page relates back to.

Attributable actions

KERI/ACDC identity makes every action — by a person or an AI agent — attributable and verifiable, and Cardano anchoring keeps records tamper-evident.

Monitoring & response

The Continuity engine drives event-driven logging and automated response, while the responsible-disclosure program provides an external channel for surfacing issues.

Published compliance detail

Scope, compliance status, and supporting documentation are maintained at www.entityos.io/security/protect — the authoritative record for auditors and customers.

Take It Further

See the documented detail.

This page maps standards to mechanisms. The formal compliance record — scope, current status, and supporting evidence — is maintained alongside the platform for auditors, partners, and customers.

View Compliance Documentation Back to Standards