Statement of Applicability
entityOS management attests to the applicability and implementation of every Annex A control of ISO/IEC 27001:2022, and the cloud-specific controls of ISO/IEC 27017:2026, for the confidentiality, integrity and availability of customer data on the entityOS cloud service.
This Statement of Applicability records, for each control, whether it applies to entityOS and how it is implemented — as required by ISO/IEC 27001:2022, clause 6.1.3(d).
The ISMS requirements standard. Annex A lists the reference controls this SOA responds to.
The control set behind Annex A — 93 controls across four themes: organisational, people, physical and technological.
Cloud services controls, rebased on ISO/IEC 27002:2022, adding four standalone cloud-specific controls.
entityOS management attests that the following controls are in place in regard to the risks relating to the confidentiality, integrity and availability of customer data stored on the entityOS cloud service using isolated / dedicated services.
Two measures are central to how we control risk: the automation of the platform using machines and the minimal use of humans in delivering the service; and, after 25+ years of development, making no functional changes to the platform — so no new internally-created risks are introduced. The only changes are security-maintenance measures against externally-created risks, shared with Amazon Web Services.
37 controls — governance, policy, people-facing process, supplier and cloud, incident and compliance.
| # | Control | Applicability | How entityOS applies it |
|---|---|---|---|
| 5.1 | Policies for information security | Applicable | Information security and topic-specific policies are defined by the CRO, form part of the employment contract, and are reviewed and re-distributed on a regular cycle. |
| 5.2 | Information security roles and responsibilities | Applicable | The Chief Risk Officer (CRO) owns and allocates all information-security roles, and communicates them to customers, service providers and suppliers as required. |
| 5.3 | Segregation of duties | Applicable | Only operational personnel can access data; conflicting duties are segregated by role under the CRO. |
| 5.4 | Management responsibilities | Applicable | Management requires all personnel to apply information security in line with policy — it is a core value and a condition of employment. |
| 5.5 | Contact with authorities | Applicable | The CRO maintains contact with relevant authorities and informs customers of the geographic location of their data. |
| 5.6 | Contact with special interest groups | Applicable | The CRO maintains contact with specialist security forums and subscribes to daily threat-intelligence feeds. |
| 5.7 | Threat intelligence | Applicable | Threat intelligence is drawn from daily security feeds, AWS advisories and the real-time testing service, and feeds patching and WAF control-set updates. |
| 5.8 | Information security in project management | Applicable | Any project that could change the platform treats information security as a first-class concern from design onward. |
| 5.9 | Inventory of information and other associated assets | Applicable | Core customer-data assets (including derived data) are managed contractually within AWS; assets used to access operations are registered and owned. |
| 5.10 | Acceptable use of information and other associated assets | Applicable | Acceptable-use rules link each asset to the employee's role and are documented. |
| 5.11 | Return of assets | Applicable | On role change or termination, assets revert immediately to the direct responsibility of the CRO. |
| 5.12 | Classification of information | Applicable | Customer data is classified and handled on a strict need-to-know basis; the model delivers only encoded data to the UI layer. |
| 5.13 | Labelling of information | Applicable | Information is labelled per handling procedures; tenancy context is enforced by the data-store. |
| 5.14 | Information transfer | Applicable | All transfer is over HTTPS (2048/256 SSL with perfect forward secrecy); no customer data is stored at remote-working sites. |
| 5.15 | Access control | Applicable | Access is least-privilege and role-based; each of the 700+ platform methods can be functionally controlled, with optional IP allowlisting and MFA. |
| 5.16 | Identity management | Applicable | The identity life cycle is managed; being employed by ibCom does not by itself grant access to customer data. |
| 5.17 | Authentication information | Applicable | Authentication information is managed by process; TOTP/MFA is available on all user access. |
| 5.18 | Access rights | Applicable | Access rights are provisioned, reviewed and removed under the CRO, with periodic access reviews. |
| 5.19 | Information security in supplier relationships | Applicable | Supplier risk is managed; the principal supplier is AWS, whose certifications are relied upon and monitored. |
| 5.20 | Addressing information security within supplier agreements | Applicable | Security requirements are established in agreements; AWS obligations are covered contractually. |
| 5.21 | Managing information security in the ICT supply chain | Applicable | ICT supply-chain risk is minimised by a fixed, in-house kernel on AWS with few third-party components. |
| 5.22 | Monitoring, review and change management of supplier services | Applicable | AWS service changes and security practices are monitored and reviewed. |
| 5.23 | Information security for use of cloud services | Applicable | As both a CSP and a CSC of AWS, entityOS has defined processes for acquisition, use, management and exit of the cloud services it consumes and provides. |
| 5.24 | Information security incident management planning and preparation | Applicable | An incident-management process is defined, including roles, responsibilities and customer-notification obligations. |
| 5.25 | Assessment and decision on information security events | Applicable | Events from the real-time testing service and monitoring are assessed and categorised. |
| 5.26 | Response to information security incidents | Applicable | Incidents are handled per documented procedures; reported issues are fixed within 24 hours (maximum). |
| 5.27 | Learning from information security incidents | Applicable | Lessons feed the plan-do-check-act cycle and the automated testing service. |
| 5.28 | Collection of evidence | Applicable | Logging and the testing service preserve evidence; procedures cover its identification and preservation. |
| 5.29 | Information security during disruption | Applicable | A real-time duplicate runs in warm mode so security is maintained during disruption. |
| 5.30 | ICT readiness for business continuity | Applicable | ICT continuity is planned, maintained and tested: real-time data-store duplication, warm standby, and daily test-restores via AWS RDS against defined RTO/RPO. |
| 5.31 | Legal, statutory, regulatory and contractual requirements | Applicable | Legal, regulatory and contractual requirements (incl. the Australian Privacy Act and data location) are identified and kept current by the CRO. |
| 5.32 | Intellectual property rights | Applicable | IP rights are respected; customer data and derived data remain the customer's property and are never shared. |
| 5.33 | Protection of records | Applicable | Records are protected from loss, falsification and unauthorised access or release. |
| 5.34 | Privacy and protection of PII | Applicable | Privacy and PII obligations are identified and met per applicable law; data is encrypted at rest and isolated per tenant. |
| 5.35 | Independent review of information security | Applicable | Information security is reviewed independently through external ISO 27001/17 audit and surveillance. |
| 5.36 | Compliance with policies, rules and standards for information security | Applicable | Compliance is reviewed regularly under the plan-do-check-act ISMS. |
| 5.37 | Documented operating procedures | Applicable | Procedures for critical operations (virtual-resource changes, key management, backup/restore, service termination) are documented. |
8 controls — the human layer, where entityOS applies its “least number of humans” principle.
| # | Control | Applicability | How entityOS applies it |
|---|---|---|---|
| 6.1 | Screening | Applicable | Personnel with data access must have at least one year with ibCom or an equivalent proven provider; the first control is using very few such people. |
| 6.2 | Terms and conditions of employment | Applicable | Information security is at the heart of the employment contract, including post-employment obligations. |
| 6.3 | Information security awareness, education and training | Applicable | All personnel are tertiary-qualified with extensive experience and are continually trained in protecting customer data, including derived data. |
| 6.4 | Disciplinary process | Applicable | Any information-security breach by an employee results in immediate termination. |
| 6.5 | Responsibilities after termination or change of employment | Applicable | Access is revoked immediately and post-employment obligations are re-communicated. |
| 6.6 | Confidentiality or non-disclosure agreements | Applicable | All personnel are bound by confidentiality / non-disclosure agreements. |
| 6.7 | Remote working | Applicable | Work is remote by design; no customer data is stored at remote sites, and AWS access requires MFA and/or IP restriction. |
| 6.8 | Information security event reporting | Applicable | Personnel and the public can report events (including via the reward program); the testing service raises real-time alerts. |
14 controls — largely inherited from AWS data centres under the shared-responsibility model.
| # | Control | Applicability | How entityOS applies it |
|---|---|---|---|
| 7.1 | Physical security perimeters | Applicable | Delivered by AWS data centres (Sydney by default) under their certified physical-security programme. |
| 7.2 | Physical entry | Applicable | AWS data-centre entry controls apply; ibCom personnel do not physically access infrastructure. |
| 7.3 | Securing offices, rooms and facilities | Applicable | No customer data is held in ibCom offices; facilities used to access operations are controlled. |
| 7.4 | Physical security monitoring | Applicable | Continuous physical monitoring is provided by AWS data centres. |
| 7.5 | Protecting against physical and environmental threats | Applicable | AWS environmental protections (power, fire, flood and similar) apply. |
| 7.6 | Working in secure areas | Applicable | AWS-controlled; the least-humans model means no ibCom physical presence in the infrastructure. |
| 7.7 | Clear desk and clear screen | Applicable | Enforced for operations personnel; no local storage of customer data. |
| 7.8 | Equipment siting and protection | Applicable | Infrastructure is sited and protected by AWS; operations endpoints are hardened. |
| 7.9 | Security of assets off-premises | Applicable | Operations endpoints are hardened and MFA/IP-restricted; no customer data is stored off-premises. |
| 7.10 | Storage media | Applicable | Media life cycle is handled by AWS; no removable media holds customer data. |
| 7.11 | Supporting utilities | Applicable | Power and utility resilience are provided by AWS. |
| 7.12 | Cabling security | Applicable | Provided within AWS data centres. |
| 7.13 | Equipment maintenance | Applicable | Infrastructure maintenance is performed by AWS; operations endpoints are maintained and patched. |
| 7.14 | Secure disposal or re-use of equipment | Applicable | Secure disposal is handled by AWS; customer data can be cryptographically cleansed by the owner via the API. |
34 controls — the technical core: access, cryptography, logging, testing and network security.
| # | Control | Applicability | How entityOS applies it |
|---|---|---|---|
| 8.1 | User endpoint devices | Applicable | Operations endpoints are hardened and monitored, MFA/IP-restricted, and run only approved software. |
| 8.2 | Privileged access rights | Applicable | Privileged access is restricted to a few long-tenured, qualified operations personnel and managed by the CRO with MFA. |
| 8.3 | Information access restriction | Applicable | Access to services, service functions and customer data is restricted by policy and enforced by the model. |
| 8.4 | Access to source code | Applicable | Read/write access to the platform source is tightly managed; the kernel is fixed and rarely changes. |
| 8.5 | Secure authentication | Applicable | Secure authentication (TOTP/MFA, perfect forward secrecy) is implemented. |
| 8.6 | Capacity management | Applicable | Resource usage is monitored and scaled on AWS; the testing service checks availability. |
| 8.7 | Protection against malware | Applicable | Endpoints run hardened, ad-blocking browsers with restricted execution and no Office/macros; AWS WAF sits at the edge. |
| 8.8 | Management of technical vulnerabilities | Applicable | Vulnerability scanning is continuous, patches are applied within 24 hours, and the WAF uses the latest control sets. |
| 8.9 | Configuration management | Applicable | Secure configuration of virtual resources is defined and continuously monitored; the fixed kernel keeps drift minimal. |
| 8.10 | Information deletion | Applicable | Customer data can be deleted by the owner at any time via the standard API; deletion on termination is documented. |
| 8.11 | Data masking | Applicable | Masking / encryption of sensitive fields is available to applications via the cryptography helper methods. |
| 8.12 | Data leakage prevention | Applicable | Layering, tenant isolation and encoded model output limit leakage; monitoring detects abnormal transfer. |
| 8.13 | Information backup | Applicable | Real-time data-store duplication plus daily full backups and test-restores via AWS RDS. |
| 8.14 | Redundancy of information processing facilities | Applicable | A warm-mode duplicate service is maintained and continuously tested for ready-to-run status. |
| 8.15 | Logging | Applicable | Activities, exceptions and faults are logged; the testing service verifies that logging is occurring. |
| 8.16 | Monitoring activities | Applicable | Networks, systems and applications are monitored for anomalies; the real-time testing service alerts on any exception. |
| 8.17 | Clock synchronization | Applicable | System clocks are synchronised to approved time sources. |
| 8.18 | Use of privileged utility programs | Applicable | Privileged utility, CLI and API use is restricted to authorised personnel under authentication and authorisation controls. |
| 8.19 | Installation of software on operational systems | Applicable | Software installation on operational systems is controlled; application control restricts executables. |
| 8.20 | Network security | Applicable | One protocol (HTTPS) over ports 80/443, behind AWS Elastic Load Balancers and WAF; virtual and physical network policies are aligned. |
| 8.21 | Security of network services | Applicable | Network-service security levels are identified, implemented and monitored. |
| 8.22 | Segregation of networks | Applicable | Tenants and services are segregated; virtual networks are configured to policy. |
| 8.23 | Web filtering | Applicable | Operations browsers apply ad-blocking / web filtering; servers carry no browser. |
| 8.24 | Use of cryptography | Applicable | 2048/256 SSL with perfect forward secrecy in transit and encryption at rest, plus customer-controlled crypto helpers (AES, SHA-256/512, RSA). |
| 8.25 | Secure development life cycle | Applicable | Secure-development rules apply; the kernel changes only for security maintenance, shared with AWS. |
| 8.26 | Application security requirements | Applicable | Security requirements are specified for any platform change; customer apps run in the isolated user-mode layer. |
| 8.27 | Secure system architecture and engineering principles | Applicable | Separation of concerns (MVC), least-humans and closed-internet principles are applied by design. |
| 8.28 | Secure coding | Applicable | Secure-coding principles (CWE/SANS Top 25, OWASP) guide platform development; the model always delivers encoded output. |
| 8.29 | Security testing in development and acceptance | Applicable | Security testing is embedded; the OWASP-based real-time testing service runs continuously. |
| 8.30 | Outsourced development | Not applicable | No outsourced development — the platform is developed and maintained in-house. Customer application development occurs in the isolated user-mode layer and cannot affect the kernel. |
| 8.31 | Separation of development, test and production environments | Applicable | Development, test and production environments are separated and secured. |
| 8.32 | Change management | Applicable | Platform changes follow change-management procedures; customers are notified of changes that could affect them. |
| 8.33 | Test information | Applicable | Test information is selected, protected and managed; production customer data is not used for testing. |
| 8.34 | Protection of information systems during audit and testing | Applicable | Audit and assurance testing is planned and agreed to protect operational systems. |
The 2026 edition retires the old seven CLD controls and defines four standalone cloud controls, layered on the ISO/IEC 27002:2022 set above.
| # | Control | Applicability | How entityOS applies it |
|---|---|---|---|
| 5.38 | CLD — Shared roles and responsibilities within a cloud computing environment | Applicable | Shared security roles between entityOS (as CSP), its customers (CSCs) and AWS are allocated, documented and communicated: entityOS operates the platform kernel; customers govern their user-mode apps and data configuration. |
| 5.39 | CLD — Agreement on the roles and responsibilities of the cloud service partner | Applicable | Where a cloud service partner (CSN) is involved, roles and responsibilities are defined and agreed consistently with the shared CSC/CSP allocation; AWS is the principal upstream provider. |
| 8.35 | CLD — Segregation in virtual computing environments | Applicable | Tenants are logically segregated in the multi-tenant environment (isolated since 2000); the data-store releases data only in tenancy context, and CSP administration is separated from tenant resources. |
| 8.36 | CLD — Detection and prevention of unauthorized use of cloud services | Applicable | Use of the service is monitored for anomalies and unauthorised access or transfer; the real-time testing service and logging detect deviations and raise alerts. |