Security · Standards & Frameworks
entityOS is designed and operated to align with a coherent family of international standards and frameworks — for information security, privacy, continuity, AI, quality, risk, and practical cyber defence — anchored on its ISO 27001 information security management system.
The Anchor
ISO 27001 is the foundation. It defines the information security management system (ISMS) that governs how entityOS protects data — and it is the reference point every other standard on this page relates back to.
Some standards extend ISO 27001 into specific domains — cloud, privacy, the detail of the controls themselves. Others are parallel management systems for continuity, AI, and quality that share the same governance discipline. A final group provides independent assurance and practical cyber baselines. Together they describe how entityOS is built, run, and held to account.
The Standards
Each standard, its main focus, and how it relates to the ISO 27001 ISMS at the centre of entityOS.
| Standard / framework | Main focus | Relationship to ISO 27001 |
|---|---|---|
| ISO 27002Controls | Information security controls | Detailed guidance for implementing the controls that support ISO 27001 certification. |
| ISO 27017Cloud | Cloud security | Adds guidance for cloud providers and customers, including shared responsibilities. The 2026 edition aligns with the ISO 27002:2022 controls behind ISO 27001:2022. |
| ISO 27701Privacy | Privacy management | Governs the handling of personal information. The 2025 edition is a standalone management system standard. |
| ISO 22301Continuity | Business continuity | Preparing for disruption, maintaining essential operations, and recovering. |
| ISO 42001AI | AI management | Governing the responsible development and use of AI. |
| ISO 9001Quality | Quality management | Consistent delivery, meeting customer requirements, and continual improvement. |
| ISO 31000Risk | Risk management | Organisation-wide risk guidance; not a certifiable standard. |
| SOC 2Assurance | Assurance over service-provider controls | Independent examination and report covering security and selected additional trust criteria. |
| NIST CSFFramework | Cybersecurity risk management | Framework for governing, identifying, protecting, detecting, responding, and recovering. |
| ASD Essential EightBaseline | Practical cyberattack mitigation | Australian Signals Directorate baseline of eight prioritised mitigation strategies, assessed against maturity levels. |
Alignment, not equivalence. Certifiable management-system standards (ISO 27001, 27701, 22301, 42001, 9001) and independent assurance (SOC 2) are distinct from guidance and frameworks (ISO 27002, ISO 31000, NIST CSF, ASD Essential Eight), which inform how controls are chosen and operated rather than being certified against.
How They Fit Together
The same standards, grouped by the role they play around the ISO 27001 core.
Guidance and management systems that build directly on the information security core.
The implementation detail behind the ISO 27001 controls.
Cloud-specific controls and shared-responsibility guidance; 2026 edition realigned to ISO 27002:2022.
Privacy management for personal information — standalone in the 2025 edition.
The same governance discipline applied to continuity, AI, and quality.
Preparing for disruption and keeping essential operations running.
Responsible development and use of AI.
Consistent delivery, customer requirements, and continual improvement.
How risk is judged organisation-wide, and how controls are attested by a third party.
Organisation-wide risk principles — not a certifiable standard.
Independent examination covering security and selected trust criteria.
Practical, outcome-focused frameworks for defending against real-world attacks.
Govern, identify, protect, detect, respond, recover.
Eight prioritised mitigations assessed against maturity levels.
A Note On Editions
A standard like ISO 27017 is not part of ISO 27001. It is a companion code of practice that adds cloud-specific guidance on top of the ISO 27002 controls that ISO 27001 draws on. So a new edition of ISO 27001 never retires it — the two are designed to move together.
What a revision does change is alignment. When ISO 27001:2022 realigned to the ISO 27002:2022 control set — 93 controls across four themes — the older ISO 27017:2015, still mapped to the 2013 structure, was temporarily out of step.
That gap is now closed. ISO 27017:2026 supersedes the 2015 edition, realigns to the ISO 27002:2022 controls, and adds guidance for modern technologies such as serverless computing and container orchestration. The lesson generalises: entityOS references the current edition of each standard, so the family stays coherent as individual standards revise on their own cycles.
ISMS realigned to the ISO 27002:2022 control set (93 controls, four themes).
Original cloud code of practice, mapped to the earlier ISO 27002:2013 structure.
Published July 2026. Realigned to ISO 27002:2022; adds serverless and container guidance.
Compliance Posture
entityOS treats standards as an operating discipline, not a badge. The full compliance detail — scope, current status, and supporting documentation — is maintained alongside the platform.