Files
hermes-brain/ideas/compliance/iso-27001.org
Hermes cc3976fb7f ideas: editorial sweep — atomization, interlinking, restructuring
- Split competitive-analysis-2026-05.org → TOC + 9 competitor files in
  ideas/competitors/. Dropped date from filename. All competitor UUIDs
  generated, TOC keeps original UUID for backlink continuity.
- Deleted passepartout-economics.org archive (replaced by 27-node KB).
- Inlined 5 'See also' blocks into natural prose (compliance-index,
  first-mover-window, revenue-table, orders-of-magnitude-time,
  native-org-knowledge-base).
- Linked 7 orphan compliance pages back to compliance index + finished
  truncated sentences.
- Linked all 14 Agora requirement docs from topic-relevant pages
  (identity→lisp-machine-security, infrastructure→compute-marketplace,
  social-space→growth-strategy, exchange→agora-contracts, etc.).
- Linked ai-industry-impact from investment-thesis, sufficiency-flip,
  verification-appliance, effects-growth-flywheel (up from 1 to 10+ pages).
- Fixed CREATED timestamps to use git commit dates instead of today.
- Made all links absolute from root (no port inheritance).
- Removed stale agora/docs/ duplicate content.
2026-05-24 16:25:55 +00:00

1.5 KiB

ISO/IEC 27001 (Information Security Management)

International standard for information security management systems (ISMS). The most widely adopted security certification globally — ~60,000 certified organizations. Requires: risk assessment, security controls (Annex A, 93 controls across 4 domains), continuous improvement (Plan-Do-Check-Act), management review, internal audit.

Who must comply: Self-selected — enterprises pursue ISO 27001 certification because supply chain partners and regulators require it. Increasingly mandatory for: cloud providers, government contractors, critical infrastructure, and regulated financial institutions in multiple jurisdictions.

Penalties: No direct fines. Losing certification means losing business.

Why it matters: ISO 27001 is the universal baseline. It is the entry-level certification that opens every other regulated market. The gate stack maps to Annex A controls directly (A.9 access control, A.12 operations security, A.16 incident management, A.18 compliance). First-mover advantage: the ISO 27001 audit market is mature ($68B) and entirely manual (auditors flip through binders). A gate stack that produces audit evidence automatically is not competing with other software — it is competing with binders.

ISO 27701 (Privacy Information Management — PIMS extension to ISO 27001)