Global · ISO 27001
ISO/IEC 27001 information security
ISO/IEC 27001 defines an information security management system. Annex A includes technological controls such as secure coding, logging and cryptography that map directly to your codebase.
Example finding
rulefix scan --format json
{
"rule": "iso-27001.weak-or",
"framework": "ISO 27001",
"severity": "high",
"file": "app/api/signup.ts",
"check": "Weak or custom cryptography",
"status": "failed",
"fix": { "available": true, "files": 2 }
}Key requirements
What ISO 27001 expects from engineering.
- 01
Secure coding
Apply secure coding principles to software development.
- 02
Logging and monitoring
Produce, store and protect logs that record activities and exceptions.
- 03
Use of cryptography
Define and apply rules for the effective use of cryptography.
- 04
Access restriction
Restrict access to information in line with access control policy.
- 05
Data masking
Mask data where required by policy and legislation.
- 06
Secure development lifecycle
Establish rules for secure development of software and systems.
What RuleFix checks
Turned into code rules.
- Weak or custom cryptography
- Unmasked sensitive fields
- Missing security logging
- Hard-coded credentials
- Insecure defaults in config
Official sources
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
Other frameworks
Cover more with the same workflow.
DPDP
GDPR
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.