This guide covers Matrix mappings for ISO 27001 access control and idle sessions (iso-1, Annex A.5.15), cryptography and key management (iso-2, Annex A.8.24), and data leakage prevention (iso-3, Annex A.8.12). ISO/IEC 27001 certification depends on an accredited audit of an organisation’s ISMS; these patterns are not certification advice.
1. Enforce access-control policy in code (iso-1)
Centralise session expiry and authorisation instead of relying on individual route handlers.
export function sessionIsValid(session: { lastSeen: number }, now = Date.now()) {
return now - session.lastSeen < 15 * 60 * 1000;
}Pair the implementation with policy ownership, access reviews, joiner/mover/leaver operations, and tests for timeouts and revoked accounts.
2. Treat keys as lifecycle-managed assets (iso-2)
Use platform cryptographic APIs and managed or hardware-backed keys where appropriate. Keep a key inventory with purpose, owner, algorithm, rotation trigger, backup/recovery procedure, and destruction record.
const iv = crypto.getRandomValues(new Uint8Array(12));
const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);Never hard-code keys, reuse AES-GCM IVs with the same key, or log plaintext and key material. Test decryption failures and key-rotation rollback paths.
3. Build DLP around egress decisions (iso-3)
Classify fields before they leave a trust boundary, then block, redact, or route to a human review queue. Record only the minimum evidence needed to investigate a policy decision.
export function allowEgress(classification: 'public' | 'internal' | 'restricted', destinationApproved: boolean) {
return classification !== 'restricted' || destinationApproved;
}Verification checklist
- Idle-session and deprovisioning tests cover privileged roles.
- Key inventory is reconciled against live key references.
- DLP tests include secrets, identifiers, malformed Unicode, and large payloads.
Use the ISO 27001 Matrix to record local evidence and residual risk.