Primebrick is built to support organizations pursuing ISO/IEC 27001
certification and compliance with related security standards. The framework
implements controls across the ISO 27001 Annex A domains out of the box,
reducing the implementation burden for security teams.
ISO/IEC 27001 Annex A controls
A.5 — Organizational controls
Control
Primebrick implementation
A.5.15 Access control
RBAC with fine-grained permissions, organization-level isolation
A.5.16 Identity management
Casdoor™/OIDC identity provider, MFA enforced
A.5.17 Authentication information
Passkeys (WebAuthn), no shared secrets stored
A.5.23 Information security for use of cloud services
Deploy on any cloud or on-premises — no vendor lock-in
A.6.6 Confidentiality or non-disclosure agreements
MIT license — code is inspectable for security review
A.7 — Physical controls
Physical controls (A.7.1–A.7.6) are deployment-dependent. Primebrick runs on
any infrastructure — cloud, on-premises, or hybrid. Physical security is the
responsibility of the hosting provider or the organization.
A.8 — Technological controls
Control
Primebrick implementation
A.8.2 Privileged access rights
RBAC with admin role, step-up authentication for critical actions
A.8.3 Information access restriction
Field-level RBAC, multi-tenant isolation at DAL layer
A.8.4 Access to source code
MIT license — code is public on GitHub™, auditable
