# ISO 27001 & Security Standards

## Overview

Primebrick is built to support organizations pursuing **ISO/IEC 27001**
certification and compliance with related security standards. The framework
implements controls across the ISO 27001 Annex A domains out of the box,
reducing the implementation burden for security teams.

## ISO/IEC 27001 Annex A controls

### A.5 — Organizational controls

| Control | Primebrick implementation |
|---------|--------------------------|
| A.5.15 Access control | RBAC with fine-grained permissions, organization-level isolation |
| A.5.16 Identity management | Casdoor™/OIDC identity provider, MFA enforced |
| A.5.17 Authentication information | Passkeys (WebAuthn), no shared secrets stored |
| A.5.23 Information security for use of cloud services | Deploy on any cloud or on-premises — no vendor lock-in |
| A.5.34 Privacy and protection of PII | See [GDPR & Data Protection](/getting-started/gdpr-data-protection) |

### A.6 — People controls

| Control | Primebrick implementation |
|---------|--------------------------|
| A.6.3 Information security awareness, education, and training | Documented security posture, audit trail visibility |
| A.6.6 Confidentiality or non-disclosure agreements | MIT license — code is inspectable for security review |

### A.7 — Physical controls

Physical controls (A.7.1–A.7.6) are deployment-dependent. Primebrick runs on
any infrastructure — cloud, on-premises, or hybrid. Physical security is the
responsibility of the hosting provider or the organization.

### A.8 — Technological controls

| Control | Primebrick implementation |
|---------|--------------------------|
| A.8.2 Privileged access rights | RBAC with admin role, step-up authentication for critical actions |
| A.8.3 Information access restriction | Field-level RBAC, multi-tenant isolation at DAL layer |
| A.8.4 Access to source code | MIT license — code is public on GitHub™, auditable |
| A.8.5 Secure authentication | Passkeys, MFA, step-up auth (see [Authentication & MFA](/getting-started/authentication-mfa)) |
| A.8.15 Logging | Immutable audit trail for all CRUD operations |
| A.8.16 Monitoring activities | Audit trail, health checks, service registry monitoring |
| A.8.23 Web filtering | N/A — application framework, not network infrastructure |
| A.8.25 Secure development life cycle | TypeScript®, linting, tests, CI/CD, dependency pinning |
| A.8.28 Secure coding | OWASP Top 10 mitigations, input validation, parameterized queries |
| A.8.29 Security testing in development | Automated axe-core accessibility scans, OpenAPI validation |

## OWASP Top 10 mitigation

| OWASP risk | Primebrick mitigation |
|------------|----------------------|
| A01: Broken Access Control | RBAC, multi-tenant isolation, field-level permissions |
| A02: Cryptographic Failures | TLS 1.2+, no password storage, JWT with short expiry |
| A03: Injection | Parameterized queries via DAL, input validation, Zod schemas |
| A04: Insecure Design | Threat modeling, step-up auth, least-privilege defaults |
| A05: Security Misconfiguration | Pinned dependencies, documented config, no default secrets |
| A06: Vulnerable Components | Pinned versions only (no ranges), CI dependency scanning |
| A07: Auth Failures | Passkeys, MFA, step-up auth, no session reuse for critical actions |
| A08: Software/Data Integrity | Audit trail, signed JWTs, OpenAPI spec validation |
| A09: Logging/Monitoring Failures | Immutable audit trail, structured logging, health checks |
| A10: SSRF | No server-side fetching of user-supplied URLs by default |

## SOC 2 alignment

Primebrick supports **SOC 2 Trust Services Criteria**:

| Criteria | How Primebrick supports it |
|----------|--------------------------|
| Security | RBAC, MFA, encryption, audit trail |
| Availability | Health checks, service registry, graceful degradation |
| Processing integrity | Audit trail, input validation, OpenAPI spec enforcement |
| Confidentiality | Multi-tenant isolation, field-level RBAC, TLS |
| Privacy | GDPR alignment, data minimization, right to erasure |

## NIST Cybersecurity Framework

| Function | Primebrick support |
|----------|-------------------|
| Identify | Asset registry via service registry, OpenAPI specs |
| Protect | RBAC, MFA, encryption, passkeys |
| Detect | Audit trail, health checks, structured logging |
| Respond | Audit trail shows what was accessed/modified |
| Recover | Soft-delete, restore operations, audit trail for forensics |

## Standards & references

| Standard | Relevance |
|----------|-----------|
| [ISO/IEC 27001](https://www.iso.org/standard/27001) | Information Security Management Systems |
| [ISO/IEC 27002](https://www.iso.org/standard/75652.html) | Information security controls |
| [SOC 2](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html) | Trust Services Criteria |
| [NIST CSF](https://www.nist.gov/cyberframework) | Cybersecurity Framework |
| [OWASP Top 10](https://owasp.org/www-project-top-ten/) | Web application security risks |
| [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) | Application Security Verification Standard |