What is ISO/IEC 27001:2022?

ISO/IEC 27001 is the international standard for information security management systems (ISMS). The 2022 edition groups the measures in Annex A into 93 controls across four themes: organisational, people, physical and technological. For certification, an organisation shows that the applicable controls are implemented and effective, not only on the day of the audit. blacklens.io is not an ISMS tool and does not replace a risk assessment; the platform is the technical source of evidence.

Which Annex A controls can blacklens.io evidence?

At the core A.5.7 (threat intelligence), A.5.9 (inventory), A.5.19 to A.5.22 (suppliers), A.5.23 (cloud), A.8.8 (technical vulnerabilities), A.8.9 (configuration), A.8.16 (monitoring) and A.8.20 (networks security), plus A.8.5 (authentication) and A.5.24 to A.5.26 (incidents). Organisational, people and physical controls remain the job of your ISMS.

Is a vulnerability scanner enough for A.8.8?

No. A.8.8 requires obtaining information about technical vulnerabilities, evaluating exposure and taking appropriate measures. A scan result proves only the first step. The documented finding lifecycle with assessment, status, retest and archive proves all three.

How often should we scan for ISO 27001?

The standard does not prescribe a frequency; it requires a risk-based approach. Continuous scanning of the external attack surface and a regular internal cadence are easy to justify to auditors, especially since NIS2 and DORA point in the same direction. More important than the frequency is that the cadence is documented and kept.

How do we evidence threat intelligence under A.5.7?

A.5.7 requires collecting, analysing and using threat information. The Threat Center history shows which new CVEs were matched against your inventory, verified and handled; the dark web findings show which threats against identities were detected and worked. Both are exportable.

Does this help with TISAX too?

Yes. TISAX is based on the VDA ISA, whose questions on vulnerability management, network security, cloud and suppliers correspond in substance to the Annex A controls named here. The same reports and logs serve as evidence; the label is issued by an accredited audit provider.

How does the evidence get into our ISMS tool?

Via scheduled PDF reports, CSV exports from any list and the REST API with 250+ endpoints. Many customers simply link the monthly vulnerability report and the executive report in the ISMS as evidence for the respective control.

Compliance

ISO 27001: evidencing Annex A controls continuously

Auditors want to see that controls work. blacklens.io generates the evidence for vulnerabilities, inventory, threats and suppliers, continuously and with history.

Start free trial Book a demo

Evidence for Annex Aas PDF

Asset inventoryISO/IEC 27001 A.5.9continuous

Threat Center matchingISO/IEC 27001 A.5.7real time

Supplier watchlistISO/IEC 27001 A.5.22about every 30 min

Vulnerability reportISO/IEC 27001 A.8.8monthly

What ISO 27001 requires in the audit

ISO/IEC 27001:2022 requires an ISMS whose controls demonstrably work, and not only on the day of the audit.

Annex A

93 controls in four themes

Organisational, people, physical, technological. Your statement of applicability selects.

Clause 9.1

Monitor and measure

The effectiveness of the ISMS is monitored, measured and evaluated on an ongoing basis.

Clause 9.3

Management review

Top management reviews the ISMS at planned intervals, including trends.

Certification

Data instead of descriptions

Auditors ask, for example, which vulnerabilities you detected, assessed and fixed in three months.

Technical guidance, not legal advice. Which obligations apply to you is for your legal department, auditor or supervisory authority to confirm.

Controls for which blacklens.io provides evidence

The mapping follows Annex A of the 2022 edition. Which controls apply to you is defined in your statement of applicability.

A.8.8

Fix firstsorted by risk

1CVE-2024-21762vpn.beispiel-gmbh.atKEV

2CVE-2024-21410mail.beispiel-gmbh.atKEV

3TLS 1.0 enabledshop.beispiel-gmbh.atMedium

A.5.9

Newly discovered assets+4 since yesterday

beispiel-gmbh.atRoot domain

vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical

dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh

mail.beispiel-gmbh.atExchange Server 2019Medium

203.0.113.24OpenSSH 8.9NewInfo

A.5.7

Early warning47 min ago

CVE-2024-21762FortiOS SSL-VPNCritical

CVE published08:12
2 assets in your inventory affected09:00
Confirmed by PoC scan09:26
Alert sent to Microsoft Teams09:27

A.5.19 to A.5.22

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

A.5.23 and A.8.9

Cloud accounts4 connected

S3 bucket publicly accessibleAWSHigh

Admin accounts without MFAMicrosoft 365Critical

VM with public IPAzureMedium

Public API endpointGoogle CloudMedium

Visuals show sample data.

Audit evidence that blacklens.io generates

Executive, vulnerability, pentest, query and insights reports go out by email daily, weekly or monthly, so the evidence is complete at audit time.

Reportsscheduled by email

PDFExecutive reportWeekly, Monday 07:00

PDFVulnerability reportMonthly

PDFPentest reportAfter every test

Management, head of IT

Activity log
Who opened, commented on, risk-accepted or closed which finding, and when.
Finding history
Closed findings are archived after 30 days rather than deleted.
Trends for clause 9
Nightly snapshots and exposure score for measurement and management review.
Exports and API
CSV and PDF from any list, REST API for your ISMS or GRC tool.

Audit preparation in four steps

1
Map controls
Map applicable controls from your statement of applicability to the matching evidence.
2
Connect the scope
Add domains and cloud accounts, roll out Sentry for the internal network.
3
Schedule reports
Send vulnerability and executive reports monthly to the ISMS owners.
4
Link the evidence
Attach reports and exports to the respective control in your ISMS tool.

Example from practice

Logistics provider evidences A.8.8 across subsidiaries

A Europe-wide logistics provider had to collect vulnerabilities from networks, cloud accounts and subsidiaries centrally. blacklens.io built a complete inventory and detected newly exposed systems between scheduled scans.

Result
Reduced attack surface, clear responsibilities and auditable implementation in line with ISO 27001.

Progresslast 90 days

Critical findings143

Exposed services3821

Visuals show sample data.

Frequently asked questions

: ISO/IEC 27001 is the international standard for information security management systems (ISMS). The 2022 edition groups the measures in Annex A into 93 controls across four themes: organisational, people, physical and technological. For certification, an organisation shows that the applicable controls are implemented and effective, not only on the day of the audit. blacklens.io is not an ISMS tool and does not replace a risk assessment; the platform is the technical source of evidence.
: At the core A.5.7 (threat intelligence), A.5.9 (inventory), A.5.19 to A.5.22 (suppliers), A.5.23 (cloud), A.8.8 (technical vulnerabilities), A.8.9 (configuration), A.8.16 (monitoring) and A.8.20 (networks security), plus A.8.5 (authentication) and A.5.24 to A.5.26 (incidents). Organisational, people and physical controls remain the job of your ISMS.
: No. A.8.8 requires obtaining information about technical vulnerabilities, evaluating exposure and taking appropriate measures. A scan result proves only the first step. The documented finding lifecycle with assessment, status, retest and archive proves all three.
: The standard does not prescribe a frequency; it requires a risk-based approach. Continuous scanning of the external attack surface and a regular internal cadence are easy to justify to auditors, especially since NIS2 and DORA point in the same direction. More important than the frequency is that the cadence is documented and kept.
: A.5.7 requires collecting, analysing and using threat information. The Threat Center history shows which new CVEs were matched against your inventory, verified and handled; the dark web findings show which threats against identities were detected and worked. Both are exportable.
: Yes. TISAX is based on the VDA ISA, whose questions on vulnerability management, network security, cloud and suppliers correspond in substance to the Annex A controls named here. The same reports and logs serve as evidence; the label is issued by an accredited audit provider.
: Via scheduled PDF reports, CSV exports from any list and the REST API with 250+ endpoints. Many customers simply link the monthly vulnerability report and the executive report in the ISMS as evidence for the respective control.

Compliance & audit

Overview of NIS2, ISO 27001, TISAX, DORA and critical infrastructure.

NIS2

Evidence Article 21 with the same data.

Unified Vulnerability Management

The process behind A.8.8.

DORA

ICT risk management for financial entities.

Evidence for Annex A, generated continuously

See in a demo which reports and logs your auditor receives. Or start with your domains.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings