Much of what an ISO 27001 audit asks about already happens in Clusterward: two-factor sign-in, roles, API tokens, the audit log, backups with restore tests, isolation, certificates. The compliance page brings it onto one page – with live checks and their Annex A control, reports as CSV, a signed access review and a compliance pack for your auditor.
The compliance page is an item of its own in the cockpit’s main menu, meant for your information security officer and your auditor. It shows checks that Clusterward works out from your workspace’s stored state every time you open it – nothing is ticked by hand, so nothing can go stale. Each check names its control from ISO/IEC 27001:2022 Annex A and links the page where you change things.
Each check reads OK, Attention, Problem or Info and names what is behind the number – the users, tokens or buckets. The control numbers are the standard’s, the same in every certification to the 2022 edition: you find each one in your own Statement of Applicability.
Documents written for the 2013 edition use other numbers – match those by the control’s name.
| Check | Control | Attention or problem when |
|---|---|---|
| Two-factor sign-in | A.8.5 Secure authentication | an active user has not enrolled (pending invitations are counted apart) |
| Administrators | A.8.2 Privileged access rights | an administrator has not signed in for 90 days |
| API tokens | A.5.17 Authentication information | a token never expires or was not used for 90 days |
| Access review | A.5.18 Access rights | none was signed yet, the next one is due within 14 days, or it is overdue |
| Sign-in protection and sessions | A.8.5 Secure authentication | sessions stay open longer than 4 hours without activity, or more than 10 failed attempts are allowed |
| Bucket backups | A.8.13 Information backup | buckets exist without a backup target, the target is not ready, or a bucket had no good backup for 36 hours |
| Restore tests | A.8.13 Information backup | the latest test failed, or a backed-up bucket was not tested this month yet |
| Database backups | A.8.13 Information backup | information only – Scaleway backs up each instance on its own schedule |
| Audit log | A.8.15 Logging | it is kept fewer than 365 days |
| Security notifications | A.8.16 Monitoring activities | sign-in, backup and certificate events reach no channel |
| IP allowlist | A.8.20 Networks security | information only – whether the cockpit answers every address |
| Environment isolation | A.8.22 Segregation of networks | an environment where isolation is offered is not isolated |
| Certificates | A.8.24 Use of cryptography | a wildcard certificate expires within 14 days or is not ready |
| Cluster add-ons | A.8.8 Management of technical vulnerabilities | an upgrade is available or an add-on no longer fits its Kubernetes version |
| Configuration check | A.8.9 Configuration management | the last check found differences or is older than 7 days |
“Compliance” in the main menu: the OK, attention and problem count at the top, the checks by theme below.
Every check links the page where you change it – users, tokens, backups, notifications.
“Start review” lists every user and token; after the clean-up, “Sign review” with a note.
“Download compliance pack” puts all six reports of a period into one ZIP with a README and checksums.
Every check is worked out from the stored state when you open the page. A change in the cockpit shows at once.
Next to A.8.5 or A.8.13 stands the name from Annex A – in the compliance pack too. So you find each in your SoA.
Access, backup evidence, changes, inventory with data locations, audit log and security settings.
One ZIP with every report, a README and SHA256SUMS – sha256sum -c later proves that nothing was changed.
Who signed when, how many users and tokens, plus a SHA-256 of the access list as evidence.
The page needs the same permission as the audit log. An auditor role sees and downloads everything, changes nothing.
You pick a period, by default the last 90 days, at most 400. It applies to the reports of things that happened; the others describe the state now. Every download is recorded in the audit log – the evidence itself has a trail too.
| Report | Content | Covers |
|---|---|---|
| Access review | every user and API token: role and what it allows, application scope, 2FA, status, last activity, expiry | state now |
| Backup evidence | every bucket backup, restore and restore test | period |
| Changes | every deploy, restart and rollback with version, result and who started it | period |
| Asset and data location inventory | clusters, database instances, buckets, the backup target, DNS zones, secret stores, environments and services with provider and region | state now |
| Audit log | every recorded action of the period; secret-looking values redacted | period |
| Security settings | the values in force: sign-in protection, sessions, allowlist, retention, backups, which channel receives which event | state now |
ISO 27001 asks you to review access at fixed intervals – and to show that you did (A.5.18). “Start review” lists everyone who can reach the workspace: users and API tokens with role, application scope, two-factor, status and last activity. You tidy up under Users, Roles or API tokens, come back and sign.
The signature records who signed when, how many users and tokens there were, and a SHA-256 of the access list – the evidence, without keeping a second copy of the list. Two weeks before the due date the check turns amber, after it red, and “Access review overdue” is sent once to the subscribed channels.
Where the evidence comes from is described on the pages for Security & access – roles, mandatory 2FA, audit log – and S3 backups, whose restore tests feed the backup evidence.
How the evidence fits into an NIS2 or ISO 27001 preparation is shown under Audit & NIS2. Which events reach you as an e-mail or webhook is listed under Notifications.
Which evidence operations supply for NIS2 Art. 21 and ISO 27001.
Go to Audit & NIS2Nightly copies with Object Lock, tested monthly, with evidence.
Go to S3 backupsRoles, mandatory 2FA, API tokens, audit log and IP allowlist.
Go to Security & accessYour question isn’t here? Write to us – we usually reply the same working day.
Ask a questionBring your checklist: we open the checks, sign an access review and download a compliance pack.
