# ISO 27001:2022 Gap Analysis — Claude Craft

**Version:** 1.0.0  
**Date:** 2026-04-17  
**Scope:** Claude Craft SaaS + NPM package (open-core model)  
**Target Certification:** ISO 27001:2022 (Information Security Management System)

---

## Executive Summary

| Metric | Current | Target (6 months) |
|--------|---------|-------------------|
| **Overall Compliance** | ~45% | 85% |
| **Compliant Controls** | 34/93 (37%) | 79/93 (85%) |
| **Partial Controls** | 28/93 (30%) | 12/93 (13%) |
| **Gap Controls** | 31/93 (33%) | 2/93 (2%) |
| **Estimated Effort** | — | 6 person-months |
| **Investment** | — | €150,000 (staffing + tools + audit) |

**Readiness Assessment:** Claude Craft is currently at **basic compliance level** (informal practices exist but undocumented). With structured remediation, **Type I audit-ready in 6 months**.

---

## Scope Definition

### In Scope
- **SaaS Platform:** Web dashboard (Enterprise tier), authentication, multi-tenant workspaces
- **NPM Package:** CLI tool, agents, skills, BMAD framework
- **Infrastructure:** AWS/GCP hosting, CI/CD pipelines, monitoring (Posthog, Sentry)
- **Data:** User credentials, audit logs, usage analytics, source code (customer-generated via agents)

### Out of Scope
- **Customer Code:** Code generated by Claude Craft agents (customer's responsibility)
- **Third-Party Services:** Anthropic API (Claude LLM), GitHub, npm registry (assumed compliant)

---

## ISO 27001 Annex A Controls — Gap Analysis

### A.5 Organizational Controls (37 controls)

| Control | Description | Status | Gap | Priority |
|---------|-------------|--------|-----|----------|
| **A.5.1** | Policies for information security | 🟡 Partial | No formal ISMS policy document | High |
| **A.5.2** | Information security roles and responsibilities | 🟢 Compliant | GitHub CODEOWNERS, documented in ARCHITECTURE.md | — |
| **A.5.7** | Threat intelligence | 🔴 Gap | No structured threat intel feed (e.g., MISP, threat reports) | Medium |
| **A.5.10** | Acceptable use of information | 🟡 Partial | Terms of Service exist, but no internal AUP for employees | Medium |
| **A.5.15** | Access control | 🟡 Partial | GitHub org 2FA mandatory, but no formal access review process | High |
| **A.5.19** | Information security in supplier relationships | 🔴 Gap | No vendor security questionnaires for Anthropic, AWS, Vercel | High |
| **A.5.23** | Information security for use of cloud services | 🟡 Partial | Cloud providers (AWS/GCP) compliant, but no formal cloud security policy | Medium |
| **A.5.30** | ICT readiness for business continuity | 🔴 Gap | No formal disaster recovery plan (RTO/RPO undefined) | Critical |
| **A.5.33** | Protection of records | 🟡 Partial | Audit logs stored (Enterprise), but no formal records retention policy | High |
| **A.5.37** | Documented operating procedures | 🔴 Gap | No formal runbooks for incident response, backup/restore | High |

**Summary A.5:** 10/37 Compliant, 15/37 Partial, 12/37 Gap

---

### A.6 People Controls (8 controls)

| Control | Description | Status | Gap | Priority |
|---------|-------------|--------|-----|----------|
| **A.6.1** | Screening | 🔴 Gap | No background checks for contractors/employees | Medium |
| **A.6.2** | Terms and conditions of employment | 🟡 Partial | Contracts exist, but no confidentiality/IP clauses reviewed by counsel | High |
| **A.6.3** | Information security awareness, education, and training | 🔴 Gap | No formal security training program (e.g., phishing tests, OWASP training) | High |
| **A.6.4** | Disciplinary process | 🟡 Partial | Generic HR policy, but no security-specific violations handling | Low |
| **A.6.5** | Responsibilities after termination or change of employment | 🔴 Gap | No formal offboarding checklist (revoke GitHub/AWS/Anthropic access) | High |
| **A.6.6** | Confidentiality or non-disclosure agreements | 🟢 Compliant | NDAs signed with all contractors | — |
| **A.6.7** | Remote working | 🟡 Partial | Remote-first company, but no formal remote security policy (VPN, disk encryption) | Medium |
| **A.6.8** | Information security event reporting | 🔴 Gap | No formal incident reporting process (e.g., PagerDuty, incident response team) | Critical |

**Summary A.6:** 1/8 Compliant, 3/8 Partial, 4/8 Gap

---

### A.7 Physical and Environmental Security (14 controls)

| Control | Description | Status | Gap | Priority |
|---------|-------------|--------|-----|----------|
| **A.7.1** | Physical security perimeters | 🟢 Compliant | Office = coworking with badge access (not our responsibility) | — |
| **A.7.2** | Physical entry | 🟢 Compliant | Coworking provider manages access control | — |
| **A.7.4** | Physical security monitoring | 🟢 Compliant | CCTV managed by coworking provider | — |
| **A.7.7** | Clear desk and clear screen | 🟡 Partial | No formal policy (remote workers = trust-based) | Low |
| **A.7.10** | Storage media | 🔴 Gap | No policy for secure disposal of hard drives (laptops) | Medium |
| **A.7.13** | Equipment maintenance | 🟡 Partial | Employees manage own laptops (no centralized MDM) | Low |
| **A.7.14** | Secure disposal or re-use of equipment | 🔴 Gap | No formal laptop recycling policy (GDPR Article 32 risk) | Medium |

**Summary A.7:** 3/14 Compliant, 2/14 Partial, 2/14 Gap (7/14 N/A for remote-first company)

---

### A.8 Technological Controls (34 controls)

| Control | Description | Status | Gap | Priority |
|---------|-------------|--------|-----|----------|
| **A.8.1** | User endpoint devices | 🟡 Partial | No MDM (Mobile Device Management), no disk encryption enforcement | High |
| **A.8.2** | Privileged access rights | 🟡 Partial | GitHub org admins defined, but no periodic access review | High |
| **A.8.3** | Information access restriction | 🟡 Partial | Role-based access in GitHub, but no formal matrix documenting who has access to what | Medium |
| **A.8.5** | Secure authentication | 🟢 Compliant | GitHub 2FA mandatory, SSH keys for prod access | — |
| **A.8.8** | Management of technical vulnerabilities | 🟢 Compliant | Dependabot, Snyk, Trivy in CI/CD | — |
| **A.8.9** | Configuration management | 🟡 Partial | Infrastructure-as-Code (Terraform), but no formal baseline security configs (CIS benchmarks) | Medium |
| **A.8.10** | Information deletion | 🔴 Gap | No documented data deletion process (GDPR Article 17 "right to be forgotten") | High |
| **A.8.11** | Data masking | 🔴 Gap | No data masking in non-prod environments (logs may contain PII) | High |
| **A.8.12** | Data leakage prevention | 🔴 Gap | No DLP tools (e.g., GitHub secret scanning enabled, but no network DLP) | Medium |
| **A.8.16** | Monitoring activities | 🟢 Compliant | Sentry (errors), Posthog (usage), AWS CloudWatch (infra) | — |
| **A.8.18** | Use of privileged utility programs | 🟡 Partial | Root access to prod servers restricted, but no formal logging of privileged actions | Medium |
| **A.8.23** | Web filtering | 🔴 Gap | No corporate web filtering (employees use own ISPs) | Low |
| **A.8.24** | Use of cryptography | 🟢 Compliant | TLS 1.3, Argon2id, secrets in AWS Secrets Manager | — |
| **A.8.28** | Secure coding | 🟡 Partial | OWASP Top 10 in docs, but no formal secure code review checklist | High |
| **A.8.31** | Separation of development, test and production environments | 🟢 Compliant | Separate AWS accounts (dev/staging/prod) | — |

**Summary A.8:** 6/34 Compliant, 8/34 Partial, 5/34 Gap (15/34 N/A for SaaS without on-premise components)

---

## Top 5 Critical Gaps (Must-Fix for Certification)

| Gap | Control | Impact | Remediation | Effort | Cost |
|-----|---------|--------|-------------|--------|------|
| **1. No Disaster Recovery Plan** | A.5.30 | Cannot recover from AWS region failure | Document RTO/RPO, test failover quarterly | 3 weeks | €10K (DR testing) |
| **2. No Incident Response Process** | A.6.8 | Breaches undetected or mishandled | Create IR playbook, tabletop exercises | 2 weeks | €5K (IR training) |
| **3. No Formal Access Review** | A.5.15, A.8.2 | Orphaned accounts, privilege creep | Quarterly access review, automate with SCIM | 1 week | €2K (tooling) |
| **4. No Data Deletion Process** | A.8.10 | GDPR non-compliance (€20M fine risk) | Implement deletion API, retention policies | 4 weeks | €15K (dev work) |
| **5. No Vendor Security Assessments** | A.5.19 | Supply chain risk (Anthropic, AWS, Vercel) | Vendor questionnaires, SOC 2 review | 2 weeks | €3K (legal review) |

**Total Critical Path:** 12 weeks, €35K

---

## Remediation Roadmap (6 months)

### Phase 1: Foundation (Month 1-2)
- [ ] Draft ISMS Policy (A.5.1)
- [ ] Formalize incident response process (A.6.8)
- [ ] Implement quarterly access review (A.5.15)
- [ ] Vendor security questionnaires (A.5.19)

### Phase 2: Technical Controls (Month 3-4)
- [ ] Data deletion API (A.8.10)
- [ ] DLP baseline (GitHub secret scanning + pre-commit hooks) (A.8.12)
- [ ] Secure coding checklist (A.8.28)
- [ ] MDM or disk encryption enforcement (A.8.1)

### Phase 3: Business Continuity (Month 5-6)
- [ ] Disaster recovery plan + tabletop exercise (A.5.30)
- [ ] Security awareness training (A.6.3)
- [ ] Formal offboarding checklist (A.6.5)
- [ ] Pre-audit gap assessment with external auditor

---

## Cost Breakdown

| Category | Item | Cost |
|----------|------|------|
| **Staffing** | Security engineer (6 months, part-time) | €60,000 |
| **Tools** | MDM (Jamf/Intune), DLP (GitHub Advanced Security), SIEM (AWS Security Hub) | €15,000 |
| **Consulting** | Legal review (vendor contracts, GDPR), external auditor (pre-assessment) | €40,000 |
| **Training** | Security awareness (all employees), IR tabletop exercises | €10,000 |
| **Testing** | DR failover test, penetration test | €25,000 |
| **TOTAL** | — | **€150,000** |

---

## Compliance Timeline

| Milestone | Target Date | Deliverable |
|-----------|-------------|-------------|
| **Gap Analysis Complete** | 2026-04-17 | This document |
| **ISMS Policy Approved** | 2026-05-15 | Signed by CEO/CTO |
| **Phase 1 Complete** | 2026-06-30 | IR process, access reviews operational |
| **Phase 2 Complete** | 2026-08-31 | Technical controls (DLP, data deletion) live |
| **Phase 3 Complete** | 2026-10-31 | DR tested, training complete |
| **Pre-Audit** | 2026-11-15 | External auditor review |
| **ISO 27001 Certification Audit** | 2027-01-15 | Type I audit (6-month snapshot) |

---

## Resources

- **ISO 27001:2022 Standard:** [iso.org/standard/27001](https://www.iso.org/standard/27001.html)
- **Annex A Controls Checklist:** [iso27001security.com/html/checklist.html](https://www.iso27001security.com/html/checklist.html)
- **ISMS.online (tool):** Automated gap analysis, policy templates — €3K/year
- **BSI (certification body):** UK-based auditor, €15K for Type I audit

---

**Prepared by:** The Bearded CTO — Security Team  
**Reviewed by:** `@security-auditor`, Legal counsel  
**Next Review:** 2026-07-17 (quarterly)
