ISO/IEC 27001:2013, Annex A
ISO 27001 imposes various data protection, privacy and security testing requirements on all companies that must adhere to it. Holistic visibility and inventory of digital assets, web and mobile application security are an indispensable part of ISO 27001 compliance process:
A.7.1.1 Inventory of assets
“All assets shall be clearly identified and an inventory of all important assets drawn up and maintained.”
A.12.6.1 Control of technical vulnerabilities
“Timely information about technical vulnerabilities of information systems being used shall be obtained, the organization's exposure to such vulnerabilities evaluated, and appropriate measures taken to address the associated risk.”
A.15.2.2 Technical compliance checking
“Information systems shall be regularly checked for compliance with security implementation standards”
ImmuniWeb® AI Platform for ISO 27001 Compliance
1
Illuminate Your Attack
Surface to Prioritize Testing
ImmuniWeb® Discovery
Dark Web & Attack Surface Monitoring
- AI-Enabled
- Automated
- 24/7
2
Run Risk-Based Security
Testing and Remediation
ImmuniWeb® On-Demand
Web Application Penetration Testing
- AI-Enabled
- Manual
- One-Time
ImmuniWeb® MobileSuite
Mobile Penetration Testing
- AI-Enabled
- Manual
- One-Time
3
Ensure Continuous Security
Monitoring and Compliance
ImmuniWeb® Continuous
Continuous Penetration Testing
- AI-Enabled
- Manual
- 24/7
Application security and compliance for ISO 27001 starts with holistic visibility of your digital assets, related risks and threats. You simply cannot protect what you don't know. Therefore, we recommend commencing your ISO 27001 compliance efforts with IT asset discovery, inventory, classification and risk scoring. Our ImmuniWeb® Discovery leverages OSINT technology to rapidly detect your external web, mobile and cloud assets equipped with attractiveness and hackability scores. Based on our award-winning AI technology, ImmuniWeb Discovery will likewise provide you with a snapshot of your exposure in the Deep and Dark Web. Once completed, you are ready to start well-informed and risk-based application security testing for the purpose of ISO 27001 compliance.
For one-time security testing of your web applications and APIs, we recommend using ImmuniWeb® On-Demand equipped with CVE, CWE reporting and CVSSv3 risk scoring. Its in-depth and rapid testing is based on OWASP Web Security Testing Guide (WSTG), NIST SP 800-115 Technical Guide to Information Security Testing and Assessment, PCI DSS Information Supplement Penetration Testing Guidance, FedRAMP Penetration Test Guidance and ISACA’s How to Audit GDPR. The testing comprehensively covers full spectrum of security vulnerabilities from SANS Top 25 and OWASP Top 10.
For iOS and Android mobile apps and their backend (e.g. APIs or REST/SOAP web services) we provide all-inclusive testing with ImmuniWeb® MobileSuite equipped with CVE, CWE reporting and CVSSv3 risk scoring. Its in-depth and rapid testing is based on OWASP Mobile Security Testing Guide (MSTG) and OWASP Mobile Security Testing Guide (MSTG), NIST SP 800-115 Technical Guide to Information Security Testing and Assessment, PCI DSS Information Supplement Penetration Testing Guidance, FedRAMP Penetration Test Guidance and ISACA’s How to Audit GDPR. The testing comprehensively covers full spectrum of security vulnerabilities from SANS Top 25 and OWASP Mobile Top 10.
For most critical applications that directly impact your ISO 27001 compliance we offer ImmuniWeb® Continuous for incremental 24/7 testing of any new or updated code. It is equipped with CVE, CWE reporting and CVSSv3 risk scoring, its in-depth and rapid testing is based on OWASP Web Security Testing Guide (WSTG), NIST SP 800-115 Technical Guide to Information Security Testing and Assessment, PCI DSS Information Supplement Penetration Testing Guidance, FedRAMP Penetration Test Guidance and ISACA’s How to Audit GDPR. The testing comprehensively covers full spectrum of security vulnerabilities from SANS Top 25 and OWASP Top 10.
What’s Next:
- Request your interactive demo
- Follow ImmuniWeb on Twitter and LinkedIn
- Learn more about Attack Surface Management by ImmuniWeb® Discovery
- Learn more about AI-enabled Application Security Testing by ImmuniWeb
- Learn more about ImmuniWeb Community Edition
