Annex A. Statement of Applicability and mapping ISO27001, NIS2 and CRA
This annex contains the official Statement of Applicability for OpenRemote. It lists
- The relevant ISO27001 security controls and describes how they are implemented within the organisation as described in this handbook.
- A mapping between the security requirements of the NIS2 Directive and the controls implemented by OpenRemote as described in this handbook.
- The cybersecurity requirements of the Cyber Resilience Act to the secure development and vulnerability management processes described in this handbook.
| Security Domain | ISO27001 Annex A | NIS2 Art.21 | CRA Requirement | OpenRemote Handbook Chapter |
|---|---|---|---|---|
| Governance & Security Policy | A.5.1 Policies for information security | Risk management measures | Secure-by-design governance | 1.3, 2.2, 2.3 |
| Roles and Responsibilities | A.5.2 Information security roles | Governance responsibility | Organisational accountability | 2.3 |
| Information Security Management | A.5.1–A.5.7 | Cybersecurity risk management | Security lifecycle governance | Chapter 3 |
| Risk Management | A.5.7 Threat intelligence / risk mgmt | Risk management measures | Risk management in design | Chapter 4 |
| Asset Management | A.5.9 Inventory of information assets | Asset identification | Asset transparency | 4.2 |
| Access Control | A.5.15 Access control | Access control measures | Secure configuration | 7.3, 16.3 |
| Authentication | A.5.17 Authentication information | Identity management | Secure access | 7.3 |
| Logging & Monitoring | A.8.15 Logging | Monitoring and detection | Monitoring mechanisms | 7.4 |
| Change Management | A.8.32 Change management | Security in operations | Secure lifecycle management | 7.5 |
| Secure Development | A.8.25 Secure development lifecycle | Security in development | Secure-by-design development | Chapter 5 |
| Secure Coding | A.8.28 Secure coding | Secure development practices | Secure software development | 5.3 |
| Build & CI/CD Security | A.8.27 Secure system engineering | Development security | Software integrity controls | 5.4 |
| Software Bill of Materials | A.8.9 Configuration management | Supply chain risk | Component transparency | 5.5 |
| Product Lifecycle & Support | A.8.31 Separation of dev/test/prod | Lifecycle security | Update and maintenance obligations | 5.6 |
| Vulnerability Monitoring | A.5.7 Threat intelligence | Vulnerability handling | Vulnerability monitoring | 6.1 |
| Patch Management | A.8.8 Management of technical vulnerabilities | Security updates | Timely patching | 6.2 |
| Vulnerability Disclosure | A.5.24 Information security incident reporting | Incident notification | Coordinated vulnerability disclosure | 6.3 |
| Security Advisories | A.5.26 Response to incidents | Incident communication | Security update communication | 6.4 |
| Infrastructure Security | A.8.20 Network security | Operational security | Secure infrastructure | Chapter 7 |
| Identity Management | A.5.16 Identity management | Access management | Secure authentication | 7.3 |
| System Monitoring | A.8.16 Monitoring activities | Threat detection | Security monitoring | 7.4 |
| Incident Management | A.5.25 Incident management | Incident handling | Incident response capability | 8.1 |
| Incident Reporting | A.5.26 Incident reporting | Incident reporting obligations | Security incident notification | 8.2 |
| Incident Review | A.5.27 Learning from incidents | Post-incident analysis | Continuous improvement | 8.3 |
| Business Continuity | A.5.29 ICT readiness for business continuity | Operational resilience | Service continuity | 9.1 |
| Disaster Recovery | A.5.30 ICT continuity | Service resilience | Recovery capabilities | 9.2 |
| Resilience Testing | A.5.30 Testing continuity | Resilience verification | Security testing | 9.3 |
| Supplier Risk Management | A.5.19 Supplier relationships | Supply chain security | Component supply chain security | Chapter 10 |
| Third Party Security | A.5.20 Security in supplier agreements | Supplier risk | Third-party risk control | 10.2 |
| Open Source Dependencies | A.8.9 Configuration management | Supply chain risk | Component risk monitoring | 10.3 |
| Data Protection | A.5.34 Privacy protection | Data protection obligations | Personal data protection | Chapter 11 |
| Data Classification | A.5.12 Classification of information | Information protection | Data security classification | 11.1 |
| Data Retention | A.5.33 Protection of records | Data governance | Secure data lifecycle | 11.2 |
| Data Subject Rights | GDPR support | Personal data protection | Privacy compliance | 11.3 |
| Security Awareness | A.6.3 Security awareness training | Human risk mitigation | Security awareness | 12.2 |
| Employee Offboarding | A.5.18 Access rights | Access lifecycle management | Secure staff transitions | 12.3 |
| Internal Audit | A.5.36 Compliance with policies | Security audits | Security evaluation | 14.2 |
| Management Review | A.5.35 Independent review | Governance oversight | Security governance | 14.3 |
| Continuous Improvement | A.10 Improvement | Continuous improvement | Lifecycle improvement | Chapter 15 |
| Tool Access Governance | A.5.15 Access control | System security | Access governance | 16.3 |