STATEMENT OF APPLICABILITY - 2025 (1).xlsx

	A	B	C	D	E	F	G	H	I	J	K	L	M	N	O	P
1
2	Statement of Applicability															Current as of: 05/09/2025
3	Legend (for Selected Controls and Reasons for controls selection)															Version 1 05/09/2025
4	LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessment, TSE: to some extent
5							Information Security Attribute (s)
6	ISO 27001 Controls				Current Controls	Remarks (Justification for exclusion)	Control Type	Informatiom Security Properties	Cybersceurity Concepts	Operational Capabiliities	Security Domains	Selected Controls and Reasons for selection				Remarks (Overview of implementation)
7	ISO 27001 Controls				Current Controls	Remarks (Justification for exclusion)	Control Type	Informatiom Security Properties	Cybersceurity Concepts	Operational Capabiliities	Security Domains	LR	CO	BR/BP	RRA	Remarks (Overview of implementation)
8	Clause	Sec	Control	Objective/Control
9		A.5	Organisational Controls
10		5.10	Policies for information security	Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.	Information Security Policy and supporting topic-specific policies in place		preventive	confidentiality, integrity, availability	identify	governance	defence, governance and ecosystem, resilience	P	P	P		Patronus maintains a single Information Security Policy, approved by both directors and supported by concise procedures (e.g. access, incidents, data handling). The policy is stored in Activ, version-controlled, and will be reviewed annually or after significant change. All future staff and contractors to confirm understanding at onboarding; relevant sections will be shared with partners and clients where appropriate.
11		5.20	Information security roles and responsibilities	Information security roles and responsibilities shall be defined and allocated according to the organization needs.	Roles and Responsibilities Register in place		preventive	confidentiality, integrity, availability	identify	governance	governance and ecosystem, resilience	P	P	P		Information security responsibilities are defined within Patronus’ Roles and Responsibilities Register. Both directors share accountability, with clear allocation of operational tasks (e.g. access control, incident handling). Roles are reviewed annually or when responsibilities change. In the Active system: Manager= KR + MC, Editor= KR, Read-only= MC.
12		5.30	Segregation of duties	Conflicting duties and conflicting areas of responsibility shall be segregated.	Roles and Responsibilities Register in place		preventive	confidentiality, integrity, availability	protect,	governance, identity and access management,	governance and ecosystem,	P	P	P		Given Patronus’ small size, both directors share responsibilities but apply peer review for key activities (e.g. system access changes, policy updates). This ensures no single person has unchecked control over critical information security processes.
13		5.40	Management responsibilities	Management shall require all personnel to apply information security in accordance with the established information security policy, topic-specific policies and procedures of the organization.	Communication Register in place Internal Audit plans in place and audit carried out		preventive	confidentiality, integrity, availability	identify	governance	governance and ecosystem,	P	P	P		Both directors actively support and enforce information security by approving policies, ensuring resources are in place, and monitoring compliance. Responsibilities are documented in the Roles and Responsibilities Register, and reviewed annually. Communication Register, Internal Audit Plan and Report form are also relevant.
14		5.50	Contact with authorities	The organization shall establish and maintain contact with relevant authorities.	Threat Intelligence Policy in place Relevant Authorities Register in place		preventive, corrective	confidentiality, integrity, availability	identify, protect, respond, recover	governance	defence, resilience	P		P		Patronus maintains up-to-date contact details for relevant authorities in the Relevan Authority Register on Google Drive (e.g. ICO, law enforcement) to enable timely reporting and cooperation if required. Both directors are responsible for maintaining and using these contacts.
15		5.60	Contact with special interest groups	The organization shall establish and maintain contact with special interest groups or other specialist security forums and professional associations.	Both directors endevour to maintain contact with special interest groups, receive newsletters and attend events.		preventive	integrity	protect,	governance	defence, resilience			P		Patronus maintains awareness of information security developments through professional networks, ISO resources, and safeguarding sector groups. This supports continual improvement and alignment with best practice.
16		5.70	Threat intelligence	Information relating to information security threats shall be collected and analysed to produce threat intelligence.	Threat Intelligence policy in place Improvement Procedure and Log in place		preventive, detective, corrective	confidentiality, integrity, availability	identify, detect, respond	threat and vulnerability management	defence, resilience			P	P	Patronus monitors relevant cyber threat intelligence through trusted sources (e.g. OWasp, ICO, sector updates). Directors will review and act on updates to strengthen controls which sits within Improvement Procedure and Improvement Log and will keep clients informed where appropriate.
17		5.80	Information security in project management	Information security shall be integrated into project management.	Project documentation and reports include security and risk section Information Security Chanve Management Register in place		preventive,	confidentiality, integrity, availability	identify, protect	governance	governance and ecosystem, protection		P	P	P	Information security is considered in all Patronus projects, including software development and consultancy. Risks are assessed at the outset, with directors ensuring controls are built into delivery. This can be found in Project Documentation on Google Drive.
18		5.90	Inventory of information and other associated assets	An inventory of information and other associated assets, including owners, shall be developed and maintained.	Equipment and Asset registers in place		preventive	confidentiality, integrity, availability	identify	asset management	governance and ecosystem protection			P	P	Manage and maintain a full configuration management database of assets. Accountability maintained within asset register in Google Drive.
19		5.10	Acceptable use of information and other associated assets	Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.	Acceptible use of Assets policy in place Mobile Devices Policy in place		preventive	confidentiality, integrity, availability	protect	asset management continuity, information protection	governance and ecosystem, protection		P	P	P	Patronus maintains an inventory of key information assets, systems, and devices in Equipment and Maintenece Register as well as Physical Asset Register. The inventory is reviewed annually and updated when assets are added or removed. Software Functionality Test happens automatically on every change.
20		5.11	Return of assets	Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.	Acceptible use of Assets policy in place		preventive	confidentiality, integrity, availability	protect	asset management	protection		P	P	P	Patronus defines acceptable use of systems, devices, and data in the Acceptable Use of Assests Policy. All staff and contractors will confirm understanding at onboarding, with compliance monitored by directors. The Leaver Checklist will support with appropriate off boarding.
21		5.12	Classification of information	Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability and relevant interested party requirements.	Information Classification and Labelling Policy in place		preventive	confidentiality, integrity, availability	identify	information protection	defence, governance and ecosystem, protection, resilience	P	P	P	P	Patronus requires all equipment, accounts, and data to be returned or revoked when staff or contractors leave. Directors will oversee recovery and confirm completion via the offboarding register.
22		5.13	Labelling of information	An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.	Information Classification and Labelling Policy in place		preventive	confidentiality, integrity, availability	protect	information protection	protection	P	P	P	P	Classification rules are set out in the Control of Documented Information Procedure. They ensure information assets are classified consistently, considering value, criticality, legal requirements, and sensitivity. The rules are designed to be practical for future staff, directors, and third parties handling Patronus information.
23		5.14	Information transfer	Information transfer rules, procedures, or agreements shall be in place for all types of transfer facilities within the organization and between the organization and other parties.	Control of Documented Information Procedure in Place		preventive	confidentiality, integrity, availability	protect	asset management, information protection	protection			P		Where required, information is labelled according to the classification rules in the Control of Documented Information Procedure. Labels are applied in a practical way so future staff and third parties can handle assets consistently however, currently we keep all files and documents to 'Highly Confidential' Standard with access being restricted to Directors only, protected by LastPass and encrypted secrets vault for production credentials.
24		5.15	Access control	Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.	Access control policy Information Security Policy in place		preventive	confidentiality, integrity, availability	protect	identity and access management	protection		P	P		Access to systems and data is granted on a need-to-know basis by the directors. Accounts will reviewed regularly, and access is revoked immediately when no longer required as per Leaver checklist and checked against the Systems Access Control Register.
25		5.16	Identity management	The full life cycle of identities shall be managed.	Access control policy in place		preventive	confidentiality, integrity, availability	protect	identity and access management	protection		P	P	P	Patronus manages user identities through unique accounts for all staff and contractors. Directors approve account creation, changes, and removal to ensure only authorised users have access.
26		5.17	Authentication information	Allocation and management of authentication information shall be controlled by a management process, including advising personnel on appropriate handling of authentication information.	Access control policy in place Acceptable Use Policy in place		preventive	confidentiality, integrity, availability	protect	identity and access management	protection			P		Patronus protects authentication information through strong password requirements and multi-factor authentication on key systems such as LastPass. Passwords are never shared, and reset processes are controlled by directors.
27		5.18	Access rights	Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control.	Access control policy in place		preventive	confidentiality, integrity, availability	protect	identity and access management	protection	P	P			User access rights will be approved and reviewed by the directors to ensure alignment with role requirements. Access will be promptly adjusted or removed when responsibilities change or users leave as per Leaver Checklist.
28		5.19	Information security in supplier relationships	Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of supplier’s products or services.	Register of externally provided products, processes and services in place Supplier Policy in place Approved Supplier list in place Register of Provider SLAs in place		preventive	confidentiality, integrity, availability	identify	supplier relationships security	defence, governance and ecosystem, protection, resilience			P		Patronus evaluates suppliers for information security and data protection requirements before engagement. Ongoing relationships will be reviewed periodically to ensure suppliers continue to meet agreed standards.
29		5.20	Addressing information security within supplier agreements	Relevant information security requirements shall be established and agreed with each supplier based on the type of supplier relationship.	Register of externally provided products, processes and services in place Supplier Policy in place Approved Supplier list in place Register of Provider SLAs in place		preventive	confidentiality, integrity, availability	identify	supplier relationships security	governance and ecosystem, protection			P		'All required information security requirements is contained in the contract / SLA and be understood by all parties. Additionally other staff involved in this project should be given a basic understanding of the main terms.
30		5.21	Managing information security in the information and communication technology (ICT) supply chain	Processes and procedures shall be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.	Register of externally provided products, processes and services in place Supplier Policy in place Approved Supplier list in place Register of Provider SLAs in place		preventive	confidentiality, integrity, availability	identify	supplier relationships security	governance and ecosystem, protection			P		Patronus assesses ICT suppliers for security controls, data protection, and reliability. Directors will monitor supplier performance and ensure risks in the supply chain are identified and managed.
31		5.22	Monitoring, review and change management of supplier services	The organization shall regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.	Register of externally provided products, processes and services in place Supplier Policy in place Approved Supplier list in place Register of Provider SLAs in place		preventive	confidentiality, integrity, availability	identify	supplier relationships security	defence, governance and ecosystem, protection, resilience Information Security Assurance			P		Supplier services are monitored by the directors to confirm security requirements are met. Reviews take place at renewal or when significant changes occur, with actions tracked as needed.
32		5.23	Information security for use of cloud services	Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements.	Register of externally provided products, processes and services in place Supplier Policy in place Approved Supplier list in place Register of Provider SLAs in place		preventive	confidentiality, integrity, availability	protect	supplier relationships security	governance and ecosystem, protection			P		Patronus uses cloud-based services with built-in resilience and backup to maintain operations during disruption. Directors will review continuity measures annually and test recovery arrangements where practical.
33		5.24	Information security incident management planning and preparation	The organization shall plan and prepare for managing information security incidents by defining, establishing and communicating information security incident management processes, roles and responsibilities.	Security Incident Procedure and Security Incident Log in place		preventive	confidentiality, integrity, availability	respond recover	governance, information security event management	defence			P		Patronus manages incidents through the Security Incident Procedure and maintains a Security Incident Log. Both directors are responsible for recording, investigating, and resolving incidents, with outcomes used to improve controls.
34		5.25	Assessment and decision on information security events	The organization shall assess information security events and decide if they are to be categorized as information security incidents.	Security Incident Procedure and Security Incident Log in place		detective	confidentiality, integrity, availability	detect, respond	information security event management	defence			P		All information security events are reviewed by the directors under the Security Incident Procedure. Events are assessed for impact and likelihood, with a decision recorded in the Security Incident Log on whether they qualify as incidents.
35		5.26	Response to information security incidents	Information security incidents shall be responded to in accordance with the documented procedures.	Security Incident Procedure and Security Incident Log in place		corrective	confidentiality, integrity, availability	respond, recover	information security event management	defence			P		When incidents occur, Patronus will follow the Security Incident Procedure to contain, investigate, and resolve them. Alerting software will send automated emails to the Tech Lead and Information Security Manager, who assign incidents based on priority and severity. Actions and outcomes will be recorded in the Security Incident Log and reviewed to prevent recurrence.
36		5.27	Learning from information security incidents	Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls.	Security Incident Procedure and Security Incident Log in place		preventive	confidentiality, integrity, availability	identify, protect	information security event management	defence			P		Patronus will review all incidents recorded in the Security Incident Log to capture lessons learned. Directors will ensure corrective actions are implemented and improvements are fed back into policies, controls, and (future) staff awareness.
37		5.28	Collection of evidence	The organization shall establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.	Security Incident Procedure and Security Incident Log in place		corrective	confidentiality, integrity, availability	detect, respond	information security event management	defence			P		Patronus follows the Security Incident Procedure to collect and preserve evidence in a way that supports potential legal or disciplinary action. The Tech Lead and Information Security Manager ensure integrity and proper documentation in Google Drive with appropriate controls depending on the label of the data.
38		5.29	Information security during disruption	The organization shall plan how to maintain information security at an appropriate level during disruption.	Business Continuity and handover plan in place		preventive, corrective	confidentiality, integrity, availability	protect, respond	continuity	protection, resilience		P	P	P	Patronus will maintain security controls during business disruptions by using resilient cloud services (AWS and Heroku) and predefined business continuity procedures as well as business impact analysis. Directors will ensure access, data protection, and monitoring remain in place throughout any disruption.
39		5.30	ICT readiness for business continuity	ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements.	Business Continuity and handover plan in place Recovery time objective (RTO) Business impact analysis (BIA)		corrective	availability	respond	continuity	protection, resilience		P	P	P	BIA and BAU plans in full operation which deail how the business will respond in the event of operational disruption. Business needs and expectations are detailed with regular testing in place to ensure the plan's continued fitness for purpose.
40		5.31	Legal, statutory, regulatory and contractual requirements	Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.	Information security legal obligations Register in place		preventive	confidentiality, integrity, availability	identify	legal and compliance	governance and ecosystem, protection	P	P	P	P	Patronus maintains a register of applicable legal, regulatory, and contractual obligations (e.g. UK GDPR, Data Protection Act 2018) in Information Security Obligations document. Directors will review compliance annually and when regulations or contracts change.
41		5.32	Intellectual property rights	The organization shall implement appropriate procedures to protect intellectual property rights.	Use of Intellectual Property Policy in place NDA templates in place		preventive	confidentiality, integrity, availability	identify	legal and compliance	governance and ecosystem, protection	P	P	P	P	Patronus respects and protects intellectual property by using properly licensed software and content. Directors will ensure that future staff and contractors follow Use of Intellectual Property Policy, with checks included in supplier and project reviews. NDA documents available when required.
42		5.33	Protection of records	Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release.	Control of Documented Information Procedure in place		preventive	confidentiality, integrity, availability	identify protect	asset management, identity and access management, information protection, legal and compliance	defence	P	P	P	P	Patronus protects records through secure cloud storage with access controls and backups. Retention and disposal will follow legal, regulatory, and contractual requirements, overseen by the directors outlined in Control of Documented Information Procedure.
43		5.34	Privacy and protection of personal identifiable information (PII)	The organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.	Protection of Personal Information Policy in place		preventive	confidentiality, integrity, availability	identify protect	information protection, legal and compliance	protection	P	P	P		Patronus complies with UK GDPR and the Data Protection Act 2018. Personal data is processed lawfully and securely, with access limited to authorised users. Data protection is built into policies, procedures, and system design. Patronus is registered with the ICO
44		5.35	Independent review of information security	The organization’s approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.	Internal Audit Plan and Form in place Management Review Record in place ISMS in place for ISO 270001		preventive, corrective	confidentiality, integrity, availability	identify protect	information security assurance	governance and ecosystem,	P	P	P		Patronus’ ISMS is independently reviewed at planned intervals by the British Assessment Bureau as part of ISO 27001 certification. This provides assurance that policies and controls remain effective.
45		5.36	Compliance with policies, rules and standards for information security	Compliance with the organization’s information security policy, topic-specific policies, rules and standards shall be regularly reviewed.	Internal Audit Plan and Form in place		preventive	confidentiality, integrity, availability	identify protect	information security assurance, legal and compliance	governance and ecosystem,	P	P	P		Patronus will monitor compliance with its information security policies and procedures through internal checks by directors. Non-compliance is logged, investigated, and addressed through corrective actions as per Internal Audit Report Form and Management Review Record.
46		5.37	Documented operating procedures	Operating procedures for information processing facilities shall be documented and made available to personnel who need them.	Operational Controls Policy		preventive, corrective	confidentiality, integrity, availability	protect, recover	Asset management Physical security System and network security Application security Secure configuration identity and access management threat and vulnerability management Continuity Information security event management	defence, governance and ecosystem, protection			P		Patronus maintains documented procedures (e.g. Security Incident Procedure, Control of Documented Information) to guide consistent operations. Procedures are version-controlled, reviewed annually, and will be accessible to future staff and contractors.
47		6.00	People Controls
48		6.1	Screening	Background verification checks on all candidates to become personnel shall be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.	Screening Policy in place		Preventive	Confidentiality, Integrity	Identify, Protect	Governance, Legal & Compliance	Governance & Ecosystem, Protection	P	P	P	P	All staff and contractors engaged by Patronus will undergo appropriate background checks (e.g. employment references, right-to-work, and where relevant, safeguarding checks). Screening is proportionate to role and responsibility.
49		6.2	Terms and conditions of employment	The employment contractual agreements shall state the personnel’s and the organization’s responsibilities for information security.	Terms and conditions of employment in place		Preventive	Confidentiality, Integrity	Identify, Protect	Governance, Legal & Compliance	Governance & Ecosystem, Protection	P	P	P	P	Patronus will include information security responsibilities in staff and contractor agreements. Contracts reference confidentiality, data protection, and compliance with Patronus’ policies and procedures.
50		6.3	Information security awareness, education and training	Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies and procedures, as relevant for their job function.	Relevant training complete as outlined in competency proof		Preventive, Detective	Confidentiality, Integrity, Availability	Identify, Protect	Governance, Human Resource Security	Governance & Ecosystem, Resilience	P	P	P	P	All staff and contractors will receive induction training on Patronus’ information security policies and procedures. Awareness will be refreshed annually, and updates will be provided when significant changes occur.
51		6.4	Disciplinary process	A disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.	Information Security Disciplinary Policy in place		Corrective	Confidentiality, Integrity	Respond	Governance, Legal & Compliance	Governance & Ecosystem, Resilience	P	P	P	P	Patronus has a documented disciplinary procedure that applies to breaches of information security policies. Directors investigate incidents, and actions may include retraining, formal warning, or termination, depending on severity.
52		6.5	Responsibilities after termination or change of employment	Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, enforced and communicated to relevant personnel and other interested parties.	Offboarding Register in place		Preventive, Corrective	Confidentiality, Integrity	Protect	Identity & Access Management, Governance	Governance & Ecosystem, Protection	P	P	P	P	On termination or role change, Patronus will follow a Leaver Checklist to ensure access rights are revoked, all assets are returned, and confidentiality obligations remain in force. Directors oversee and confirm completion and complete the Systems Access Control Register.
53		6.6	Confidentiality or non-disclosure agreements	Confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information shall be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.	NDA template in place		Preventive	Confidentiality	Identify, Protect	Legal & Compliance, Supplier Relationship Security	Governance & Ecosystem, Protection	P	P	P	P	All Patronus future staff and contractors will sign confidentiality or non-disclosure agreements as part of their contracts. These obligations remain in force after engagement ends.
54		6.7	Remote working	Security measures shall be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization’s premises.	Remote Working Policy in place		Preventive	Confidentiality, Integrity, Availability	Identify, Protect	Continuity, Asset Management	Protection, Resilience	P	P	P	P	Patronus supports remote working through secure cloud services, MFA, and encrypted devices. Future staff and contractors will follow the Remote Working Procedure, which sets out requirements for secure access, storage, and communication.
55		6.8	Information security event reporting	The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.	Security Incident Procedure and Security Incident Log in place Improvement Procedure and Improvement Log in place		Detective	Confidentiality, Integrity, Availability	Detect, Respond	Incident Management, Governance	Defence, Governance & Ecosystem	P	P	P	P	Patronus maintains a clear process for reporting actual or suspected information security events. Future staff and contractors are required to report events immediately via the Security Incident Procedure, which directs them to notify the Tech Lead or Information Security Manager without delay.
56		A.7	Physical Controls
57		7.1	Physical security perimeters	Security perimeters shall be defined and used to protect areas that contain information and other associated assets.		We are a remote first organisation with no physical office space										EXCLUDED
58		7.2	Physical entry	Secure areas shall be protected by appropriate entry controls and access points.		We are a remote first organisation with no physical office space										EXCLUDED
59		7.3	Securing offices, rooms and facilities	Physical security for offices, rooms and facilities shall be designed and implemented.		We are a remote first organisation with no physical office space										EXCLUDED
60		7.4	Physical security monitoring	Premises shall be continuously monitored for unauthorized physical access.		We are a remote first organisation with no physical office space										EXCLUDED
61		7.5	Protecting against physical and environmental threats	Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.	Approved Supplier list in place provides due dilligence against environmental threats		Preventive	Availability, Integrity	Identify, Protect	Continuity, Physical Security	Protection, Resilience	P	P	P	P	Risks are managed via provider SLAs, insurance, and disaster recovery planning.
62		7.6	Working in secure areas	Security measures for working in secure areas shall be designed and implemented.		We are a remote first organisation with no physical office space										EXCLUDED
63		7.7	Clear desk and clear screen	Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.	Clear Desk and Clear Screen Policy in place		Preventive	Confidentiality	Protect	Governance, Information Protection	Protection	P	P	P	P	Patronus enforces a clear desk and clear screen approach to reduce the risk of unauthorised access. Staff must lock screens when unattended, store papers and removable media securely, and avoid leaving sensitive information exposed.
64		7.8	Equipment siting and protection	Equipment shall be sited securely and protected.		We are a remote first organisation with no physical office space										EXCLUDED
65		7.9	Security of assets off-premises	Off-site assets shall be protected.	Remote Working Policy in place		Preventive	Confidentiality, Integrity	Identify, Protect	Asset Management, Continuity	Protection	P	P	P	P	Patronus uses secure, provider-managed facilities for cloud services where physical entry is controlled by the supplier.
66		7.10	Storage media	Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements.	Control of Documented Information Procedure in place Information Classification, Labelling, and Handling Policy in place		Preventive	Confidentiality, Integrity	Protect	Asset Management, Information Protection	Protection	P	P	P	P	Patronus limits the use of removable media. Where used, data must be encrypted, access controlled, and securely erased before reuse or disposal. Cloud storage is the default for data handling.
67		7.11	Supporting utilities	Information processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities.		We are a remote first organisation with no physical office space										EXCLUDED
68		7.12	Cabling security	Cables carrying power, data or supporting information services shall be protected from interception, interference or damage.		We are a remote first organisation with no physical office space										EXCLUDED
69		7.13	Equipment maintenance	Equipment shall be maintained correctly to ensure availability, integrity and confidentiality of information.	Asset Register in place		Preventive	Availability, Integrity	Protect	Maintenance, Asset Management	Protection	P	P	P	P	Patronus ensures laptops and other equipment are maintained with regular software updates, patching, and hardware servicing where needed. Cloud service providers are responsible for maintaining hosted infrastructure.
70		7.14	Secure disposal or re-use of equipment	Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.	Acceptable Use of Assets Policy in place		Corrective	Confidentiality, Integrity	Protect	Asset Management, Information Protection	Protection	P	P	P	P	Patronus will securely wipe all devices before re-use or disposal. Where external disposal services are used, certificates of destruction will be obtained and retained.
71		A.8	Technological Controls
72		8.1	User end point devices	Information stored on, processed by or accessible via user end point devices shall be protected.	Acceptable Use of Assets Policy in place Access Control Policy in place Mobile Devices Policy in place Protection from Malware Policy in place		Preventive	Confidentiality, Integrity, Availability	Identify, Protect	Asset Management, Information Protection	Protection	P	P	P	P	Patronus manages laptops and mobile devices through encryption, strong authentication, and regular updates. Future staff will follow the Protection from Malware Policy and Acceptable Use Procedures to ensure secure handling and storage.
73		8.2	Privileged access rights	The allocation and use of privileged access rights shall be restricted and managed.	Access Control Policy in Place Systems Access Control Register in place		Preventive, Detective	Confidentiality, Integrity	Identify, Protect	Identity & Access Management, Governance	Governance & Ecosystem, Protection	P	P	P	P	Privileged access is restricted to directors. Such rights are granted only when necessary, logged, and reviewed regularly to prevent misuse.
74		8.3	Information access restriction	Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.	Access Control Policy in Place Systems Access Control Register in place		Preventive	Confidentiality, Integrity	Identify, Protect	Identity & Access Management, Governance	Protection	P	P	P	P	Access to information is limited based on role and need-to-know. Directors will ensure permissions are applied in line with the Information Security Policy and reviewed regularly.
75		8.4	Access to source code	Read and write access to source code, development tools and software libraries shall be appropriately managed.	Access Control Policy in Place Systems Access Control Register in place		Preventive	Confidentiality, Integrity	Identify, Protect	Secure Development, Version Control	Protection	P	P	P	P	Access to Patronus source code will be restricted to authorised developers. Version control systems will enforce authentication and logging, and changes will be peer-reviewed to maintain integrity. (When company grows)
76		8.5	Secure authentication	Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.	Access Control Policy in Place Systems Access Control Register in place		Preventive	Confidentiality, Integrity	Identify, Protect	Identity & Access Management	Protection	P	P	P	P	Patronus enforces secure authentication using strong passwords and multi-factor authentication on critical systems. Authentication methods will be reviewed periodically to align with best practice.
77		8.6	Capacity management	The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.	Cloud Scaling Policy in place		Preventive	Availability	Identify, Protect	Continuity, Resource Planning	Resilience	P	P	P	P	Patronus monitors usage of cloud services and systems to ensure sufficient capacity and performance. Providers’ built-in monitoring and scaling features are relied upon, with directors reviewing as needed.
78		8.7	Protection against malware	Protection against malware shall be implemented and supported by appropriate user awareness.	Protection from Malware policy in place		Preventive, Detective	Confidentiality, Integrity, Availability	Identify, Protect, Detect	Endpoint Security, Threat Management	Defence, Protection	P	P	P	P	Patronus relies on built-in operating system protections and automatic updates to reduce malware risk. Directors and future staff will receive simple guidance during induction on recognising and reporting suspicious activity.
79		8.8	Management of technical vulnerabilities	Information about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.	Protection from Malware policy in place Secure Software Development Lifecycle in place		Preventive, Corrective	Confidentiality, Integrity, Availability	Identify, Protect	Threat & Vulnerability Management	Defence, Resilience	P	P	P	P	Vulnerability scans scheduled weekly; automated penetration testing performed monthly; tickets tracked in Github.
80		8.9	Configuration management	Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.	Configuration Management Policy in place		Preventive	Confidentiality, Integrity, Availability	Identify, Protect	Asset Management, Configuration Management	Protection, Governance	P	P	P	P	Patronus keeps device and system configurations simple and secure by using standard operating system settings and updates. Changes are limited and overseen by the directors.
81		8.10	Information deletion	Information stored in information systems, devices or in any other storage media shall be deleted when no longer required.	Control of Documented Information Procedure in place Information Deletion Register in place Acceptable use of Assets Policy in place		Corrective	Confidentiality, Integrity	Protect	Data Lifecycle Management	Protection	P	P	P	P	Patronus deletes information securely when no longer required. Directors ensure deletion follows legal and contractual requirements and tracked in the information deletion register.
82		8.11	Data masking	Data masking shall be used in accordance with the organization’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.	Access Control Policy in Place Systems Access Control Register in place		Preventive	Confidentiality	Protect	Information Protection	Protection	P	P	P	P	Production data does not leave the production environment and tools are provided for generating randomised test data,
83		8.12	Data leakage prevention	Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information.	Information Classification, Labelling, and Handling Policy in place		Preventive, Detective	Confidentiality	Detect, Protect	Threat Management, Data Loss Prevention	Protection, Defence	P	P	P	P	Patronus does not routinely process sensitive production data outside secure systems. Where test or demo data is needed, anonymised or dummy data is used instead of live personal data.
84		8.13	Information backup	Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.	Backup policy in place Business Continuity plan in place Periodic restoration tests in place		Preventive	Availability, Integrity	Protect	Continuity, Backup & Recovery	Resilience	P	P	P	P	Backups stored in multiple AWS regions; restoration tests logged.
85		8.14	Redundancy of information processing facilities	Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.	Business Continuity plan in place Business Impact Analysis in place		Preventive	Availability	Protect	Continuity	Resilience	P	P	P	P	Provider SLA reviewed annually; redundancy tested during DR exercises.
86		8.15	Logging	Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed.	Coralogix and centralized SIEM store encrypted, immutable logs.		Detective	Confidentiality, Integrity	Detect	Threat Detection, Governance	Defence, Governance	P	P	P	P	Logs retained for 12 months; alerts configured for critical events.
87		8.16	Monitoring activities	Networks, systems and applications shall be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.	SIEM monitors networks and applications; alerts trigger incident response workflows.		Detective	Confidentiality, Integrity, Availability	Detect, Respond	Threat Monitoring	Defence	P	P	P	P	Alerts reviewed daily; escalation handled by ISM.
88		8.17	Clock synchronization	The clocks of information processing systems used by the organization shall be synchronized to approved time sources.	Heroku automatically synchronise with trusted NTP servers. Logs include timestamps from these time sources.		Preventive	Integrity	Protect	Configuration Management	Governance & Ecosystem	P	P	P	P	NTP configuration handled by Heroku- cloud service provider.
89		8.18	Use of privileged utility programs	The use of utility programs that can be capable of overriding system and application controls shall be restricted and tightly controlled.	Access Control Policy in Place Systems Access Control Register in place		Preventive, Detective	Confidentiality, Integrity	Identify, Protect	Identity & Access Management	Governance & Ecosystem, Protection	P	P	P	P	Patronus restricts the use of administrative tools and utility programs to authorised personnel only. Access is limited to the directors for now. Admin account separate from day to day use is used for administrative changes to google suite.
90		8.19	Installation of software on operational systems	Procedures and measures shall be implemented to securely manage software installation on operational systems.	Use of Software Policy in place		Preventive	Integrity, Availability	Protect	Asset Management	Protection	P	P	P	P	Patronus restricts software installation on laptops and systems to the directors. Only approved, licensed software is used to reduce security and compliance risks.
91		8.20	Networks security	Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.		Fully remote, no network in place.										EXCLUDED
92		8.21	Security of network services	Security mechanisms, service levels and service requirements of network services shall be identified, implemented and monitored.		Fully remote, no network in place.										EXCLUDED
93		8.22	Segregation of networks	Groups of information services, users and information systems shall be segregated in the organization’s networks.		Fully remote, no network in place.										EXCLUDED
94		8.23	Web filtering	Access to external websites shall be managed to reduce exposure to malicious content.	Protection from Malware Policy in place		Preventive	Confidentiality, Integrity	Protect	Threat Prevention	Defence	P	P	P	P	Cyber security training will be provided for appropriate staff renewed annually
95		8.24	Use of cryptography	Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.	Cryptographic Controls Policy in place		Preventive	Confidentiality, Integrity	Protect	Cryptographic Management	Protection	P	P	P	P	Cryptographic policies reviewed annually; compliance confirmed during audits.
96		8.25	Secure development life cycle	Rules for the secure development of software and systems shall be established and applied.	SSDLC in place Information Security Change Management Procedure and Change Management Register in place Project Documentation template in place		Preventive	Confidentiality, Integrity	Identify, Protect	Application Security, Development Security	Protection	P	P	P	P	Developers receive annual secure coding training; SDLC documented and reviewed.
97		8.26	Application security requirements	Information security requirements shall be identified, specified and approved when developing or acquiring applications.	SSDLC in place Information Security Change Management Procedure and Change Management Register in place Project Documentation template in place		Preventive	Confidentiality, Integrity	Identify, Protect	Application Security	Protection	P	P	P	P	The Project Documentation template will be used prior to kicking off any project, in order to ensure that any risks, data security considerations and timelines are taken into account early and throughout
98		8.27	Secure system architecture and engineering principles	Principles for engineering secure systems shall be established, documented, maintained and applied to any information system development activities.	SSDLC in place Information Security Change Management Procedure and Change Management Register in place Project Documentation template in place		Preventive	Confidentiality, Integrity	Identify, Protect	Architecture & Engineering	Protection, Governance	P	P	P	P	Patronus designs its software using simple, secure architectures with cloud hosting, encryption, and role-based access. Security principles are considered in development and reviewed by the Tech Lead during changes.
99		8.28	Secure coding	Secure coding principles shall be applied to software development.	SSDLC in place Information Security Change Management Procedure and Change Management Register in place Project Documentation template in place		Preventive	Confidentiality, Integrity	Protect	Secure Development	Protection	P	P	P	P	Patronus follows basic secure coding practices, including peer review, use of version control, and dependency management. The Tech Lead reviews changes to reduce vulnerabilities before release.
100		8.29	Security testing in development and acceptance	Security testing processes shall be defined and implemented in the development life cycle.	SSDLC in place Information Security Change Management Procedure and Change Management Register in place Project Documentation template in place		Detective	Confidentiality, Integrity	Detect	Application Security Testing	Defence	P	P	P	P	Patronus carries out basic security testing during development and before release, including code review, static analysis and dependency checks. Directors confirm acceptance criteria include security considerations.