> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Statement of Applicability
> ISO 27001:2022 Annex A control mapping — which controls apply to Denialbase, which are implemented, and where the evidence lives.
The Statement of Applicability (SoA) is a required ISO 27001 document that lists every Annex A control, states whether it applies to our ISMS, records the implementation status, and points to the evidence. This page is the public summary; the full SoA (with sensitive evidence paths) is available under NDA.
**Last reviewed**: April 2026 · **Version**: 0.9 (draft, targeted GA Q2 2026) · **Owner**: Security Officer
## Scope of the ISMS
The Denialbase Information Security Management System (ISMS) covers:
* The Denialbase SaaS platform — production, staging, and development environments.
* All customer PHI and operational data processed by Denialbase.
* All Denialbase workforce members (employees, contractors, consultants).
* All subprocessors that may touch Denialbase customer data (see [Subprocessors](/trust/subprocessors)).
* Denialbase corporate systems that support the above (GitHub, GCP, Google Workspace, 1Password).
## Applicability summary
| Annex A clause | Title | Applicable | Implemented | Evidence |
| --------------------------------------------- | ------------------------------------------------------------- | ---------- | ----------- | ------------------------------------------------------------------------------------------------- |
| **5 — Organizational controls (37 controls)** | | | | |
| A.5.1 | Policies for information security | ✅ | Partial | [ISP](/trust/information-security-policy) — draft Q2 2026 |
| A.5.2 | Information security roles & responsibilities | ✅ | Partial | [ISP — roles](/trust/information-security-policy#roles) |
| A.5.3 | Segregation of duties | ✅ | Yes | [Change management](/trust/change-management#segregation-of-duties) |
| A.5.4 | Management responsibilities | ✅ | Partial | [Management review](/trust/management-review) — program starting Q2 2026 |
| A.5.5 | Contact with authorities | ✅ | Partial | [Incident response](/trust/incident-response) |
| A.5.6 | Contact with special interest groups | ✅ | Partial | Not formalized |
| A.5.7 | Threat intelligence | ✅ | Partial | Sentry, GCP Security Command Center, CVE monitoring |
| A.5.8 | Information security in project management | ✅ | Yes | [Change management](/trust/change-management), secure SDLC in CI |
| A.5.9 | Inventory of information and other associated assets | ✅ | Partial | Asset inventory — target Q2 2026 |
| A.5.10 | Acceptable use of information and other associated assets | ✅ | Partial | [AUP](/trust/acceptable-use-policy) — draft Q2 2026 |
| A.5.11 | Return of assets | ✅ | Partial | [HR security — offboarding](/trust/hr-security#offboarding) |
| A.5.12 | Classification of information | ✅ | Partial | [Data classification policy](/trust/data-classification-policy) |
| A.5.13 | Labelling of information | ✅ | Partial | [Data classification policy — labeling](/trust/data-classification-policy#labeling) |
| A.5.14 | Information transfer | ✅ | Yes | TLS in transit, PHI-scrubbed egress — see [Network security](/trust/network-security) |
| A.5.15 | Access control | ✅ | Yes | [Access control policy](/trust/access-control-policy) |
| A.5.16 | Identity management | ✅ | Yes | [Authentication](/trust/authentication) |
| A.5.17 | Authentication information | ✅ | Yes | GCP Secret Manager, no plaintext secrets — [Cryptography](/trust/cryptography-policy) |
| A.5.18 | Access rights | ✅ | Yes | Pundit RBAC + IAM + [Access control](/trust/access-control-policy) |
| A.5.19 | Information security in supplier relationships | ✅ | Partial | [Vendor management](/trust/vendor-management); BAAs in progress |
| A.5.20 | Addressing information security within supplier agreements | ✅ | Partial | Standard DPA/BAA templates — see [BAA](/trust/baa) |
| A.5.21 | Managing information security in the ICT supply chain | ✅ | Partial | Dependency scanning (Dependabot, bundler-audit, npm audit) |
| A.5.22 | Monitoring, review and change management of supplier services | ✅ | Partial | [Vendor management](/trust/vendor-management) — annual review |
| A.5.23 | Information security for use of cloud services | ✅ | Yes | GCP hardened per CIS benchmarks; private VPC; CMEK |
| A.5.24 | Information security incident management planning | ✅ | Partial | [Incident response](/trust/incident-response) — formal IRP Q2 2026 |
| A.5.25 | Assessment and decision on information security events | ✅ | Yes | Alert triage + severity matrix |
| A.5.26 | Response to information security incidents | ✅ | Partial | [IR — response phases](/trust/incident-response#response-phases) |
| A.5.27 | Learning from information security incidents | ✅ | Partial | Blameless post-mortem process |
| A.5.28 | Collection of evidence | ✅ | Yes | Audit logs with 7-year retention, immutable Cloud Logging sink |
| A.5.29 | Information security during disruption | ✅ | Partial | [DR](/trust/disaster-recovery), [BC](/trust/business-continuity) |
| A.5.30 | ICT readiness for business continuity | ✅ | Partial | Multi-region backups; first drill Q2 2026 |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | ✅ | Yes | HIPAA, state breach laws, ERISA, ACA — tracked |
| A.5.32 | Intellectual property rights | ✅ | Yes | license\_finder in CI; OSS license policy |
| A.5.33 | Protection of records | ✅ | Yes | Audit log integrity + retention |
| A.5.34 | Privacy and protection of PII | ✅ | Yes | [HIPAA](/trust/hipaa), PHI minimization, encryption |
| A.5.35 | Independent review of information security | ✅ | Partial | [Internal audit](/trust/internal-audit) program launching Q2 2026 |
| A.5.36 | Compliance with policies, rules and standards | ✅ | Partial | Being formalized as part of internal audit program |
| A.5.37 | Documented operating procedures | ✅ | Partial | Runbooks in `/docs`; being migrated to Trust Center |
| **6 — People controls (8 controls)** | | | | |
| A.6.1 | Screening | ✅ | Yes | Background checks for all production-access personnel |
| A.6.2 | Terms and conditions of employment | ✅ | Yes | Employment agreements with confidentiality clauses |
| A.6.3 | Information security awareness, education and training | ✅ | Partial | [Security awareness](/trust/security-awareness) — annual training |
| A.6.4 | Disciplinary process | ✅ | Yes | [AUP — enforcement](/trust/acceptable-use-policy#enforcement) |
| A.6.5 | Responsibilities after termination or change of employment | ✅ | Yes | [HR security — offboarding](/trust/hr-security#offboarding) |
| A.6.6 | Confidentiality or non-disclosure agreements | ✅ | Yes | NDAs required; mutual NDAs for customer conversations |
| A.6.7 | Remote working | ✅ | Yes | [AUP — remote work](/trust/acceptable-use-policy#remote-work) |
| A.6.8 | Information security event reporting | ✅ | Yes | [security@denialbase.com](mailto:security@denialbase.com); anonymized reporting channel |
| **7 — Physical controls (14 controls)** | | | | |
| A.7.1 | Physical security perimeters | ✅ | Inherited | GCP data centers — [GCP physical security](https://cloud.google.com/security/overview/whitepaper) |
| A.7.2 | Physical entry | ✅ | Inherited | GCP data centers |
| A.7.3 | Securing offices, rooms and facilities | ❌ | N/A | Fully remote — no Denialbase offices |
| A.7.4 | Physical security monitoring | ✅ | Inherited | GCP data centers |
| A.7.5 | Protecting against physical and environmental threats | ✅ | Inherited | GCP multi-region; disaster resilience |
| A.7.6 | Working in secure areas | ❌ | N/A | No physical secure areas |
| A.7.7 | Clear desk and clear screen | ✅ | Yes | [AUP — devices](/trust/acceptable-use-policy#devices) |
| A.7.8 | Equipment siting and protection | ✅ | Inherited | GCP |
| A.7.9 | Security of assets off-premises | ✅ | Yes | MDM + full-disk encryption + auto-lock |
| A.7.10 | Storage media | ✅ | Yes | [AUP — devices](/trust/acceptable-use-policy#devices) — no removable media for customer data |
| A.7.11 | Supporting utilities | ✅ | Inherited | GCP |
| A.7.12 | Cabling security | ✅ | Inherited | GCP |
| A.7.13 | Equipment maintenance | ✅ | Yes | Managed workstation patching |
| A.7.14 | Secure disposal or re-use of equipment | ✅ | Yes | Cloud asset destruction per GCP; workstation wipe on offboarding |
| **8 — Technological controls (34 controls)** | | | | |
| A.8.1 | User endpoint devices | ✅ | Yes | MDM, FDE, EDR, patching |
| A.8.2 | Privileged access rights | ✅ | Yes | [Access control](/trust/access-control-policy), just-in-time production access |
| A.8.3 | Information access restriction | ✅ | Yes | Pundit + IAM |
| A.8.4 | Access to source code | ✅ | Yes | GitHub with enforced MFA + SSO |
| A.8.5 | Secure authentication | ✅ | Yes | [Authentication](/trust/authentication) |
| A.8.6 | Capacity management | ✅ | Yes | Cloud Run autoscaling + alerting |
| A.8.7 | Protection against malware | ✅ | Yes | ClamAV on uploads; EDR on workstations |
| A.8.8 | Management of technical vulnerabilities | ✅ | Yes | [Vulnerability management](/trust/vulnerability-management) |
| A.8.9 | Configuration management | ✅ | Yes | Terraform IaC, signed commits |
| A.8.10 | Information deletion | ✅ | Yes | `User#permanently_delete!`, account/practice deletion flows |
| A.8.11 | Data masking | ✅ | Yes | PHI masking in list views; logs PHI-scrubbed |
| A.8.12 | Data leakage prevention | ✅ | Partial | No endpoint DLP; egress limited, scrubbing in place |
| A.8.13 | Information backup | ✅ | Yes | [DR — backups](/trust/disaster-recovery#backup-strategy) |
| A.8.14 | Redundancy of information processing facilities | ✅ | Yes | Cloud Run multi-zone; Cloud SQL HA |
| A.8.15 | Logging | ✅ | Yes | [Audit logging](/trust/audit-logging) |
| A.8.16 | Monitoring activities | ✅ | Yes | Cloud Monitoring + Sentry + alerting |
| A.8.17 | Clock synchronization | ✅ | Yes | GCP NTP, workstation NTP |
| A.8.18 | Use of privileged utility programs | ✅ | Partial | Break-glass logged; no broad sudo in prod |
| A.8.19 | Installation of software on operational systems | ✅ | Yes | Container images only; no ad-hoc installs |
| A.8.20 | Networks security | ✅ | Yes | [Network security](/trust/network-security) |
| A.8.21 | Security of network services | ✅ | Yes | Cloud Armor WAF; private VPC |
| A.8.22 | Segregation of networks | ✅ | Yes | VPC isolation between staging and prod |
| A.8.23 | Web filtering | ❌ | N/A | No employee web proxy (remote-first) |
| A.8.24 | Use of cryptography | ✅ | Yes | [Cryptography policy](/trust/cryptography-policy) |
| A.8.25 | Secure development life cycle | ✅ | Yes | [Change management](/trust/change-management); SAST + tests + review |
| A.8.26 | Application security requirements | ✅ | Yes | Secure SDLC, threat modeling for new features |
| A.8.27 | Secure system architecture and engineering principles | ✅ | Yes | [Security architecture](/trust/security-architecture) |
| A.8.28 | Secure coding | ✅ | Yes | Brakeman, ESLint security, Trivy, gitleaks on every commit |
| A.8.29 | Security testing in development and acceptance | ✅ | Yes | 90% backend / 80% frontend test coverage; E2E |
| A.8.30 | Outsourced development | ❌ | N/A | No outsourced development |
| A.8.31 | Separation of development, test and production environments | ✅ | Yes | Separate GCP projects; isolated data |
| A.8.32 | Change management | ✅ | Yes | [Change management policy](/trust/change-management-policy) |
| A.8.33 | Test information | ✅ | Yes | Seed data only; no prod PHI in non-prod |
| A.8.34 | Protection of information systems during audit testing | ✅ | Yes | Audit access controls; read-only audit role |
**Totals**: 93 applicable, 4 not applicable (N/A), out of 97 Annex A controls in ISO 27001:2022.
## Implementation status summary
| Status | Count | Meaning |
| ------------- | ----- | --------------------------------------------------------------------------------------- |
| **Yes** | 53 | Control is fully implemented with evidence |
| **Partial** | 32 | Control is partially implemented; gaps tracked in [Risk register](/trust/risk-register) |
| **Inherited** | 8 | Control is inherited from GCP; evidence via GCP SOC 2/ISO 27001 reports |
| **N/A** | 4 | Control doesn't apply (remote-only, no physical sites, no outsourced dev) |
## Exclusions and rationale
Denialbase is a fully remote organization with no physical offices. Workforce security relies on managed workstations, secure home networks, and [AUP — devices](/trust/acceptable-use-policy#devices).
No physical secure areas to protect — see A.7.3 above.
No corporate network with employee web traffic to filter. DNS-level filtering is considered if workforce expands.
All product development is performed by Denialbase employees. No outsourced/offshore development. If this changes, the control will be applicable and tracked.
## Review cadence
* **Monthly** — control implementation status updated by Security Officer.
* **Quarterly** — applicability reviewed with CTO for any scope changes.
* **Annually** — full SoA refresh ahead of external audit; mapped to current version of ISO 27001.
* **Ad-hoc** — any material architecture or vendor change triggers re-evaluation of affected controls.
## How to request the full SoA
The internal SoA includes owner names, ticket links, specific evidence file paths, and private supplier evaluation records. Enterprise customers may request the full document under mutual NDA: [security@denialbase.com](mailto:security@denialbase.com).