Why ISO 27001 automation still needs human judgment

ISO 27001 automation is the use of software to collect evidence, monitor controls, and run ISMS workflows continuously, replacing manual screenshots and spreadsheets with system-to-system data pulls, policy-mapped dashboards, and scheduled reviews across your cloud and SaaS estate. It gathers facts. It does not make decisions.

That distinction is where most cloud-native certification projects get into trouble. The ISO Survey counted 83,016 valid ISO/IEC 27001 certifications worldwide in 2023 across 165 countries (International Organization for Standardization). Compliance automation platforms are good. The findings still land in the same places: risk acceptance without an owner, Statement of Applicability exclusions nobody can defend, and evidence that was collected but never evaluated.

This guide maps the boundary. It covers what automation handles reliably, where a human signature is non-negotiable, how shared responsibility changed what auditors actually ask for, and which Annex A controls cloud-only teams wrongly assume they can skip.

What can ISO 27001 automation actually handle on its own?

Automation handles the mechanical layer of an ISMS: retrieving configuration state, detecting drift, mapping artifacts to controls, and routing recurring tasks to the right person. It is reliable precisely because these jobs have deterministic answers. Compliance teams have leaned in hard: 49% of respondents in a global compliance survey used technology for 11 or more compliance activities, with training, risk assessment and compliance monitoring among the most common (PwC).

Continuous evidence collection from cloud infrastructure

Integrationen mit AWS, Azure, GCP, Ihrem Identity Provider, Ihrer Code-Repository-Plattform und Ihrem HR-System erfassen aktuelle Sicherheitsinformationen direkt aus Ihren Systemen. Dazu gehören Einstellungen zur Verschlüsselung gespeicherter Daten, öffentlich zugängliche Storage-Buckets, der MFA-Aktivierungsstatus, Branch-Protection-Regeln und Zeitstempel aus dem Offboarding. Damit entfällt das manuelle Erstellen und Datieren von Screenshots vollständig. Stattdessen erhalten Sie aussagekräftigere Nachweise, deren Herkunft direkt nachvollziehbar ist. Auditoren können erkennen, wann die Daten abgerufen wurden, aus welchem Konto sie stammen und ob sich seit dem letzten Quartal etwas verändert hat.

Policy-to-control mapping and gap detection

Good tooling keeps a live link between each Annex A control, the policy that governs it, the owner, and the evidence that proves it operates. When a control has no evidence attached, or the evidence has gone stale, the gap surfaces immediately rather than three weeks before Stage 2. This is also where cross-framework reuse pays off: the same access-review export answers ISO 27001, SOC 2 and parts of your GDPR accountability file. That reuse is the clearest argument for automating ISO 27001 compliance work.

Aufgabensteuerung: Überprüfungen, Erinnerungen und automatisierte Workflow-Zuweisung

Quarterly access reviews, annual policy re-acceptance, supplier reassessments, internal audit scheduling, management review agendas: all of these are calendar-driven obligations that fail through forgetfulness, not through disagreement. Routing them automatically to named owners removes an entire category of nonconformity.

Here is the line that matters. Automation collects evidence. It does not decide whether the evidence is sufficient, whether the residual risk it reveals is acceptable, or whether a failing control warrants an exception. Those are judgments, and judgments need a person attached.

Wo bleibt menschliches Urteilsvermögen unverzichtbar?

Drei Bereiche lassen sich grundsätzlich nicht vollständig automatisieren: Risikoakzeptanz, Genehmigung von Ausnahmen und Begründungen im Statement of Applicability (SoA). Auditoren prüfen die Überlegungen hinter jeder Entscheidung und nicht nur, ob diese in einem Dashboard angezeigt wird. Auch beim sicheren Fernzugriff auf Cloud-Dienste ist die Verantwortung eindeutig: Sie liegt bei Ihrem Unternehmen. Diese Kontrolle im SoA als „nicht anwendbar“ einzustufen, lässt sich daher kaum rechtfertigen.

Risikoakzeptanz und formelle Freigabe des Restrisikos

A risk register can be populated automatically. It cannot be accepted automatically. Clause 6.1.3 expects risk owners to approve the risk treatment plan and accept the residual risk. In practice, the auditor will pick one high-scoring risk and ask who signed off, on what date, against which criteria, and what they considered. A tool that exports a risk table without capturing that deliberation leaves you answering from memory.

Genehmigung von Ausnahmen und kompensierende Kontrollen

Every cloud-native company runs exceptions. A legacy service account that cannot take a hardware key. A contractor who needs standing production access for six weeks. The exception itself is not a finding. An undocumented exception is. Each one needs a stated reason, a compensating control, an expiry date and an approver.

Die Risiken sind hier konkret. Laut Microsoft verhindert die Multifaktor-Authentifizierung (MFA) mehr als 99 % der unbefugten Zugriffsversuche. Untersuchungen des Incident-Response-Teams von Microsoft ergaben zudem, dass 28 % der Sicherheitsverletzungen durch Phishing oder Social Engineering, 18 % durch ungepatchte Webanwendungen und 12 % durch öffentlich erreichbare Remote-Dienste verursacht wurden (Microsoft). Eine Ausnahme von der MFA-Pflicht ist daher eine echte Risikoentscheidung und keine reine Formalität. Sie erfordert eine verantwortliche Person, die auch die möglichen Konsequenzen trägt.

SoA justifications: why a control applies or does not

The Statement of Applicability is where auditors concentrate, and it is a common source of avoidable findings. Marking a control not applicable is a claim about your responsibility boundary, and it has to survive questioning. "We're in the cloud" is not a justification. "We have no corporate network perimeter; remote access to production is mediated by our identity provider with conditional access and device posture checks, which is how A.6.7 and A.8.1 are satisfied" is one. The habits behind a smooth certification audit nearly always include an SoA whose justifications were written by someone who understood the architecture, not generated from a template.

Wie verändert das Shared Responsibility Model die Prüfanforderungen von Auditoren?

Shared responsibility moves the auditor's attention from infrastructure you operate to configuration you own and suppliers you depend on. Network diagrams and server-room photos have largely been replaced by config exports, IAM policy dumps and supplier review logs. The model is also no longer simple: 63% of organizations report using more than one cloud provider, and 82% maintain some form of hybrid infrastructure (Cloud Security Alliance).

Supplier assurance: certificates, SOC 2 reports, and contractual clauses

Your provider's certificate is an input to your supplier assurance process, not an output of your control effectiveness. The auditor wants to see that you obtained it, read the scope statement, checked the validity dates, reviewed the complementary user entity controls in the SOC 2 report, and recorded a decision. The same applies to every SaaS tool holding customer data.

Die meisten Unternehmen investieren in diesem Bereich zu wenig. Laut Verizon waren bei 30 % der untersuchten Sicherheitsverletzungen Drittanbieter beteiligt. Das entspricht dem Doppelten des Vorjahresanteils. Gleichzeitig entfielen 22 % der ursprünglichen Angriffsvektoren auf den Missbrauch von Zugangsdaten und 20 % auf die Ausnutzung von Schwachstellen (Verizon). Dennoch überprüften in den vergangenen 12 Monaten nur 14 % der britischen Unternehmen die Cybersicherheitsrisiken ihrer direkten Lieferanten (UK National Cyber Security Centre).

Configuration evidence versus provider-side controls

AWS schützt den Hypervisor. Für die Konfiguration Ihrer Security Groups sind Sie verantwortlich. Die typischen Schwachstellen auf Kundenseite sind gut dokumentiert: Im ersten Halbjahr 2025 waren schwache oder fehlende Zugangsdaten bei 47,1 % der Cloud-Sicherheitsvorfälle der ursprüngliche Angriffsvektor, gefolgt von Fehlkonfigurationen mit 29,4 % (Google Cloud). Beide Risiken fallen eindeutig in den Verantwortungsbereich des Kunden innerhalb des Shared Responsibility Model. Genau deshalb verlangen Auditoren zunehmend Nachweise über den aktuellen Konfigurationsstatus, statt sich auf Richtlinien zu verlassen, die lediglich die vorgesehenen Maßnahmen beschreiben.

When your cloud provider's scope ends and yours begins

Dokumentieren Sie die Verantwortlichkeiten für jeden Cloud-Anbieter und jeden genutzten Dienst. Identitäten und Berechtigungen liegen immer in Ihrer Verantwortung. Laut einer Studie der Cloud Security Alliance sehen 59 % der Unternehmen unsichere Identitäten und riskante Berechtigungen als größtes Risiko für ihre Cloud-Infrastruktur. Auch Datenklassifizierung, Verwaltung von Verschlüsselungsschlüsseln, Tests zur Wiederherstellung von Backups, Aufbewahrung von Protokolldaten und Tenant-Konfiguration gehören zu Ihren Aufgaben. Dokumentieren Sie die Aufteilung der Verantwortlichkeiten einmal zentral und verweisen Sie in allen betroffenen Einträgen des Statement of Applicability (SoA) darauf.

Welche Kontrollen schließen reine Cloud-Unternehmen fälschlicherweise aus?

Four clusters account for most wrongful exclusions: physical security, endpoint and software installation controls, supplier management for SaaS, and backup or restore testing. The reasoning error is always the same. Teams exclude a control because they do not operate the asset, when the standard asks whether they bear the risk.

Physische Sicherheitskontrollen und ihre Entsprechungen in der Cloud

If you have no office and everyone works from home, physical security of an office may genuinely fall outside scope, and an auditor will accept that. What does not fall away is physical protection of the endpoints themselves: laptop disk encryption, screen locks, clear-desk expectations in home working environments, secure disposal of returned hardware, and a documented position on home-office working conditions. Exclude the office, not the equipment.

Überwachung von Softwareinstallationen: Risikobasiert statt nach starren Vorgaben entscheiden

The usual question is whether every single utility needs approval. It does not. What ISO 27001 expects is a defined, enforced rule. For most cloud-native teams that means restricted local admin rights, an MDM baseline, an allowlist or approval path for anything touching customer data or production credentials, and periodic review of installed software inventories. Auditors want to see the rule, evidence it is enforced technically, and evidence someone checks it. They are not asking for a ledger of every screenshot tool.

Klimawandel: Die Ergänzung zu Abschnitt 4 aus dem Jahr 2024

Amendment 1:2024 requires you to determine whether climate change is a relevant issue when establishing ISMS context, and to consider whether interested parties have climate-related requirements. This is a Clause 4 context obligation, not a new Annex A control, which is why it confuses teams who look for it in the control list. For an AWS-hosted company, adequate evidence is a short, reasoned entry in your context analysis: an assessment of climate-driven availability and resilience risk in your chosen regions, a reference to your provider's published sustainability and resilience information, and your conclusion about whether multi-region architecture or additional continuity measures are warranted. Keeping that entry current is part of the broader discipline of maintaining certification between surveillance audits.

How does compliance automation software collect the evidence an ISO 27001 auditor asks for?

Über drei Mechanismen: schreibgeschützte API-Verbindungen zu Ihren Systemen, agentenbasierte Datenerfassung auf Endgeräten und manuelle Uploads für Systeme ohne API. Wenn Sie wissen, welcher Mechanismus welche Nachweise liefert, können Sie genau beurteilen, wie viel Ihrer Auditvorbereitung tatsächlich automatisiert ist.

Integrationstiefe: Datenabruf über APIs, agentenbasierte Scans und manuelle Uploads als Alternative

What matters is how deep each connection goes into your specific AWS account structure. Check what populates automatically from your real stack and what your team still uploads by hand, especially for multi-account AWS Organizations, Kubernetes workloads, and any niche tool that carries production access. Anything without an API stays a manual upload, and that list is worth knowing well before the audit.

Mapping raw evidence to specific Annex A controls

Raw evidence is useless until it is attached to a control, dated, and given an owner. Secfix, the compliance automation platform, maps a single access-review export once and reuses it across ISO 27001, SOC 2 and internal policy requirements. For teams running more than one framework, that deduplication is the difference between one evidence cycle and three.

Grenzen der Automatisierung: Interviews, Prozessbegehungen und Nachweise, die menschliches Urteilsvermögen erfordern

No integration produces a management review minute, an internal audit report with findings and root-cause analysis, a corrective action that a human closed out, or a competent answer when the auditor asks your engineering lead to walk through how a change reached production last Tuesday. Expect roughly the governance half of your audit to rest on artifacts your team writes and conversations your team has.

What should ISMS software handle for a cloud-native team?

Three capabilities matter most: how the Statement of Applicability is handled, where your evidence physically lives and which regulations it maps to, and how well decisions are supported rather than just data collection.

SoA workflow and Annex A 2022 coverage

The SoA needs to map to the 2022 revision, with all 93 Annex A controls across the four themes, and stay a living document rather than a quarterly export. Inclusion and exclusion justifications should be written by a person who understands the control rather than filled from a template, and applicability may need to vary by business unit. Secfix, the compliance automation platform, combines automated evidence collection with expert support, so the applicability decisions in your SoA stay with your team.

EU data residency and regulatory overlap (NIS 2, GDPR)

European teams rarely pursue ISO 27001 in isolation. NIS 2 obligations, GDPR accountability and, for financial entities, DORA tend to arrive on the same roadmap, and reusing one evidence base across them saves more time than any single integration. Where evidence is stored and who operates that infrastructure matters too, so EU data residency should be the default rather than an opt-in request. Secfix, the compliance automation platform built in Europe, covers NIS 2, GDPR, DORA and TISAX alongside ISO 27001 on one platform, so the same evidence base can be reused across them.

Automatisierungstiefe im Vergleich zur Unterstützung menschlicher Entscheidungen

The decisive capability is not how many controls are tested automatically but how a risk gets accepted and an exception gets approved. That requires named owners, approval chains, expiry dates on exceptions, version history on justifications, and an audit trail that records who decided what and when. Tooling that only pulls evidence leaves the hardest part on a spreadsheet, which is usually where the finding comes from. Weighing these capabilities against cost is easier with a clear view of your ISO 27001 budget across tools and consultants.

What does an AI compliance assistant actually do during ISO 27001 audit preparation?

It drafts, summarizes, classifies and flags. It reads a control requirement, inspects your attached evidence, and tells you what looks thin. Used well, it compresses weeks of reading into hours. Used badly, it produces polished prose over hollow evidence, which is the cheapest way to fail a Stage 2.

Bei der Einführung entsprechender Technologien bestehen weiterhin deutliche Lücken. Unter britischen Unternehmen nutzten in den vergangenen 12 Monaten 32 % spezielle Tools zur Sicherheitsüberwachung und 30 % führten eine Bewertung ihrer Cybersicherheitsrisiken durch. Gleichzeitig nutzten, implementierten oder erwogen 31 % den Einsatz von KI. Von diesen Unternehmen gaben jedoch nur 24 % an, über Cybersicherheitsmaßnahmen zum Umgang mit KI-bezogenen Risiken zu verfügen (Britisches Ministerium für Wissenschaft, Innovation und Technologie).

Evidence summarization and control-status dashboards

The strongest current use case is triage. An assistant can compare this quarter's artifact against last quarter's, flag drift, extract the relevant lines from a CloudTrail or IdP export, and draft a first-pass control narrative. Every one of those outputs is a starting point for review, not a finished artifact.

Automatisierte Erstellung von Risikoregistereinträgen im Vergleich zur Verantwortung für das Risikoregister

Ein KI-Assistent kann Bedrohungsszenarien vorschlagen, Eintrittswahrscheinlichkeiten und Auswirkungen einschätzen und Risiken aufzeigen, die Ihr Team bislang nicht berücksichtigt hat. Die Verantwortung für diese Risiken kann er jedoch nicht übernehmen. Wie groß die Lücke zwischen der Identifizierung und dem tatsächlichen Management von Risiken ist, zeigen aktuelle Zahlen: 86 % der Unternehmen gaben an, in den vergangenen 12 Monaten KI-bezogene Sicherheitsvorfälle erlebt zu haben. Gleichzeitig verfügten nur 45 % nach eigenen Angaben über die internen Ressourcen und das Fachwissen, um umfassende KI-Sicherheitsbewertungen durchzuführen (Cisco).

Die Grenze zwischen KI-generierten Empfehlungen und auditfesten Entscheidungen

Treat AI output as a draft that a named person approves, with the approval recorded. That discipline matters doubly if you use AI in the product itself, because your ISMS now has to govern it: only 24% of business leaders reported their organization had an AI governance program, and only 30% had processes to assess AI-introduced risks and required mitigations (BSI). Cloud Security Alliance research found that, among organizations running AI workloads, 34% reported an AI-related breach. An auditor who asks where a control narrative came from and hears "the assistant wrote it, nobody checked" has found their nonconformity.

Die wichtigsten Erkenntnisse

• Automate evidence collection and control monitoring, but keep risk acceptance, exception approval and SoA justification as signed human decisions with named owners.

• Treat your cloud provider's certificate as one input to supplier assurance and record your review of it, rather than filing it as proof your own controls work.

• Definieren Sie eine einheitliche, risikobasierte Regel für Softwareinstallationen und setzen Sie diese mithilfe von Mobile Device Management (MDM) und eingeschränkten Administratorrechten durch. Zeigen Sie dem Auditor diese Regel, statt ein Protokoll jeder einzelnen installierten Anwendung vorzulegen.

• Use ISMS tooling that records exception approvals and residual-risk sign-offs with named owners, not only evidence pulls.

• Legen Sie fest, dass alle KI-generierten Compliance-Dokumente und Nachweise vor der Weitergabe an Auditoren von einer namentlich benannten Person geprüft und freigegeben werden müssen. Dokumentieren Sie jede Freigabe.

Häufig gestellte Fragen

Können wir physische Sicherheitskontrollen als nicht anwendbar einstufen, wenn wir keine Büros haben?

Partly. If no office exists, controls governing secure areas, physical entry and office equipment siting can reasonably be excluded, with a justification stating that no corporate premises are in scope. Controls covering the physical protection of endpoints, media disposal and equipment returned by leavers remain applicable, because you still own those assets and the risk attached to them.

What evidence satisfies the climate change requirement for an AWS-hosted company?

A documented entry in your Clause 4 context analysis showing you considered whether climate change is a relevant issue, and whether interested parties have climate-related requirements. For an AWS-hosted company that typically means assessing regional availability and resilience risk, referencing your provider's published sustainability and resilience information, and recording your conclusion about architecture or continuity measures. One well-reasoned page is sufficient.

Wie genau sollten wir die Softwareinstallation auf den Endgeräten unserer Mitarbeitenden überwachen?

Die Überwachung sollte so umfassend sein, dass eine klar definierte Regel zuverlässig durchgesetzt werden kann. Schränken Sie lokale Administratorrechte ein, legen Sie grundlegende Sicherheitsanforderungen über MDM fest und verlangen Sie eine Genehmigung für Software, die Kundendaten oder Zugangsdaten zur Produktionsumgebung verarbeitet. Überprüfen Sie außerdem die installierte Software in festgelegten Abständen. Jede kleine Anwendung einzeln freizugeben, ist weder vorgeschrieben noch langfristig praktikabel. Fehlt hingegen eine verbindliche und durchgesetzte Regel, kann dies zu einer Abweichung im Audit führen.

Is our cloud provider's ISO 27001 certificate enough for our own certification?

No. It demonstrates the provider's controls over infrastructure they operate. Your certification covers your ISMS, your configuration, your access management and your supplier oversight. The certificate belongs in your supplier assurance file alongside evidence that you reviewed its scope, validity and any complementary user entity controls.

Which ISO 27001 checklist tools work for cloud-native teams?

A usable checklist tool tracks all 93 Annex A 2022 controls with owners, status and linked evidence, and feeds directly into the SoA rather than sitting beside it. Spreadsheet templates work for scoping conversations and early gap analysis. For anything beyond the first few weeks, a platform that connects the checklist to live evidence prevents the drift that makes spreadsheets unreliable.

Which ISO 27001 software pulls evidence from AWS automatically?

Secfix, the compliance automation platform, collects AWS evidence natively and maps it to your Statement of Applicability. In a demo, connect a real account and check what populates automatically and what still needs manual upload, for example for multi-account organizations, IAM policies, logging configuration and encryption state.

Does an auditor accept automated evidence without a human signature?

For factual artifacts such as configuration exports or access review outputs, yes, provided provenance and timestamps are clear. For anything involving a judgment, including risk acceptance, exception approval and applicability decisions, the auditor expects an identifiable person who made the call and can explain their reasoning in an interview.

Can a fully remote company achieve ISO 27001 certification?

Yes, and many do. Scope the ISMS around your actual operating model, justify office-specific exclusions explicitly, and strengthen the controls that carry the risk instead: endpoint hardening, identity and access management, secure remote access to production, home working expectations, and supplier oversight of the SaaS tools your team depends on.

Schlussfolgerung

Automation has genuinely changed ISO 27001. Evidence collection that once consumed weeks now runs continuously, drift surfaces within hours, and the pre-audit scramble is largely avoidable. None of that changes where accountability sits. The standard is built around a management system, and a management system is a series of decisions made by people who can defend them.

So split the work deliberately. Let the platform handle what is mechanical, and reserve your team's attention for the risk decisions, exception approvals and applicability justifications that an auditor will actually interrogate. Teams that draw that line clearly make the audit much easier, and more importantly, they end up with an ISMS that reflects how the company really operates.