ISO 27001
ISO 27001 asks you to watch for unusual behaviour. Decoys make that visible.
ISO/IEC 27001 is the international standard for managing information security. Its 2022 version added control A.8.16, Monitoring activities: watch networks and systems for behaviour that could be an attack. Kandaro Deception supports that control and parts of incident management. It does not make you certified on its own.
Annex A controls
Which controls Kandaro supports, and which it doesn’t.
Annex A lists 93 controls. Kandaro has a real role in a handful of them, mostly around monitoring and incidents. For the rest you need other tools and processes, and we would rather say so.
| Control | Title | How Kandaro helps | Evidence you get |
|---|---|---|---|
| A.8.16 | Monitoring activities | Decoys sit among your real systems and alert on any touch, so you notice unusual behaviour inside the network: scans, logins with planted credentials, AI agents probing tools. Nobody legitimate uses a decoy, so alerts are not noise. | Each decoy’s status and last check-in, every alert with its time and source, and our published detection test. |
| A.5.25 | Assessment and decision on information security events | Activity from one source is grouped into one incident with a fixed, rule-based severity and a plain-English explanation of what happened. | Incident severity with the rule behind it, and who assessed and closed it. |
| A.5.26 | Response to information security incidents | Every incident ends with a concrete next step, sent to email, Slack, your SIEM or a webhook. Your team assigns, comments on and closes it. | The activity log of who did what and when. |
| A.5.28 | Collection of evidence | Every raw event is kept with its timestamp, source and details, alongside the explanation. | Incident timelines and JSON exports, plus suggested indicators and draft detection rules per incident. |
| A.5.7 | Threat intelligence | What attackers do on your decoys is intelligence about your own network: which systems they look for, which credentials they try, mapped to MITRE ATT&CK. | ATT&CK techniques per incident and the indicators seen. |
| A.5.19–A.5.22 | Supplier relationships | Kandaro is one of your suppliers. We give you what you need to assess us. | Our security page, data processing agreement, signed sensor images with a software bill of materials, and our vulnerability disclosure policy. |
| Others | Risk assessment, access control, malware protection, vulnerability management, backup, secure development, awareness training | Outside what Kandaro does. | — |
What to show your auditor
For A.8.16, auditors look for monitoring that is defined, running and acted on. A decoy gives you all three in a form that is easy to show: where the decoys are and that they are online, the alerts they raised, and what your team did with each one. Because nobody should ever touch a decoy, every alert is worth a look, which keeps the record short and meaningful.
You can also point to how we test our detection: every release has to raise an alert on every decoy service and stay silent when nobody is there.
Questions about how Kandaro fits your ISO 27001 programme? Ask us through the contact form, or read how we secure Kandaro itself.
Using another framework too? See all frameworks Kandaro supports.
See your first explained finding today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing