ISO/IEC 27001:2013 has been withdrawn, and the transition period for certificates issued against it ended in October 2025. Surveillance and recertification audits now refer to the 2022 edition, so the statement of applicability, each control owner's evidence and any vendor mapping you rely on should use 2022 Annex A numbers. For identity work the renumbering is the change people notice first: the old A.9 access control section is now spread across A.5.15 to A.5.18 in the organisational controls and A.8.2 to A.8.5 in the technological controls.
The Tanflow IAM Suite and Tanflow PAM give evidence for eleven Annex A controls. Each one is listed below with the product that produces the evidence. Both products run on your own servers, so the logs and records an auditor asks to see stay inside your environment.
Certification is an assessment of your ISMS
An ISO/IEC 27001 certificate is issued to an organisation for its information security management system. The certification body looks at your risk assessment, your statement of applicability, your policies and whether the controls you selected operate as described. The IAM Suite and PAM carry out parts of your access-control and logging policy and keep the records that show those controls operating. They are designed to align with the controls listed here, and the scope, documentation and operation of each control are decided in your ISMS.
Organisational controls in section 5
- A.5.3 Segregation of duties (IAM Suite): you define conflicting combinations of access, such as creating a vendor and approving its payment, and the IAM Suite blocks or flags them when someone requests access.
- A.5.15 Access control (IAM Suite): access is granted through roles and attribute-based policies instead of by hand. Roles map business positions to technical entitlements, and dynamic policies re-evaluate a person's access when an attribute such as department or location changes.
- A.5.16 Identity management (IAM Suite): employees, contractors, partners and service accounts are held in one directory that is kept in step with HR. Joiners get birthright access from the HR record, and a leaver event disables their accounts from the same source.
- A.5.17 Authentication information (both): the IAM Suite applies one password policy across the directory and connected systems, and self-service password reset requires the user's MFA factors. PAM keeps privileged passwords and SSH keys in an encrypted vault and rotates them on a schedule or after each use.
- A.5.18 Access rights (IAM Suite): access requests go through approval workflows, certification campaigns send each person's access to their manager or the resource owner for review, and access is removed when someone changes role or leaves. Each review decision is recorded against the person who made it.
- A.5.19 Supplier relationships (PAM): vendor access is approved, opens only for a time-boxed window and is recorded for the whole session.
Technological controls in section 8
- A.8.2 Privileged access rights (PAM): users request elevation when they need it and give a business reason, approvers grant it for a set window, and the grant expires on schedule. Administration of PAM itself uses tiered roles from User up to Super Admin, with delegated roles for narrower duties.
- A.8.5 Secure authentication (both): MFA with authenticator apps or one-time codes, FIDO2 security keys and passkeys, and account lockout after repeated failed attempts. The same MFA engine protects logins to the PAM gateway.
- A.8.15 Logging (both): append-only audit logs record logins, access changes, privileged sessions and the commands run in them. Administrative access to the audit store is itself logged.
- A.8.16 Monitoring (both): the IAM Suite raises security events such as failed-login bursts and impossible travel as they happen, PAM lets a supervisor watch privileged sessions live, and both forward events to your SIEM.
- A.8.18 Use of privileged utility programs (PAM): command control inspects each command at the gateway and can block it, warn on it or ask the user for a reason before it runs. The reason is stored next to the command in the audit trail.
A.8.17 clock synchronisation is set on the host servers
A.8.17 asks for clocks that agree across the systems in scope, so that timestamps in different logs can be compared. Clock synchronisation is configured on the host servers that the IAM Suite and PAM run on. Record it in your statement of applicability as an infrastructure control and collect its evidence from those hosts.
Evidence you can show an auditor
The IAM Suite has ready-made reports for access reviews, dormant accounts, privileged assignments, failed logins and leaver checks. Reports can be sent to stakeholders on a schedule or exported as CSV or PDF. PAM keeps session replays with timeline search, a command-level audit that can be searched by user, target and time range, and reports for ISO 27001 evidence requests. Log retention in both products is set by policy, so it can follow the retention period your ISMS defines.
Auditors can also be given a scoped, read-only auditor role in PAM. It lets them search logs and watch replays for the period of their engagement, and their own activity is logged as well.
When you update the statement of applicability, record for each control the 2022 number, the Tanflow product that produces the evidence and the report or log an auditor should open. For A.8.17, point to the time configuration on the host servers.