ISO 27001 evidence-bundle export
OrbitalReg ships an ISO 27001 Evidence-Engine that produces an auditor-ready ZIP bundle on demand, bringing the ISO 27001 surface to parity with the SOC 2 Evidence-Engine. This page documents what's in the bundle, how to generate one, and where it differs from the SOC 2 bundle.
Where to find it
Admin > Compliance > ISO 27001 (System group), /admin/compliance#iso27001. The same tab also renders the Annex A controls mapping with live point-in-time probes.
What's in the bundle
Every bundle covers the full current 93-control Annex A catalogue plus a full live-probe snapshot — unlike the SOC 2 bundle there is no caller-supplied audit-window or per-criterion scope selection, because ISO 27001 evidence is a point-in-time control-posture statement rather than an activity log over a date range.
| File | Contents |
|---|---|
manifest.json | Bundle version, generated_at, control count, counts-by-status. |
summary.md | Auditor cover sheet — one section per Annex A cluster (A.5–A.8) with a pointer to its detail file. |
report.json | The entire snapshot envelope (catalogue + live-probe states) in one file, for tools that want to ingest the whole bundle at once. |
evidence/A.5-organizational-controls.json | A.5 controls (37) + the live-probe states they reference. |
evidence/A.6-people-controls.json | A.6 controls (8) + referenced probe states. |
evidence/A.7-physical-controls.json | A.7 controls (14) + referenced probe states. |
evidence/A.8-technological-controls.json | A.8 controls (34) + referenced probe states. |
Section files are self-contained: each one carries its controls and the live-probe data those controls cite (joined by the control's snapshot key), so an auditor working section-by-section never has to cross-reference report.json for context.
Generating a bundle
- Navigate to Admin > Compliance > ISO 27001.
- Optionally enter a note (e.g. the audit or vendor-review name) — it's stored alongside the run but not embedded in the ZIP.
- Click Generate & download to stream the ZIP.
- Past runs are listed below with per-row date, control count, size, and SHA-256.
There is no CLI equivalent yet (unlike orbital compliance soc2-report) — the admin UI is the only surface today.
Bundle integrity
The server persists per-run metadata (timestamp, generated-by, control count, SHA-256, byte size) to iso27001_evidence_runs, but not the bundle bytes themselves. The auditor's copy IS the file the operator downloaded; the server-side row is the integrity counterpart that proves the file the auditor received matches what the engine produced. Response headers X-Orbital-ISO27001-Bundle- SHA256 and X-Orbital-ISO27001-Bundle-Controls carry the same values for scripted verification.
Differences from the SOC 2 bundle
| SOC 2 | ISO 27001 | |
|---|---|---|
| Scope window | Caller-supplied start/end date | None — point-in-time only |
| Criteria/control subset | Caller-selectable checkbox grid | None — always the full 93-control catalogue |
| Per-item files | One file per Trust Service Criterion | One file per Annex A cluster (A.5–A.8) |
| CLI | orbital compliance soc2-report | Admin UI only |
| Persisted table | soc2_evidence_runs | iso27001_evidence_runs |
Related compliance docs
- ISO/IEC 27001:2022 Annex A controls — the per-control status/feature/evidence mapping this bundle exports.
- SOC 2 Trust-Service-Criteria mapping — the parallel evidence engine this one mirrors.