---
title: "Security Audits based on ISO/IEC 27001"
description: "We audit Ruby on Rails applications and their development and operations processes against ISO/IEC 27001 controls and help you get ready for certification."
url: "https://qameta.com/security-audits-iso-27001/"
---

# Security Audits based on ISO/IEC 27001

Customers, investors and larger B2B partners increasingly ask how you protect
their data - often with a security questionnaire or a request for ISO/IEC 27001.
We review your application and the way it is built and operated, show you where
you stand, and help you close the gaps.

## What we audit

**The application**

* Code review for common vulnerabilities: injection, broken access control,
  insecure direct object references, mass assignment, cross-site scripting and
  request forgery
* Authentication, sessions, password handling and authorization rules
* Handling of personal and sensitive data, including logging and backups
* Dependencies with known vulnerabilities
* Static analysis with tools like Brakeman, checked by hand for false
  positives and missed issues

**Development and operations**

* Access control to repositories, servers, databases and third-party services
* Secrets management and key rotation
* Change management: code review, [Continuous Integration](https://qameta.com/continuous-integration/)
  and [Continuous Delivery](https://qameta.com/continuous-delivery/)
* Logging, monitoring and incident response
* Backup and restore - including whether a restore was ever tested
* Patch and vulnerability management

## ISO/IEC 27001

ISO/IEC 27001 is the international standard for information security
management systems, part of the ISO/IEC 27000 family. We map our findings to
its Annex A controls, so the results are useful for your certification
project and for answering customer security questionnaires.

Certification itself is granted by an accredited certification body. Our part
is to prepare you for it: a gap analysis of where you stand, concrete measures
for the technical controls around your software, and the evidence your auditor
will ask for.

## What you get

* A written report with findings ranked by risk, each with a concrete
  recommendation
* A mapping of the findings to ISO/IEC 27001 controls
* A debrief call with your team
* On request, the fixes themselves - followed by ongoing
  [security maintenance](https://qameta.com/ruby-on-rails-security-maintenance/) so the results
  don't erode over time

## Summary

A security audit tells you where you stand before a customer, an auditor or an
attacker does. We know Rails applications from the inside and look at both the
code and the processes around it.

Preparing for ISO/IEC 27001 or a customer security review? [Get in touch](mailto:info@qameta.com).