Prime RP • ISO 27001 / 22301 Readiness

🧭How Certification Works

Build the ISMS (this page): scope, risk assessment, Statement of Applicability, policies, asset + risk registers, evidence.
Operate it ~3 months so records (access reviews, incidents, backups, internal audit, management review) accumulate.
Stage 1 audit (documentation review) → Stage 2 audit (implementation evidence) by an accredited certification body → certificate (3-yr cycle + annual surveillance).

Scope (draft): the Prime/Axalar ERP platform — on-prem services (Proxmox VMs: app-01, edge-01, files-drive/MinIO, Postgres, mail-01) + Firebase (Auth/Firestore/Storage) + Cloudflare edge, and the staff who operate them.

Gap Assessment — ISO 27001:2022 Annex A (93 controls)

First-pass self-assessment against Prime's known infrastructure. Status legend: Implemented Partial Gap N/A.

18Implemented

59Partial

10Gap

6N/A

Updated after drafting the full policy set + registers: the documentation is now substantially complete — most controls are "Partial" (documented, pending management approval + ~3 months of operating evidence). The ~10 true Gaps need actual doing/tooling, not just a policy: tested backup/restore, vulnerability scanning, malware/EDR, DLP, SAST in CI, internal audit + independent review (performed), and physical-monitoring evidence.

Statement of Applicability

The central audit artifact — every Annex A control, its status, and the note/evidence. Grouped by theme.

A.5 — Organizational controls (37)

#	Control	Status	Note / evidence
5.1	Policies for information security	Partial	Full policy set drafted (12 policies below); needs management approval
5.2	InfoSec roles & responsibilities	Partial	Roles exist (admin/super); not formally assigned an ISMS owner
5.3	Segregation of duties	Partial	Role-based access; document approval workflows
5.4	Management responsibilities	Gap	Need management commitment + review cadence
5.5	Contact with authorities	Gap	Document FTA/MoF/CERT contacts
5.6	Contact with special interest groups	Partial	OpenPeppol membership planned
5.7	Threat intelligence	Gap	Mail-health monitor exists; formalize threat feeds
5.8	InfoSec in project management	Gap	Add security gate to project workflow
5.9	Inventory of assets	Partial	Infra known (Proxmox/VM map); formalize a register
5.10	Acceptable use of assets	Gap	Draft Acceptable Use Policy
5.11	Return of assets	Partial	Offboarding exists (HR); add asset return step
5.12	Classification of information	Gap	Draft Data Classification Policy
5.13	Labelling of information	Gap	Follows classification
5.14	Information transfer	Partial	TLS + presigned URLs; document transfer rules
5.15	Access control	Impl	Firebase Auth + Firestore rules + roles
5.16	Identity management	Impl	Firebase Auth; chat-identity merges done
5.17	Authentication information	Partial	MFA (3 login methods, phone OTP); enforce universally
5.18	Access rights	Partial	Roles/permissions; add periodic access reviews
5.19	InfoSec in supplier relationships	Partial	Firebase/Cloudflare/Mailjet; document supplier register
5.20	Security in supplier agreements	Gap	Capture DPAs/SLAs
5.21	Security in ICT supply chain	Gap	npm/dependency provenance
5.22	Monitoring of supplier services	Partial	Mail-health monitor; broaden
5.23	Security for cloud services	Partial	Firebase/GCP/Cloudflare configured; document
5.24	Incident management planning	Partial	Incident playbooks exist (outages); formalize
5.25	Assessment of security events	Partial	Board/monitor; define triage
5.26	Response to incidents	Partial	Demonstrated (mail/calling/deploy recoveries)
5.27	Learning from incidents	Impl	Incident memory records + post-mortems
5.28	Collection of evidence	Gap	Define forensic evidence procedure
5.29	InfoSec during disruption	Partial	See ISO 22301 BIA below
5.30	ICT readiness for continuity	Partial	VM snapshots; needs tested DR
5.31	Legal/regulatory requirements	Partial	UAE VAT/e-invoicing tracked; build a register
5.32	Intellectual property rights	Partial	License inventory needed
5.33	Protection of records	Partial	Firestore/Postgres; define retention
5.34	Privacy & protection of PII	Gap	Draft Privacy Policy + PII map (UAE PDPL)
5.35	Independent review of InfoSec	Gap	Schedule internal audit
5.36	Compliance with policies	Gap	Follows once policies approved
5.37	Documented operating procedures	Partial	Deploy/infra docs in memory; formalize runbooks

A.6 — People controls (8)

#	Control	Status	Note / evidence
6.1	Screening	Partial	HR onboarding; add background checks
6.2	Terms & conditions of employment	Partial	Contracts module; add InfoSec clauses
6.3	Awareness, education & training	Gap	Build a security-awareness programme
6.4	Disciplinary process	Partial	HR process exists; reference in policy
6.5	Responsibilities after termination	Impl	Offboarding revokes access (3-store)
6.6	Confidentiality / NDAs	Partial	Add NDA to onboarding
6.7	Remote working	Gap	Draft Remote Working Policy
6.8	Security event reporting	Partial	In-app feedback→tasks; define channel

A.7 — Physical controls (14)

#	Control	Status	Note / evidence
7.1	Physical security perimeters	Partial	On-prem Proxmox site; document perimeter
7.2	Physical entry	Partial	Site access controls — document
7.3	Securing offices/rooms	Partial	Document server-room security
7.4	Physical security monitoring	Gap	CCTV/alarm evidence needed
7.5	Physical & environmental threats	Gap	Fire/flood/power assessment
7.6	Working in secure areas	N/A	If no classified secure areas
7.7	Clear desk & clear screen	Gap	Add to Acceptable Use Policy
7.8	Equipment siting & protection	Partial	Rack/UPS; document
7.9	Security of assets off-premises	Partial	Laptops (mac mini build host); MDM?
7.10	Storage media	Partial	Disk handling policy
7.11	Supporting utilities	Partial	UPS/power; document
7.12	Cabling security	N/A	Scope-dependent
7.13	Equipment maintenance	Partial	Proxmox maintenance; log it
7.14	Secure disposal / re-use	Gap	Media sanitisation procedure

A.8 — Technological controls (34)

#	Control	Status	Note / evidence
8.1	User endpoint devices	Gap	Add endpoint/MDM policy
8.2	Privileged access rights	Partial	admin/super roles; review + log
8.3	Information access restriction	Impl	Firestore rules + role checks
8.4	Access to source code	Partial	Repo access; the stale-clone incident shows control gap
8.5	Secure authentication	Impl	Firebase Auth + MFA/OTP
8.6	Capacity management	Partial	Cloud-run min-instances; monitor
8.7	Protection against malware	Gap	AV/EDR + Drive scan policy
8.8	Technical vulnerability mgmt	Gap	Add dependency + infra scanning
8.9	Configuration management	Partial	Docker/Caddy; baseline + drift control
8.10	Information deletion	Partial	Trash/retention exists; document
8.11	Data masking	Partial	Bank acct masking present; extend
8.12	Data leakage prevention	Gap	DLP controls
8.13	Information backup	Partial	Backup & BCP drafted; restore-testing still required (key evidence gap)
8.14	Redundancy of facilities	Partial	edge-01/app-01; document HA
8.15	Logging	Partial	Board + audit logs; central retention
8.16	Monitoring activities	Partial	Mail-health + heartbeats; broaden SIEM
8.17	Clock synchronization	Partial	NTP on VMs; confirm
8.18	Privileged utility programs	Partial	Restrict + log
8.19	Software on operational systems	Partial	Controlled deploys; formalize
8.20	Networks security	Partial	Cloudflare + on-prem; document
8.21	Security of network services	Partial	TLS/TURN; document
8.22	Segregation of networks	Impl	10.255.254.x internal; CF bridge edge
8.23	Web filtering	N/A	Scope-dependent
8.24	Use of cryptography	Impl	TLS everywhere; presigned URLs; Fernet vault
8.25	Secure development life cycle	Gap	Formalize SDLC
8.26	Application security requirements	Partial	Rules/validation; document
8.27	Secure architecture principles	Partial	On-prem + cloud architecture documented
8.28	Secure coding	Partial	Add coding standards + review gates
8.29	Security testing in dev	Gap	Add SAST/DAST
8.30	Outsourced development	N/A	If none
8.31	Separation of dev/test/prod	Partial	erp-live/erp-staging exist; korasai dev
8.32	Change management	Partial	Change & Release policy drafted; enforce single-source-of-truth + evidence
8.33	Test information	Partial	Avoid prod data in test; document
8.34	Protection during audit testing	N/A	Define when audits begin

ISO 22301 — Business Continuity (BIA + RTO/RPO)

Business Impact Analysis of the critical Prime services + recovery targets. Continuity plans draw on the real incident playbooks already on record.

Service	Impact if down	RTO (target)	RPO (target)	Continuity basis
ERP web (dash.primerp.ai)	High — ops halt	4 h	1 h	edge-01/app-01 + CF; VM snapshots
Prime Mail	High — comms	4 h	15 min	Stalwart on VM115; Mailjet outbound; replica
Prime Drive (files)	Medium	8 h	1 h	MinIO + on-prem drive service
Calling (WebRTC/TURN)	Medium	8 h	n/a	TURN rotator; multi-server
Firestore/Auth (Firebase)	High	2 h	~0 (managed)	Google-managed SLA

Gaps to close: formal BIA sign-off, tested backup/restore (currently snapshots, untested RPO), a written DR runbook per service, and a continuity test schedule. Incident history (mail-01 disk I/O, app-01 host fault, calling/TURN, deploy conflict) already provides post-mortem evidence (control 5.27 ✓).

Policy Library

The mandatory ISMS documents. The master Information Security Policy is drafted below; the rest are queued.

Policy	Status	Covers (Annex A)
Information Security Policy (master)	Drafted	5.1, 5.2, 5.4, 5.36
Access Control Policy	Drafted	5.15–5.18, 8.2–8.5
Acceptable Use Policy	Drafted	5.10, 7.7, 8.1
Cryptography Policy	Drafted	8.24
Data Classification & Handling	Drafted	5.12–5.14, 5.33
Supplier / Cloud Security Policy	Drafted	5.19–5.23
Incident Response Plan	Drafted	5.24–5.28, 6.8
Change & Release Management	Drafted	8.32, 8.19, 8.31
Secure Development Policy	Drafted	8.25–8.29
Backup & Business Continuity Plan	Drafted	8.13, 5.29, 5.30
Privacy / PII Policy (UAE PDPL)	Drafted	5.34
HR Security Policy	Drafted	6.1–6.6

Information Security Policy (master) — draft v0.1

1. Purpose

Axalar establishes, operates and continually improves an Information Security Management System (ISMS) conforming to ISO/IEC 27001:2022 to protect the confidentiality, integrity and availability of information processed by the Prime platform and its customers.

2. Scope

All information assets, systems and personnel supporting the Prime/Axalar ERP platform: on-prem services (Proxmox VMs — app-01, edge-01, files-drive/MinIO, Postgres, mail-01), Firebase (Auth/Firestore/Storage), Cloudflare edge, and supporting cloud services.

3. Objectives

Protect customer + business data; meet UAE legal/regulatory obligations (VAT, e-invoicing, PDPL); maintain service availability per the BIA; and achieve + maintain ISO 27001 / 22301 certification.

4. Principles

Least-privilege access; defence in depth; encryption in transit and at rest; secure-by-design development; risk-based decision-making; and continual improvement via internal audit and management review.

5. Roles & responsibilities

Top management provides resources and reviews ISMS performance. An ISMS Owner / CISO (to be appointed) maintains the risk register, SoA and this policy set. All staff comply with policies and report security events.

6. Risk management

Risks to information assets are identified, assessed and treated; residual risk is accepted by management. The Statement of Applicability records control applicability and status.

7. Compliance & review

Non-compliance is handled via the HR disciplinary process. This policy is reviewed at least annually and after significant change. Approved by: ______ · Date: ______ · Version 0.1 (draft).

Access Control Policy — draft v0.1

Purpose/scope: govern who may access Prime systems and data, and how. Covers Firebase Auth, Firestore rules, on-prem services and admin access. (A.5.15–5.18, A.8.2–8.5)

Access is granted on least-privilege / need-to-know and role-based (engineer/supervisor/accounting/admin/super).
Every user has a unique identity; shared/generic accounts are prohibited.
MFA is required for all accounts; privileged (admin/super) access additionally logged.
Joiner-Mover-Leaver: access provisioned on hire, changed on role change, revoked immediately on termination (HR offboarding revokes Auth + Firestore + mail).
Quarterly access reviews of privileged and standard accounts; recertify or remove.
Secrets/keys held in managed vaults (Firebase, Fernet board vault); never in source or chat.

Acceptable Use Policy — draft v0.1

Purpose/scope: rules for acceptable use of Prime systems, devices and data by all staff. (A.5.10, A.7.7, A.8.1)

Systems are for authorised business use; no sharing of credentials or bypassing controls.
Clear-desk / clear-screen: lock sessions when away; no Confidential data left exposed.
Devices must be encrypted, patched, screen-locked and (where issued) enrolled in management.
No installation of unapproved software on operational systems; no use of personal cloud for company data.
Suspected security events reported immediately via the incident channel.

Cryptography Policy — draft v0.1

Purpose/scope: protect data with appropriate cryptography. (A.8.24)

In transit: TLS 1.2+ everywhere (Cloudflare edge, on-prem Caddy, TURN/DTLS-SRTP for calls).
At rest: provider-managed encryption (Firebase, GCP, MinIO) + time-limited presigned URLs for media.
Key management: secrets in Firebase config / Fernet-encrypted board vault; rotation on compromise; no hard-coded keys.
Deprecated ciphers/protocols (SSLv3, TLS 1.0/1.1, MD5/SHA-1 for signatures) are prohibited.
Certificates are monitored and renewed before expiry.

Data Classification & Handling — draft v0.1

Purpose/scope: classify and handle information by sensitivity. (A.5.12–5.14, A.5.33)

Classes: Public · Internal · Confidential · Restricted (PII, financial, credentials = Restricted).
Handling, sharing, storage and transfer rules scale with class; Restricted requires encryption + access logging.
Records retained per legal/tax requirements (UAE VAT/e-invoicing) then securely deleted.
Labelling applied in documents/repositories where practical.

Supplier & Cloud Security Policy — draft v0.1

Purpose/scope: manage security risk from suppliers and cloud services. (A.5.19–5.23)

All suppliers recorded in the Supplier Register with the data they process and their assurance (SOC2/ISO).
Security + privacy assessed before onboarding; DPAs/SLAs in place for processors of Restricted data.
Cloud service configurations reviewed against provider security baselines; least-privilege service accounts.
Supplier performance + security monitored; access revoked at contract end.

Incident Response Plan — draft v0.1

Purpose/scope: detect, respond to and learn from security incidents. (A.5.24–5.28, A.6.8)

Report: any suspected event via the incident channel; auto-signals from mail-health monitor + heartbeats.
Triage: severity (Low/Med/High/Critical) and impact assessed; an owner assigned.
Respond: contain → eradicate → recover, following per-service runbooks; preserve evidence.
Post-mortem: root cause + corrective actions recorded (existing playbooks: mail-01 disk I/O, app-01 host fault, calling/TURN, stale-deploy).
Regulator/customer notification where legally required.

Change & Release Management — draft v0.1 priority

Purpose/scope: control changes to production safely. (A.8.32, A.8.19, A.8.31) — directly addresses the recurring stale-deploy incident.

Single source of truth: one canonical repository; all deploys originate from it. No deploys from out-of-date local clones (root cause of the #49 regressions).
Changes follow request → review → approve → deploy, with version bump + changelog.
Separate environments: dev (korasai) · staging (erp-staging) · production (erp-live); promote, don't edit-in-place.
Every deploy is reversible (backups/version refs) with a documented rollback.
Emergency changes are logged and reviewed retrospectively.

Secure Development Policy — draft v0.1

Purpose/scope: build security into the SDLC. (A.8.25–8.29)

Security requirements considered at design; threat-aware review for sensitive features (auth, payments, e-invoicing).
Secure coding: input validation, output encoding, parameterised queries, no secrets in code.
Code review before production; dependency provenance + vulnerability scanning.
Automated tests (e.g. the PINT-AE engine has 36 unit tests) + security testing before release.
No production data in development/test environments.

Backup & Business Continuity Plan — draft v0.1 priority

Purpose/scope: ensure data is recoverable and critical services continue. (A.8.13, A.5.29–5.30) — see the BIA above.

Backup scope: Firestore exports, Postgres, MinIO/files, mail store, VM snapshots; frequency set to meet each service RPO.
At least one offsite / immutable copy; backups encrypted.
Restore tests performed on a schedule (currently untested — top priority gap).
Per-service DR runbooks with RTO/RPO from the BIA; continuity exercises at least annually.

Privacy / PII Policy (UAE PDPL) — draft v0.1

Purpose/scope: protect personal data per the UAE Personal Data Protection Law. (A.5.34)

Maintain a PII inventory (staff, customers, contacts) and lawful basis for processing.
Honour data-subject rights (access, correction, deletion) and consent where required.
Retention limited to purpose + legal need; secure deletion thereafter.
Cross-border transfers assessed; breach notification per PDPL timelines.

HR Security Policy — draft v0.1

Purpose/scope: security across the employment lifecycle. (A.6.1–6.6)

Screening proportionate to role before access to Restricted data.
Employment terms include information-security responsibilities + an NDA.
Awareness training at onboarding and annually; phishing awareness.
Onboarding provisions least-privilege access; offboarding revokes all access (Auth + Firestore + mail, asset return).
Breaches handled via the disciplinary process.

Asset Register (draft)

Primary information assets in ISMS scope (A.5.9).

Asset	Type	Classification	Location / owner
Firestore (project `axalar`)	Database — customer + business data	Restricted	Firebase / GCP · IT
Firebase Auth	Identity store	Restricted	Firebase · IT
app-01 / edge-01 (Proxmox)	App + edge servers	Confidential	On-prem 10.255.254.x · IT
files-drive (MinIO)	Object storage — documents	Confidential	On-prem · IT
Postgres (10.255.254.112)	Drive/HR/microservice DB	Restricted	On-prem · IT
mail-01 (Stalwart, VM115)	Mail store	Restricted	On-prem · IT
Source repository (axalar-erp)	Source code + IaC	Confidential	Dev workstations · Eng
Secrets / keys (Firebase, Fernet vault)	Credentials	Restricted	Vaults · IT
Cloudflare zone + DNS	Edge / DNS	Confidential	Cloudflare · IT

Risk Register (draft)

Top information-security risks + treatment. L/I = Likelihood/Impact (H/M/L).

Risk	L/I	Treatment	Control
Stale-clone deploy overwrites production	H/M	Change & Release policy — single source of truth, no out-of-date deploys	8.32
Data loss — backups untested	M/H	Backup plan + scheduled restore tests	8.13
Credential compromise / account takeover	M/H	MFA, access reviews, secret vaulting	5.17, 8.5
Supplier/cloud outage (Firebase/CF/mail)	M/M	BIA, redundancy, monitoring	5.30, 8.14
PII breach (UAE PDPL exposure)	L/H	Classification, encryption, Privacy policy	5.34, 8.24
Unpatched vulnerability exploited	M/M	Vulnerability + patch management	8.8
Malware via Drive upload	M/M	Upload scanning + endpoint protection	8.7
Insider misuse of privileged access	L/H	Least privilege, logging, segregation	8.2, 8.15

Supplier Register (draft)

Third parties processing or supporting in-scope data (A.5.19–5.23).

Supplier	Service	Data	Assurance
Google / Firebase (GCP)	Auth, Firestore, Storage, Functions	Restricted	ISO 27001 / SOC 2 (Google)
Cloudflare	Edge, DNS, WAF, tunnels	Confidential (traffic)	ISO 27001 / SOC 2
Mailjet	Outbound email relay	Confidential (mail metadata)	ISO 27001 / GDPR
Proxmox / hosting	On-prem virtualization	Restricted (hosts data)	Self-managed — document physical controls
OpenPeppol + ASP (planned)	E-invoice transmission (AS4)	Confidential (invoices)	Peppol-accredited (to select)

Recommended Next Steps

Documentation is done (policies + SoA + registers). What's left is approval, operation and the external audit.

Done Gap assessment, full SoA, 12 policies, Asset/Risk/Supplier registers, ISO 22301 BIA — all drafted in-house.
1. Appoint an ISMS Owner + management approval of the drafted policy set — moves 5.1/5.2/5.4 and the policy-backed controls from Partial → Implemented.
2. Close the ~10 operational gaps (implement + evidence): tested backup/restore, vulnerability scanning, malware/EDR, DLP, SAST in CI, and enforce single-source-of-truth change management (the stale-deploy fix).
3. Stand up records — quarterly access reviews, log retention, awareness training delivered, one internal audit + one management review.
4. Operate ~3 months, then engage an accredited certification body for Stage 1 + Stage 2.

Progress Log

Most recent first.

2026-06-30

Full ISMS documentation set drafted

Drafted all 12 policies (master ISP + Access Control, Acceptable Use, Cryptography, Data Classification, Supplier/Cloud, Incident Response, Change & Release, Secure Development, Backup & BCP, Privacy/PDPL, HR Security) and the Asset, Risk and Supplier registers. Gap assessment re-scored: 18 implemented · 59 partial · 10 gap · 6 N/A — the documentation is substantially complete. Remaining ~10 gaps are operational (tested restores, vuln scanning, EDR, DLP, SAST, internal audit) + the external audit. The in-house ISMS package is now ready for an ISMS-owner to approve and operate.

2026-06-30

ISO readiness initiated — gap assessment + SoA + BIA + master policy

First-pass self-assessment of all 93 ISO 27001:2022 Annex A controls (18 implemented · 41 partial · 28 gap · 6 N/A), an ISO 22301 BIA with RTO/RPO for the 5 critical services, a 12-policy library, and a draft master Information Security Policy. Next: appoint ISMS owner + draft the remaining policies.