ISO 27001
ISO 27001, with the evidence already kept.
71 of Eurus's 72 checks follow a clause of ISO/IEC 27001. Each result is kept with a fingerprint, and a pass counts only while the read behind it is fresh.
What the standard asks
ISO/IEC 27001:2022 is the international standard for an information security management system. A business chooses to meet it, often when its customers ask for a certificate. NIS2's Article 21 measures and DORA's ICT risk management ask for much of the same work.
Clauses 4 to 10: the management system
The context and scope, leadership, a risk assessment and treatment plan, a Statement of Applicability, resources and awareness, operation, internal audit and management review, and improvement.
Annex A: 93 controls
In four themes: organisational (37), people (8), physical (14) and technological (34). The Statement of Applicability says which apply and why.
Certification
An accredited certification body audits in two stages: the documented system first, then whether it runs as written. A certificate lasts three years, with a surveillance audit each year between. In Ireland the Irish National Accreditation Board accredits certification bodies.
The 2013 edition
Certificates to ISO/IEC 27001:2013 had until 31 October 2025 to move to the 2022 edition.
How Eurus handles it
The evidence an auditor asks for is made as the work happens, from the systems the business already runs.
Access
An admin added without an approver or two-step sign-in fails its check, and the fix needs a named approver.
Leavers
A leaver who can still sign in fails the leavers' check, by name of the app, until their access ends.
Coverage, system by system
Each system connected, the permission it reads with, and the clauses its checks answer.
A trail an auditor can test
Each business's audit trail is numbered and chained, and a change made underneath it is found. Everything exports, each table fingerprinted.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyFor a business of 5 to 50 staff
FourWinds, who make Eurus, work hands-on with Irish businesses of 5 to 50 staff, and wrote a guide to this law for them.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.