# ISO/IEC 27001

Source: https://s3msecurity.com/compliance/iso-27001/
Last updated: 2026-11-12

S3M supports nine ISO/IEC 27001:2022 Annex A controls with technical evidence. ConnGuard NAC inventories devices and enforces access, EndGuard protects user endpoint devices, SpotGate and SAMI keep logs and records, and CityGate and APNZone separate networks. The table names each control by number and title only; the standard’s text is not quoted.

**ISO/IEC 27001:2022, Annex A controls.** Applies to: Organizations that run, or seek certification for, an information security management system. Official text: https://www.iso.org/standard/27001

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| A.5.9 Inventory of information and other associated assets | Keep an inventory of information and the assets that go with it. | ConnGuard NAC discovers every connected device, managed, IoT or BYOD, and records what it is. | ConnGuard NAC |
| A.5.15 Access control | Set and apply rules for physical and logical access. | ConnGuard NAC and CityGate enforce access rules by identity, device and role at each connection. | ConnGuard NAC, CityGate |
| A.8.1 User endpoint devices | Set rules for the devices people use for work, and keep those devices and their data safe. | EndGuard fingerprints each device, binds it to its user and checks its posture during the session. | EndGuard |
| A.8.5 Secure authentication | Use secure authentication for access to systems and information. | ConnGuard NAC authenticates users and devices with 802.1X and RADIUS, and EndGuard keeps verifying during the session. S3M does not provide multi-factor authentication. | ConnGuard NAC, EndGuard |
| A.8.15 Logging | Produce and keep logs of activities and events. | SpotGate stores guest sessions with their identity for audits, and SAMI keeps audit-ready records. | Spotgate, SAMI |
| A.8.16 Monitoring activities | Monitor networks, systems and applications for anomalous behavior. | EndGuard and CityGate verify sessions continuously, and APNZone detects unauthorized SIMs. | EndGuard, CityGate, APNZone |
| A.8.20 Networks security | Secure and manage networks and network devices. | ConnGuard NAC keeps unknown and failing devices off the network and works with existing switches through 802.1X, RADIUS and SNMP. | ConnGuard NAC |
| A.8.21 Security of network services | Identify and apply security mechanisms for network services. | SpotGate authenticates every guest Wi-Fi user by SMS, OAuth, voucher or sponsor before granting access. | Spotgate |
| A.8.22 Segregation of networks | Separate groups of services, users and systems on networks. | SpotGate keeps guest traffic apart from the corporate network, CityGate segments without VLANs and APNZone isolates mobile devices. | Spotgate, CityGate, APNZone |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Does using S3M certify my organization against ISO/IEC 27001?

No product can certify an organization. Certification covers your management system and is granted by an accredited body. S3M supports the Annex A controls in the table with technical evidence.

### Why does the table show only control numbers and titles?

ISO/IEC 27001 is a paid, copyrighted standard. We name each control by number and title and describe it in our own words.

### Which control does SpotGate support?

SpotGate supports A.8.21 Security of network services and A.8.22 Segregation of networks for guest Wi-Fi, and A.8.15 Logging through stored guest sessions.