MRIS for ISO/IEC 27001:2022, Annex A. Edition 2.0, September 2026
Do your ISO 27001 controls still work when the attacker is an AI?
MRIS analyzes all 93 controls of ISO/IEC 27001:2022 Annex A (ISO/IEC 27002:2022) against AI-accelerated attacks. For every gap the analysis names flanking Mythos Hardening Controls, and the Implementation Guide describes how to implement them.
Select a cell to see the control, its classification and the hardening measure.
All 93 controls
93 controls: 29 robust, 37 partially degraded, 4 friction-only, 23 not affected.
Analysis matrix
All 93 controls with their classification and flanking MHC, as per MRIS Annex A. Search by number, title or MHC, or filter by classification.
93 of 93 controls
| Control | Title | Classification | Flanking MHC |
|---|---|---|---|
| A.5 Organizational controls 37 controls | |||
| A.5.1 | Policies for information security | not affected | – |
| A.5.2 | Information security roles and responsibilities | not affected | – |
| A.5.3 | Segregation of duties | partially degraded | MHC-05 |
| A.5.4 | Management responsibilities | not affected | – |
| A.5.5 | Contact with authorities | partially degraded | MHC-11 |
| A.5.6 | Contact with special interest groups | not affected | – |
| A.5.7 | Threat intelligence | partially degraded | MHC-05 |
| A.5.8 | Information security in project management | not affected | – |
| A.5.9 | Inventory of information and other associated assets | robust | MHC-13 |
| A.5.10 | Acceptable use of information and other associated assets | not affected | – |
| A.5.11 | Return of assets | not affected | – |
| A.5.12 | Classification of information | robust | – |
| A.5.13 | Labelling of information | not affected | – |
| A.5.14 | Information transfer | partially degraded | MHC-05 |
| A.5.15 | Access control | partially degraded | MHC-04, MHC-05 |
| A.5.16 | Identity management | robust | MHC-04, MHC-13 |
| A.5.17 | Authentication information | partially degraded | MHC-03 |
| A.5.18 | Access rights | partially degraded | MHC-10 |
| A.5.19 | Information security in supplier relationships | partially degraded | MHC-02 |
| A.5.20 | Addressing information security within supplier agreements | partially degraded | MHC-02 |
| A.5.21 | Managing information security in the ICT supply chain | partially degraded | MHC-02 |
| A.5.22 | Monitoring, review and change management of supplier services | partially degraded | MHC-02 |
| A.5.23 | Information security for use of cloud services | partially degraded | MHC-06, MHC-07 |
| A.5.24 | Information security incident management planning and preparation | partially degraded | MHC-11 |
| A.5.25 | Assessment and decision on information security events | friction-only | MHC-11 |
| A.5.26 | Response to information security incidents | partially degraded | MHC-11 |
| A.5.27 | Learning from information security incidents | robust | – |
| A.5.28 | Collection of evidence | robust | – |
| A.5.29 | Information security during disruption | partially degraded | MHC-08 |
| A.5.30 | ICT readiness for business continuity | robust | MHC-08 |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | not affected | – |
| A.5.32 | Intellectual property rights | not affected | – |
| A.5.33 | Protection of records | partially degraded | MHC-08 |
| A.5.34 | Privacy and protection of PII | partially degraded | – |
| A.5.35 | Independent review of information security | partially degraded | MHC-10, MHC-12 |
| A.5.36 | Compliance with policies, rules and standards for information security | friction-only | MHC-10 |
| A.5.37 | Documented operating procedures | not affected | – |
| A.6 People controls 8 controls | |||
| A.6.1 | Screening | not affected | – |
| A.6.2 | Terms and conditions of employment | not affected | – |
| A.6.3 | Information security awareness, education and training | partially degraded | – |
| A.6.4 | Disciplinary process | not affected | – |
| A.6.5 | Responsibilities after termination or change of employment | robust | – |
| A.6.6 | Confidentiality or non-disclosure agreements | not affected | – |
| A.6.7 | Remote working | partially degraded | MHC-03, MHC-04 |
| A.6.8 | Information security event reporting | partially degraded | – |
| A.7 Physical controls 14 controls | |||
| A.7.1 | Physical security perimeters | robust | – |
| A.7.2 | Physical entry | robust | – |
| A.7.3 | Securing offices, rooms and facilities | robust | – |
| A.7.4 | Physical security monitoring | robust | – |
| A.7.5 | Protecting against physical and environmental threats | not affected | – |
| A.7.6 | Working in secure areas | robust | – |
| A.7.7 | Clear desk and clear screen | not affected | – |
| A.7.8 | Equipment siting and protection | not affected | – |
| A.7.9 | Security of assets off-premises | partially degraded | – |
| A.7.10 | Storage media | robust | – |
| A.7.11 | Supporting utilities | not affected | – |
| A.7.12 | Cabling security | not affected | – |
| A.7.13 | Equipment maintenance | not affected | – |
| A.7.14 | Secure disposal or re-use of equipment | robust | – |
| A.8 Technological controls 34 controls | |||
| A.8.1 | User endpoint devices | partially degraded | MHC-03, MHC-05 |
| A.8.2 | Privileged access rights | robust | MHC-04 |
| A.8.3 | Information access restriction | partially degraded | MHC-05 |
| A.8.4 | Access to source code | partially degraded | MHC-02, MHC-05 |
| A.8.5 | Secure authentication | partially degraded | MHC-03 |
| A.8.6 | Capacity management | not affected | – |
| A.8.7 | Protection against malware | partially degraded | MHC-05 |
| A.8.8 | Management of technical vulnerabilities | friction-only | MHC-09 |
| A.8.9 | Configuration management | robust | MHC-10 |
| A.8.10 | Information deletion | robust | – |
| A.8.11 | Data masking | robust | – |
| A.8.12 | Data leakage prevention | partially degraded | MHC-05 |
| A.8.13 | Information backup | robust | MHC-08 |
| A.8.14 | Redundancy of information processing facilities | robust | MHC-08 |
| A.8.15 | Logging | robust | MHC-05 |
| A.8.16 | Monitoring activities | partially degraded | MHC-05 |
| A.8.17 | Clock synchronization | robust | – |
| A.8.18 | Use of privileged utility programs | robust | – |
| A.8.19 | Installation of software on operational systems | robust | – |
| A.8.20 | Networks security | partially degraded | MHC-04 |
| A.8.21 | Security of network services | partially degraded | MHC-04 |
| A.8.22 | Segregation of networks | partially degraded | MHC-04, MHC-07 |
| A.8.23 | Web filtering | friction-only | MHC-03 |
| A.8.24 | Use of cryptography | robust | MHC-01 |
| A.8.25 | Secure development life cycle | partially degraded | MHC-09 |
| A.8.26 | Application security requirements | partially degraded | MHC-09 |
| A.8.27 | Secure system architecture and engineering principles | robust | MHC-13 |
| A.8.28 | Secure coding | partially degraded | MHC-09 |
| A.8.29 | Security testing in development and acceptance | robust | MHC-09, MHC-12 |
| A.8.30 | Outsourced development | partially degraded | MHC-02 |
| A.8.31 | Separation of development, test and production environments | robust | MHC-06 |
| A.8.32 | Change management | partially degraded | MHC-09 |
| A.8.33 | Test information | robust | – |
| A.8.34 | Protection of information systems during audit testing | not affected | – |
No control matches this search. Check the spelling or reset the filter.
What has changed in the threat landscape
The ISO/IEC 27001 methodology stays intact. What has been destabilized are its inputs: assumptions about the time, effort and capabilities of attackers.
- Collapse of the patch window
- The time between a known vulnerability and its exploitation is shrinking toward zero.
- Timeline compression
- Minutes, not days, pass between initial access and damage.
- Fragmentation
- Attacks run in parallel and distributed to overwhelm the response.
- Capability decoupling
- Attack capability no longer depends on the actor’s resources.
Seven systematic gaps in ISO/IEC 27002:2022
The gap analysis (chapter 8) condenses these shifts into requirements that other frameworks already mandate and that deliver hard protective effect under Mythos conditions:
- Post-quantum strategy and crypto agility
- Supply-chain transparency with an SBOM mandate
- Containers, confidential computing and multi-tenancy
- Time-based reporting deadlines and root-cause duty
- Continuous verification instead of periodic audits
- Phishing-resistant MFA and workload identity
- Automation mandate and parallel incident testing
All seven gaps in detail: framework requirements and mapped MHC
Classification and risk assessment
Every control receives one of four classifications. The result feeds directly into the risk assessment under ISO/IEC 27005.
- Robust
- 29
- 31%
- Keeps working structurally: cryptographic or architectural hardness.
- Partially degraded
- 37
- 40%
- Works with limitations and needs flanking hardening.
- Friction-only
- 4
- 4%
- The classic implementation loses its standalone protective effect and must be replaced or redesigned.
- Not affected
- 23
- 25%
- Neutral towards the AI threat and remains important unchanged.
Bridge to ISO/IEC 27005. A partially degraded control raises the likelihood by one level, a friction-only control by two levels.
Leverage: a few measures carry many gaps
How many of the 41 degraded controls (partially degraded and friction-only) each MHC flanks. MHC-01 and MHC-13 flank only robust controls, but can still be P0 depending on data and the use of AI agents.
| MHC | Degraded controls | Also flanks robust | Character |
|---|---|---|---|
| MHC-05 Behavior-Based Detection | 10 | A.8.15 | broadly cross-cutting |
| MHC-02 SBOM and Build Provenance | 6 | – | supply chain |
| MHC-03 Phishing-Resistant MFA | 5 | – | identity / authentication |
| MHC-04 Workload Identity and Zero Trust | 5 | A.5.16, A.8.2 | identity / access |
| MHC-09 AI-Assisted Security Testing | 5 | A.8.29 | secure development |
| MHC-11 SOAR and Tier-1 Automation | 4 | – | incident response |
| MHC-10 Continuous Control Monitoring | 3 | A.8.9 | verification |
| MHC-07 Multi-Tenancy Isolation | 2 | – | cloud |
| MHC-08 Immutable Backups | 2 | A.5.30, A.8.13, A.8.14 | resilience |
| MHC-06 Containers and Confidential Computing | 1 | A.8.31 | narrow |
| MHC-12 Threat-Led Penetration Testing | 1 | A.8.29 | narrow, validating |
| MHC-01 Post-Quantum Strategy and Cryptographic Inventory | 0 | A.8.24 | flanks robust controls only |
| MHC-13 AI Agent Governance | 0 | A.5.9, A.5.16, A.8.27 | flanks robust controls only |
Implementation Guide: from gap to implementation
The Implementation Guide describes each of the 13 MHC in the same structure, so that leadership, IT and audit look things up in the same place:
- Control statement
- Purpose and threat reference
- Organizational implementation (leadership view)
- Technical implementation (for IT professionals)
- Implementation examples
- Maturity path (Initial, Defined, Managed)
- Measurement and audit evidence
- Typical mistakes
- Scope, residual risk and references
Prioritization by Threat Priority Score
The MHC are not a linear sequence. The guide correlates them with threat scenarios and computes a score per scenario: threat relevance × business impact × exposure × control gap, each on a scale from 1 to 5. The result is a standard tiering as an adaptable template:
P0 immediate
- MHC-03 Phishing-Resistant MFAHigh likelihood of occurrence, rapid risk reduction for admins and external access.
- MHC-08 Immutable BackupsBaseline capability against ransomware and destructive attacks.
- MHC-05 Behavior-Based DetectionWithout detection there is no robust response and no meaningful SOAR automation.
- MHC-04 Workload Identity and Zero TrustReduces lateral movement and is an enabler for AI agents.
P1 next
- MHC-02 SBOM and Build ProvenanceThe basis for supply chain transparency and pipeline testing.
- MHC-09 AI-Assisted Security TestingEffective where a pipeline and SBOM basis exist.
- MHC-11 SOAR and Tier-1 AutomationAutomate only once detection is stable.
- MHC-10 Continuous Control MonitoringA cross-cutting control for ongoing deviation detection.
P2 risk-based
- MHC-06 Containers and Confidential ComputingHighly relevant for container and cloud platforms.
- MHC-07 Multi-Tenancy IsolationDirectly applicable only for multi-tenant platforms or SaaS operations.
- MHC-13 AI Agent GovernanceHighly relevant where AI agents, tool calling or automation are in use; upgrade to P0 in that case.
- MHC-01 Post-Quantum Strategy and Cryptographic InventoryPrioritize higher for long-lived confidential data.
- MHC-12 Threat-Led Penetration TestingValidation after baseline implementation, then on a regular basis.
The tiering is an example for typical enterprise environments and must be aligned with the threat landscape, asset criticality and applicability. The score is ordinal: it ranks, it does not measure.
Market comparison
Fifteen positions, one question: what does a work contribute to an ISMS under the current Gen-AI threat landscape? Measured are Mythos and Gen-AI coverage and implementation readiness and auditability.
ISO/IEC 27002 alone is maximally certifiable, but as a 2022 work it has no answer to the Gen-AI threat landscape. This is not a judgement of the standard, only of its coverage of this threat landscape.
MRIS alone reaches the highest Gen-AI coverage in the field but is deliberately not a standalone ISMS: an effectiveness layer, not a replacement, and not certifiable without the standard as its foundation.
The combination of ISO/IEC 27002 and MRIS is the decision-relevant unit in practice: the highest Gen-AI coverage (9.4) and the highest execution strength (9.0) in the field. Certification still targets the ISMS under ISO/IEC 27001, with a Statement of Applicability extended by the 13 MHC.
All 15 positions as a table
| Work | Type | Gen-AI coverage | Readiness |
|---|---|---|---|
| ISO/IEC 27002 + MRIS for ISO 27001 | combination | 9.4 | 9.0 |
| MRIS for ISO 27001 (v2.0) | effectiveness layer | 9.4 | 6.5 |
| Mythos-Ready (CSA/SANS/[un]prompted/OWASP) | programme agenda | 8.8 | 4.6 |
| OWASP Top 10 for Agentic Applications | risk top 10 (community) | 7.8 | 3.8 |
| MITRE ATT&CK v19.2 / ATLAS | taxonomy / knowledge base | 6.8 | 6.4 |
| BSI C5:2026 | audit catalog | 5.4 | 9.0 |
| NIST AI RMF 1.0 + GenAI-Profil (AI 600-1) | governance framework | 5.0 | 5.8 |
| ISO/IEC 42001:2023 | management system standard | 4.6 | 6.2 |
| BSI A5 (AI Audit and Assurance Assessment Architecture) | audit catalog, community draft | 3.9 | 5.7 |
| CISA Zero Trust Maturity Model v2.0 | maturity model | 4.0 | 6.8 |
| NIST CSF 2.0 | framework | 3.6 | 7.0 |
| CSA Cloud Controls Matrix v4 | control catalog | 3.5 | 8.6 |
| CIS Controls v8.1 | practice framework | 3.2 | 7.6 |
| BSI IT-Grundschutz | standard / methodology | 3.0 | 8.4 |
| ISO/IEC 27002:2022 | standard | 2.2 | 9.0 |
What MRIS does and deliberately does not do
MRIS provides
- An effectiveness analysis of all 93 ISO/IEC 27002 controls against the AI threat
- A gap analysis against C5:2026, NIST, DORA, CRA and NIS2
- An audit-ready catalog of 13 Mythos Hardening Controls with maturity levels
- A bridge into the risk process under ISO/IEC 27005
MRIS deliberately does not provide
- A full ISMS; an established ISMS is assumed
- A risk-management process of its own
- A compliance-mapping or certification tool
- An organization-specific policy hierarchy
Analyzed against ISO/IEC 27001:2022, ISO/IEC 27002:2022, BSI C5:2026, NIST, DORA, CRA, the NIS2 Directive and the NIS2 IR.
Downloads
New in edition 2.0 (September 2026): quality release following external review (subject matter, leadership perspective, audit logic), a binding reading of the maturity levels (Initial is not evidence of implementation) and the control statements of all 13 MHC synchronized to the Defined level.
| Publication | Edition | Date | License | Files |
|---|---|---|---|---|
| MRIS analysis | 2.0 | September 2026 | CC BY-SA 4.0 | DEEN |
| Implementation Guide | 2.0 | September 2026 | CC BY-SA 4.0 | DEEN |
| Machine-readable edition | 2.0 | September 2026 | CC BY-SA 4.0 | YAML |
MRIS and the Implementation Guide are working aids for analyzing the effectiveness of existing security controls. They assume an established ISMS and do not replace it. They do not constitute legal, compliance or certification advice, make no claim to completeness and establish no warranty. Use is at your own responsibility.