[VITI Science Exclusive] ISO 27001 is a State Machine: Turning Annex A into Executable Physics ⚙️🔒

The traditional approach to ISO 27001:2022 Annex A is a bureaucratic nightmare. It involves writing 93 heavy Word documents, hosting endless workshops, and storing it all in a SharePoint graveyard just to pass an annual audit.

Under the Business Impact Governance Framework (BIGF), we apply the Zero Workshops philosophy. Instead of writing policies that humans will ignore, we build a single deterministic runtime engine. We wire the four main themes of the standard directly into sensor data and execute them as a state machine.

Here is the architectural blueprint for the BIGF Executable Code library. This is how you replace Governance Theater with physics.

1. The Repository Structure (Killing SharePoint)

This structure replaces the traditional document hell with a single, clear Git repository that both developers and auditors can read:

bigf-iso27001-runtime/
├── core/
│   ├── physics_engine.py       # P = f(B x S x T) fixed-point math & evaluation
│   ├── fail_closed.py          # 403 Hard Halt & Containment Cage logic
│   ├── crypto_attestation.py   # Ed25519 signatures & cryptographic audit trails
│   └── telemetry_bus.py        # Sensor data reader (eBPF, OT sensors, SIEM)
├── controls/
│   ├── A5_organizational/      # 37 controls (authorization, supplier risk, exceptions)
│   ├── A6_people/              # 8 controls (access revocation, role changes)
│   ├── A7_physical/            # 14 controls (datacenter sensors, access, power/thermal)
│   └── A8_technological/       # 34 controls (change management, logging, crypto, capacity)
├── audit_translator/
│   └── ANNEX_A_MATRIX.md       # Automated translation matrix for auditors (Clause -> Code)
└── bigf_manifest.yaml          # The centralized BIA weight definitions for the enterprise

2. The Core Engine (physics_engine.py)

All 93 controls call this exact same core. Once this is coded, no single control can slip into "human interpretation."

import time

class BIGFPhysicsEngine:
    def __init__(self, bia_weight: float, min_authority: float, max_telemetry_age_ms: int):
        self.bia_weight = bia_weight
        self.min_authority = min_authority
        self.max_telemetry_age_ms = max_telemetry_age_ms

    def evaluate(self, telemetry_timestamp_ms: int, security_score: float, crypto_valid: bool) -> dict:
        now_ms = int(time.time() * 1000)
        telemetry_age = now_ms - telemetry_timestamp_ms

        # 1. Telemetry Blindness Check (T) - Fail-Closed
        if telemetry_age > self.max_telemetry_age_ms:
            return {"status": "403_HARD_HALT", "reason": "TELEMETRY_BLINDNESS", "cage": True}

        # 2. Cryptographic Integrity (S)
        if not crypto_valid:
            return {"status": "403_HARD_HALT", "reason": "CRYPTO_ATTESTATION_FAILED", "cage": True}

        # 3. Deterministic Authority Formula: P = f(B x S x T)
        integrity_factor = max(0.0, 1.0 - (telemetry_age / self.max_telemetry_age_ms))
        authority_score = round(self.bia_weight * security_score * integrity_factor, 4)

        if authority_score < self.min_authority:
            return {
                "status": "403_HARD_HALT",
                "reason": f"AUTHORITY_BELOW_THRESHOLD ({authority_score} < {self.min_authority})",
                "cage": True
            }

        return {"status": "200_ALLOW", "authority": authority_score, "cage": False}

3. Translating the Annex A Categories into Code

Here is how each of the four main Annex A categories transforms into executable code without a single PDF document:

A. Organizational Controls: A.5.15_access_control.py

• Traditional Theater: RACI matrices and static Excel permission lists.
• BIGF Execution: Eliminates static roles. Access is calculated live based on the Business Impact Analysis (BIA) and the current security posture.

from core.physics_engine import BIGFPhysicsEngine

def enforce_a5_15_access(request_context, idp_telemetry):
    # Critical financial interface (BIA = 0.99)
    engine = BIGFPhysicsEngine(bia_weight=0.99, min_authority=0.92, max_telemetry_age_ms=1000)

    # security_score flows directly from Zero Trust / MFA / MDM sensors
    decision = engine.evaluate(
        telemetry_timestamp_ms=idp_telemetry.last_verified_ms,
        security_score=idp_telemetry.device_trust_score,
        crypto_valid=request_context.has_valid_ed25519_token
    )
    return decision

B. People Controls: A.6.5_termination_or_change.py

• Traditional Theater: HR sends an email to IT support, who disables the account next week.
• BIGF Execution: The HR system state is wired directly to the runtime gate. If the status drops, all keys and sessions are severed in milliseconds.

def enforce_a6_5_hr_sync(actor_id, hr_sensor_stream, active_sessions):
    hr_state = hr_sensor_stream.get_live_status(actor_id)

    if hr_state.status != "ACTIVE" or hr_state.clearance_revoked:
        # Instant Fail-Closed revocation across all environments
        active_sessions.revoke_all_tokens(actor_id)
        active_sessions.lock_in_containment_cage(actor_id)
        return {"control": "A.6.5", "action": "INSTANT_REVOCATION_EXECUTED"}

    return {"control": "A.6.5", "action": "VERIFIED_ACTIVE"}

C. Physical Controls: A.7.11_supporting_utilities.py

• Traditional Theater: A datacenter checklist signed once a month.
• BIGF Execution: Reads directly from environmental and UPS sensors. If cooling fails, the engine autonomously sheds low-BIA workloads to protect the core.

def enforce_a7_11_datacenter_physics(ups_sensor, thermal_sensor, workload_manager):
    # If running on battery AND capacity < 40%, OR temp > 32°C
    if (ups_sensor.on_battery and ups_sensor.battery_pct < 40) or thermal_sensor.temp_c > 32.0:
        # BIA dictates survival: kill all workloads with BIA < 0.90 to save the core business
        workload_manager.shed_loads_below_bia(threshold=0.90)
        return {"control": "A.7.11", "state": "SURVIVAL_MODE_ACTIVE", "non_critical": "TERMINATED"}

    return {"control": "A.7.11", "state": "NOMINAL"}

D. Technological Controls: A.8.15_logging.py

• Traditional Theater: Logs are dumped into a bucket and ignored until an incident happens.
• BIGF Execution: Makes logging a strict prerequisite for runtime. If the SIEM pipeline chokes, the production system refuses to process transactions. "We do not drive blind."

def enforce_a8_15_telemetry_integrity(siem_pipeline_sensor, api_gateway):
    if not siem_pipeline_sensor.is_writing or siem_pipeline_sensor.write_lag_ms > 250:
        # If the audit trail breaks, the system goes into immediate Hard Halt
        api_gateway.set_global_fail_closed(reason="ISO-27001-A.8.15-LOG-SINK-FAILURE")
        return {"status": "403_HARD_HALT", "audit_trail": "BROKEN"}

    return {"status": "200_OPERATIONAL", "audit_trail": "CRYPTO_VERIFIED"}

4. The 93-Control Scaling Matrix (ANNEX_A_MATRIX.md)

This matrix dictates how the remaining 93 controls are sorted into four code-based design patterns—without writing a single new PDF document:

Annex A Domain	Count	BIGF Code Pattern	Replaces Traditional Theater
A.5 Organizational	37	Policy-as-Code & Dynamic Authority: Permissions, APIs, and rules run through a JSON engine.	RACI matrices, static policy PDFs, annual vendor Excel surveys.
A.6 People	8	Identity Telemetry Sync: HR and training system states wired directly to IAM/Zero Trust gates.	Manual Jira tickets for access removal, paper NDA binders.
A.7 Physical	14	OT/IoT Sensor Circuit Breakers: Access control, thermal, and power sensors dictate server runtime.	Visitor logbooks, monthly facility walkthrough checklists.
A.8 Technological	34	Runtime Gates & Fail-Closed Pipelines: CI/CD checks, live SIEM integrity, and BIA-based load balancing.	CAB meetings, manual change tickets, rearview-mirror dashboards.

How to Deploy (Without Consultants)

1. Code the core/ folder (roughly 200 lines of Python).
2. Define your organization's true BIA weights in a single bigf_manifest.yaml file.
3. Wire your sensors (Prometheus, SIEM, HR-API) to feed the telemetry_bus.py.
4. When the auditor arrives, run a script that prints out a cryptographically signed log of real-time production decisions. Watch them weep as their checklists become obsolete.

---

(Business Impact Governance Framework by Erkki Laine - Designed in Turku, Enforced by Physics)

Just google it: BIG framework Erkki Laine

UPDATE (Nov 2026):
Stop writing Non-Conformances. Start writing State Machines. The official BIGF "Your Auditor reads PDFs. My Architecture executes Physics." gear is available.
👉 [VITI Labs Official Store: viti-labs.myspreadshop.fi]