Teaser only. This is not the full article. Complete guide mapping 12 DNS records to Annex A 2022: ISO 27001: 12 Email DNS Records That Matter
Stage 2 asks for email transfer controls. You open a 40-page acceptable use policy. The assessor asks for twelve queryable DNS objects.
ISO/IEC 27001:2022 maps Annex A to SPF, DKIM, enforced DMARC, MTA-STS, TLS-RPT, DNSSEC, CAA, and subdomain policies. Authentication without operating evidence still fails A.8.16 monitoring arguments.
Stage 2 does not care that DMARC was "planned for Q3" since the last cycle.
dig _dmarc.example.com TXT +short
p=none through your certification window is a finding waiting for A.8.7.
In the full post on zerohook.org:
- All 12 records with Annex A control IDs
- Evidence samples for each record type
- Stage 2 remediation priority order
- Overlap with NIS2 and SOC2 evidence reuse
Read the full guide: ISO 27001: 12 Email DNS Records That Matter
Top comments (0)