ISO 27001 domain compliance check
Auditors and ISMS owners use this to gather outside-in evidence for Annex A controls in minutes: email authentication for A.5.14, TLS for A.8.24, exposed services for A.8.20, configuration for A.8.9, with a dated result you can keep.
What this check covers
Each check below names the ISO/IEC 27001:2022 Annex A control it supports.
Email sender authentication
SPF, DKIM and DMARC records, policy strength and alignment, BIMI
Stops others sending email that claims to be you. A DMARC policy of quarantine or reject is the evidence; p=none is monitoring only.
Email in transit
MTA-STS, TLS-RPT, DANE and STARTTLS on every MX
Shows mail between servers is encrypted and can’t be quietly downgraded to plain text.
Web encryption
Certificate validity, chain, expiry, protocol versions and HSTS
Evidence that data to and from the website uses current, strong cryptography and that certificates are managed before they expire.
Website hardening
Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy), redirects, HTTP to HTTPS
Secure configuration applied to the public face of the organisation, and a baseline to detect drift against.
DNS integrity
DNSSEC chain of trust, CAA records, lame or open nameservers
Protects the name everything else depends on from spoofing, and limits who can issue certificates for it.
Resilience
Nameserver count and diversity, SOA timers, MX redundancy, propagation from many regions
One nameserver or one mail server is a single point of failure. Redundancy here supports continuity plans.
Exposed services
Common ports open to the internet, from outside the network
Remote desktop, databases and admin panels facing the internet are the usual way in. Outside-in evidence the boundary does what the policy says.
Reputation
Domain and mail server IPs on spam and threat blocklists
A listing is often the first sign of a compromised mailbox or server.
Domain ownership
Registrar, expiry date, transfer lock, registrant privacy
An expired or unlocked domain can be lost or hijacked. The registrar is a supplier like any other.
Attack surface
Subdomains seen in certificate logs and DNS, dangling records
You can’t protect what isn’t on the asset register. Old subdomains pointing at deleted cloud resources can be taken over.
This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.
Guides for auditors
All guidesQuestions
Check a domain against ISO/IEC 27001:2022 Annex A controls you can evidence from outside: A.5.14 information transfer, A.8.24 cryptography, A.8.20 networks security, A.8.9 configuration and more.