The gap between "we have controls" and "we can prove it"
Most organisations pursuing ISO/IEC 27001 certification spend significant effort implementing technical controls - firewalls, access management, patch processes, log retention. The harder problem is demonstrating to an auditor that those controls are actually functioning day-to-day, not just configured once and forgotten. That's the gap between having an Information Security Management System (ISMS) on paper and having one that holds up under scrutiny.
Wazuh, the open-source SIEM and XDR platform, doesn't just detect threats - it generates a continuous, timestamped record that your controls are operating as intended. That record is exactly what an ISO 27001 audit requires.
Important note: the October 2025 deadline for transitioning from ISO 27001:2013 to the 2022 revision has passed. If your organisation is still working toward initial certification, or renewing, you are working to the 2022 standard. This article covers the controls in that version.
What changed in ISO 27001:2022
The 2022 revision reorganised Annex A from 114 controls across 14 clauses down to 93 controls across 4 themes: Organisational, People, Physical, and Technological. Eleven controls are entirely new. For technology-driven businesses, the most significant additions sit in the Technological theme (Section 8), and they are precisely the areas where a SIEM like Wazuh produces the most useful evidence.
The seven new technological controls are:
- 8.9 - Configuration Management
- 8.10 - Information Deletion
- 8.11 - Data Masking
- 8.12 - Data Leakage Prevention
- 8.16 - Monitoring Activities
- 8.23 - Web Filtering
- 8.28 - Secure Coding
How Wazuh maps to the key controls
Below is a practical mapping of Wazuh's core modules to the ISO 27001:2022 controls they most directly support. This is not exhaustive - Wazuh touches many more controls indirectly - but these are the areas where it generates the clearest, most auditable evidence.
| ISO 27001:2022 Control | Wazuh Module | What Evidence It Produces |
|---|---|---|
| 8.9 - Configuration Management | Security Configuration Assessment (SCA) | Periodic scans against CIS benchmarks and custom policies; pass/fail records with timestamps for every assessed system. |
| 8.15 - Logging | Log Collection & Management | Centralised, tamper-evident log archive from Linux servers, Windows endpoints, firewalls, cloud platforms, and applications. |
| 8.16 - Monitoring Activities | Threat Detection & Alerting | Real-time alerts with rule IDs, timestamps, source systems, and severity levels - a continuous record that monitoring is active. |
| 8.8 - Vulnerability Management | Vulnerability Detector | Automated CVE scanning across all agents, with severity ratings and remediation tracking - maps directly to the vulnerability management process requirement. |
| 8.3 / 8.5 - Access Control & Authentication | Authentication Log Analysis | Failed login attempts, privilege escalation events, sudo usage, SSH key changes - all correlated across systems to surface unauthorised access patterns. |
| 8.7 - Protection Against Malware | Malware Detection & Rootkit Check | Host-based malware scanning, rootkit detection, and alerts on suspicious process behaviour with full process and file path context. |
| 8.32 - Change Management | File Integrity Monitoring (FIM) | Records every change to critical files and directories - who changed what, when, and from what previous state. Directly supports change authorisation audit trails. |
| 8.28 - Secure Coding | CI/CD Log Ingestion | Ingests events from Jenkins, GitLab, and GitHub pipelines to evidence that security checks are embedded in the development process. |
| 5.33 - Protection of Records | Centralised Log Retention | Immutable, searchable log store with configurable retention periods - demonstrates that records are protected against loss, tampering, and unauthorised access. |
| 8.16 / 5.25 - Incident Management | Incident Response & Active Response | Automated response actions (blocking IPs, isolating processes) with full audit trail - demonstrates that incidents are detected and responded to, not just logged. |
The SCA module deserves particular attention
Control 8.9 (Configuration Management) is one of the areas where organisations most commonly struggle to produce evidence. Policies say "systems will be hardened to a baseline standard" - but without tooling, proving that at audit time means manually screenshotting configuration settings across every server. Wazuh's Security Configuration Assessment module runs periodic scans automatically, compares each system against a defined policy (CIS benchmarks, custom rules, or both), and records the outcome with timestamps. An auditor can look at a dashboard showing 94% compliance across 23 servers, drill into the 6% failures, and see exactly what remediation was done and when. That's the kind of evidence that closes findings quickly.
File Integrity Monitoring as a change-management audit trail
Control 8.32 requires that changes to information processing systems are managed in a controlled way. FIM is the technical backbone of that evidence. Wazuh monitors defined directories and files - configuration files, web roots, SSH authorised keys, cron jobs - and records every modification: the file path, the previous hash, the new hash, the timestamp, and the process that made the change. In an audit, this answers the question "how do you know no unauthorised changes were made to your production systems?" with a searchable, timestamped log rather than a verbal assurance.
Compliance dashboards and out-of-the-box reporting
Wazuh ships with pre-built compliance dashboards covering ISO 27001, PCI DSS, HIPAA, GDPR, and NIST 800-53. Alerts are automatically tagged with the relevant control reference as they fire, which means your compliance posture is visible in real time - not assembled manually the week before an audit. Dashboards can be exported, scheduled reports generated, and specific date ranges queried to produce evidence for any audit period.
For South African businesses, the overlap with POPIA requirements is also significant. The centralised logging, access monitoring, and incident detection capabilities that satisfy ISO 27001 controls also directly address POPIA's "appropriate technical and organisational measures" obligation - particularly around breach detection and notification timelines.
What Wazuh doesn't cover
It's important to be clear about the limits. Wazuh is a monitoring and detection platform - it doesn't implement controls, it provides evidence that controls are working. It can't, by itself, satisfy controls that are primarily organisational rather than technical: things like human resources security (Annex A.6), supplier relationship management (A.5.19–5.22), or business continuity planning. Those require documented processes, training records, and contractual arrangements that sit outside what any SIEM can provide.
It also can't substitute for a formal risk assessment and Statement of Applicability, which are the foundation of any ISO 27001 ISMS. What it does is make the technical evidence for the controls you've implemented significantly easier to collect, maintain, and present.
Getting started in a South African context
For businesses in Johannesburg, Cape Town, or elsewhere in South Africa working toward ISO 27001 certification, the practical starting point is usually a security assessment that identifies which controls you already satisfy, which have gaps, and which are simply undocumented. From there, deploying Wazuh against your existing Linux server infrastructure typically closes a significant portion of the technical evidence gaps within the first few weeks - before any process documentation work begins.
The advantage of starting with an open-source platform is cost predictability. There is no per-agent licensing fee, which matters when you're deploying across 20 or 50 servers. The evidence quality is the same whether you're a 30-person business or a 300-person one.
Working toward ISO 27001 certification?
We deploy and manage Wazuh for South African businesses and can map your current environment to the controls you need to evidence.
