d-centralize runs one information security management system (ISMS) for the holding, its companies and the
products they run, aligned with ISO/IEC 27001:2022. This section is the ISMS: it follows the structure of the
standard, so every clause and every Annex A control has one place that says how we meet it.
- The clause pages 4 to 10 describe how we meet each requirement of the standard and link to the evidence.
- The Statement of Applicability lists the 93 Annex A controls, whether they apply, why,
which role owns them, and which policy covers them.
- The policies under Policies state the rules per topic. They are short on purpose and link to the handbook
pages that hold the detailed procedures.
- Records live in private GitLab issues, linked from these pages. Employees have access; auditors get access during
an audit.
- Every change goes through a merge request, see documented information.
