---
title: Statement of Applicability (SoA)
description: This Statement of Applicability covers the information security management system (ISMS) of HealthSafe, encompassing the SecurePass platform and associated cloud-based services for Visitor Management, Contractor Management, Employee Sign-In, and Risk Management. The ISMS scope includes all information assets, personnel, processes, and technology supporting the delivery of these SaaS services from HealthSafe's operational locations in Australia and New Zealand.
---

[Skip to content](https://support.healthsafe.co/statement-of-applicability#main-content)

English

Show submenu for translations

[More support](https://support.healthsafe.co/kb-tickets/new?hsLang=en)

[![HealthSafe\_Logo&Wordmark\_DarkColour\_2000x581@3x](https://support.healthsafe.co/hs-fs/hubfs/HealthSafe_Logo%26Wordmark_DarkColour_2000x581@3x.png?width=300&height=87&name=HealthSafe_Logo%26Wordmark_DarkColour_2000x581@3x.png)](https://support.healthsafe.co/?hsLang=en)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [More support](https://support.healthsafe.co/kb-tickets/new)

 Welcome to HealthSafe. How can we help?

- There are no suggestions because the search field is empty.

1. [HealthSafe Help Center](https://support.healthsafe.co/?hsLang=en)
2. [HS ISO27001 Documents](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en)
3. [Level 3 Supporting Procedures](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-3-supporting-procedures)

# Statement of Applicability (SoA)

## ISO/IEC 27001:2022 — Annex A Controls

| Document Title: | Statement of Applicability |
| --- | --- |
| Standard: | ISO/IEC 27001:2022 |
| Organisation: | HealthSafe (healthsafe.co) |
| Industry: | Workplace Safety & Visitor Management Software (SaaS) |
| Document Owner: | Information Security Manager |
| Classification: | Confidential |
| Current Version: | 2.2 |
| Date of Issue: | 03/11/2025 |
| Next Review Date: | 03/11/2026 |
| Prepared By: | CISO |
| Approved By: | CEO |
|  |  |
| Scope |  |
| This Statement of Applicability covers the information security management system (ISMS) of HealthSafe, encompassing the SecurePass platform and associated cloud-based services for Visitor Management, Contractor Management, Employee Sign-In, and Risk Management. The ISMS scope includes all information assets, personnel, processes, and technology supporting the delivery of these SaaS services from HealthSafe's operational locations in Australia and New Zealand. |  |
|  |  |
| Exclusion Summary |  |
| Controls within Annex A Section 7 (Physical Controls) and Section 8.25, 8.27- 8.29, 8.31, 8.33 (Software Development and testing), as well as Supplier Relationship controls (A.5.19 – A.5.23), have been excluded from this SoA. HealthSafe operates as a cloud-native SaaS organisation with no company-owned physical data centres or server rooms. All infrastructure is hosted by certified third-party cloud service providers (e.g., AWS/Azure). Supplier relationship controls are excluded as HealthSafe does not maintain an extensive physical supply chain; cloud provider security is governed through contractual SLAs and due diligence rather than direct physical oversight. |  |

| Version | Date | Author | Approved By | Description of Changes |
| --- | --- | --- | --- | --- |
| 1.0 | 01/06/2018 | CISO | MD | Initial SoA created based on ISO/IEC 27001:2013 Annex A (114 controls across 14 domains). Baseline applicability assessment completed. |
| 1.1 | 15/06/2019 | CISO | MD | Annual review — minor updates to justification text for A.9 (Access Control) and A.12 (Operations Security). No changes to applicability decisions. |
| 1.2 | 01/07/2020 | CISO | MD | Annual review — updated exclusion rationale for A.11 (Physical and Environmental Security) to reflect full migration to cloud-hosted infrastructure. |
| 1.3 | 30/06/2021 | CISO | MD | Annual review — added justifications for remote working controls following COVID-19 operational changes. Updated supplier controls rationale. |
| 2.0 | 15/11/2022 | CISO | MD | Major revision — Transitioned SoA from ISO/IEC 27001:2013 (114 controls, 14 domains) to ISO/IEC 27001:2022 (93 controls, 4 themes). Remapped all existing controls to new Annex A structure. Updated applicability, justifications, and exclusions in line with the 2022 standard. Physical controls (Section 7) and Supplier Relationship controls (A.5.19–A.5.23) excluded. |
| 2.1 | 20/11/2023 | CISO | CEO | Annual review under ISO 27001:2022. Confirmed all applicability decisions remain current. Minor wording updates. |
| 2.2 | 03/11/2025 | CISO | CEO | Annual review under ISO 27001:2022. Confirmed all applicability decisions remain current. Minor wording updates. |

 

| Control ID | Control Name | Applicable (Yes / No) | Justification / Exclusion Rationale | Implementation Status | Implementation Notes |
| --- | --- | --- | --- | --- | --- |
| 5 — Organisational Controls (37 controls) |  |  |  |  |  |
| A.5.1 | Policies for information security | Yes | Required to establish management direction and support for information security in accordance with business requirements and applicable legislation. | Implemented | Information security policy suite approved by senior management and communicated to all personnel. |
| A.5.2 | Information security roles and responsibilities | Yes | Necessary to define and allocate information security responsibilities to ensure accountability across the organisation. | Implemented | RACI matrix maintained; CISO, IT Manager, and team leads assigned specific security responsibilities. |
| A.5.3 | Segregation of duties | Yes | Required to reduce the risk of fraud, error, and unauthorised access by ensuring no single individual controls all aspects of a critical process. | Implemented | Duties segregated across development, operations, and security functions; enforced via role-based access. |
| A.5.4 | Management responsibilities | Yes | Management must demonstrate leadership and commitment to the ISMS to ensure its effectiveness and alignment with business objectives. | Implemented | Management reviews conducted quarterly; security objectives included in business planning. |
| A.5.5 | Contact with authorities | Yes | Required to ensure appropriate contacts with relevant authorities (e.g., data protection regulators, law enforcement) are maintained. | Implemented | Contact register maintained for OAIC, CERT Australia, NZ Privacy Commissioner, and NZ CERT. |
| A.5.6 | Contact with special interest groups | Yes | Necessary to maintain awareness of current threats, vulnerabilities, and best practices through engagement with professional security forums. | Implemented | Memberships maintained with AuSCERT, AISA, and relevant cloud security alliances. |
| A.5.7 | Threat intelligence | Yes | Required to collect and analyse information about threats to enable informed risk-based security decisions. | Implemented | Threat intelligence feeds integrated into SIEM; quarterly threat landscape reviews conducted. |
| A.5.8 | Information security in project management | Yes | Necessary to ensure information security is integrated into project management processes regardless of the type of project. | Implemented | Security gates embedded in SDLC; security review mandatory at project initiation and design phases. |
| A.5.9 | Inventory of information and other associated assets | Yes | Required to identify and maintain an inventory of information assets to enable appropriate protection. | Implemented | Asset register maintained in CMDB covering all information assets, software, and cloud resources. |
| A.5.10 | Acceptable use of information and other associated assets | Yes | Necessary to ensure employees and contractors understand and follow rules for the acceptable use of information assets. | Implemented | Acceptable use policy signed by all personnel upon onboarding and reviewed annually. |
| A.5.11 | Return of assets | Yes | Required to ensure all organisational assets are returned upon termination of employment, contract, or agreement. | Implemented | Offboarding checklist includes return/revocation of all assets and access credentials. |
| A.5.12 | Classification of information | Yes | Necessary to ensure information receives an appropriate level of protection in accordance with its importance to the organisation. | Implemented | Four-tier classification scheme (Public, Internal, Confidential, Restricted) applied to all assets. |
| A.5.13 | Labelling of information | Yes | Required to ensure information is appropriately labelled in accordance with the adopted classification scheme. | Implemented | Labelling procedures implemented across documents, emails, and cloud storage. |
| A.5.14 | Information transfer | Yes | Necessary to maintain the security of information transferred within or outside the organisation via all types of communication. | Implemented | TLS enforced for all data in transit; secure file transfer mechanisms in place. |
| A.5.15 | Access control | Yes | Required to ensure access to information and information processing facilities is restricted based on business and security requirements. | Implemented | Role-based access control (RBAC) implemented across all systems; least privilege principle enforced. |
| A.5.16 | Identity management | Yes | Necessary to manage the full lifecycle of identities to ensure unique identification and authentication of users. | Implemented | Centralised identity provider (IdP) with unique user IDs; lifecycle management automated. |
| A.5.17 | Authentication information | Yes | Required to ensure the secure allocation and management of authentication information (e.g., passwords, MFA tokens). | Implemented | MFA enforced for all users; password policy aligned with NIST 800-63B guidelines. |
| A.5.18 | Access rights | Yes | Necessary to ensure access rights are provisioned, reviewed, and revoked in accordance with the access control policy. | Implemented | Quarterly access reviews conducted; automated provisioning/deprovisioning via IdP. |
| A.5.19 | Information security in supplier relationships | No | Excluded — HealthSafe operates as a cloud-native SaaS provider without a traditional physical supply chain. Cloud service provider security is governed through contractual SLAs, due diligence assessments, and reliance on provider certifications (e.g., SOC 2, ISO 27001). Direct supplier ISMS oversight is not applicable. | Not Applicable | Cloud provider compliance verified via SOC 2 / ISO 27001 certificates. |
| A.5.20 | Addressing information security within supplier agreements | No | Excluded — As above. Security requirements are embedded in cloud service agreements and standard terms of service rather than bespoke supplier ISMS agreements. HealthSafe does not procure physical goods or outsource core security functions. | Not Applicable | Security clauses included in cloud service contracts. |
| A.5.21 | Managing information security in the ICT supply chain | No | Excluded — HealthSafe's ICT supply chain risk is limited to cloud infrastructure providers (e.g., AWS/Azure) whose supply chain security is managed under their own certified ISMS. HealthSafe does not manage upstream hardware or component supply chains. | Not Applicable | Cloud provider supply chain managed under their own ISO 27001 certification. |
| A.5.22 | Monitoring, review and change management of supplier services | No | Excluded — Ongoing monitoring of cloud provider performance is conducted through service dashboards and uptime SLAs rather than formal supplier ISMS audit programmes. This control's intent is partially addressed through operational monitoring. | Not Applicable | Cloud service uptime and incidents monitored via provider dashboards. |
| A.5.23 | Information security for use of cloud services | Yes | This control is applicable as there are business as well as contractual requirements to ensure that processes for acquisition, use, management and exit from cloud services are established in cloud service agreements. | Implemented | Processes for acquisition,use,management and exit from cloud services are established in accordance with the organisation's information security requirement. |
| A.5.24 | Information security incident management planning and preparation | Yes | Required to ensure a consistent and effective approach to the management of information security incidents. | Implemented | Incident response plan documented, tested annually via tabletop exercises. |
| A.5.25 | Assessment and decision on information security events | Yes | Necessary to ensure information security events are assessed and classified to determine if they constitute incidents. | Implemented | Triage process defined with severity classification matrix. |
| A.5.26 | Response to information security incidents | Yes | Required to ensure incidents are responded to in accordance with documented procedures to minimise impact. | Implemented | Incident response procedures include containment, eradication, and recovery steps. |
| A.5.27 | Learning from information security incidents | Yes | Necessary to ensure knowledge gained from incidents is used to strengthen the organisation's security posture. | Implemented | Post-incident reviews conducted; lessons learned fed into risk register and control improvements. |
| A.5.28 | Collection of evidence | Yes | Required to ensure evidence related to information security incidents is collected and preserved for potential legal or disciplinary proceedings. | Implemented | Evidence collection procedures aligned with forensic best practices; chain of custody documented. |
| A.5.29 | Information security during disruption | Yes | Necessary to ensure information security is maintained during adverse situations such as crises or disasters. | Implemented | BCP/DRP includes information security provisions; tested bi-annually. |
| A.5.30 | ICT readiness for business continuity | Yes | Required to ensure ICT services are sufficiently resilient and recoverable to meet business continuity requirements. | Implemented | RTO/RPO defined for all critical systems; automated failover configured for production environment. |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Yes | Necessary to identify and comply with all relevant legal, regulatory, and contractual requirements related to information security. | Implemented | Compliance register maintained covering Privacy Act (AU/NZ), GDPR (where applicable), and contractual obligations. |
| A.5.32 | Intellectual property rights | Yes | Required to ensure compliance with legal and contractual requirements related to intellectual property and use of proprietary software. | Implemented | Software asset management and licence compliance procedures in place. |
| A.5.33 | Protection of records | Yes | Necessary to ensure records are protected from loss, destruction, falsification, and unauthorised access in accordance with legal and business requirements. | Implemented | Records retention schedule defined; secure storage with access controls and audit logging. |
| A.5.34 | Privacy and protection of personal identifiable information (PII) | Yes | Required to ensure compliance with applicable privacy legislation and contractual requirements regarding the processing of PII. | Implemented | Privacy impact assessments conducted; data processing agreements in place with all processors. |
| A.5.35 | Independent review of information security | Yes | Necessary to ensure the continuing suitability, adequacy, and effectiveness of the ISMS through independent assessment. | Implemented | Annual independent ISMS audit conducted by accredited certification body. |
| A.5.36 | Compliance with policies, rules and standards for information security | Yes | Required to ensure compliance of information processing within the organisation with security policies and standards. | Implemented | Internal compliance checks conducted quarterly; non-conformities tracked to resolution. |
| A.5.37 | Documented operating procedures | Yes | Necessary to ensure correct and secure operations of information processing facilities through documented procedures. | Implemented | Operating procedures documented in knowledge base; reviewed and updated annually. |
| 6 — People Controls (8 controls) |  |  |  |  |  |
| A.6.1 | Screening | Yes | Required to ensure background verification checks on all candidates for employment are carried out in accordance with relevant laws and proportionate to business requirements. | Implemented | Pre-employment screening including identity verification and reference checks for all roles. |
| A.6.2 | Terms and conditions of employment | Yes | Necessary to ensure employees and contractors acknowledge and agree to their information security responsibilities. | Implemented | Employment contracts include information security clauses; NDAs signed by all personnel. |
| A.6.3 | Information security awareness, education and training | Yes | Required to ensure all personnel receive appropriate security awareness training relevant to their job functions. | Implemented | Mandatory annual security awareness training; role-specific training for developers and administrators. |
| A.6.4 | Disciplinary process | Yes | Necessary to ensure a formal disciplinary process exists for personnel who commit information security breaches. | Implemented | Disciplinary process documented in HR policy; linked to information security policy violations. |
| A.6.5 | Responsibilities after termination or change of employment | Yes | Required to protect the organisation's interests during and after changes to or termination of employment. | Implemented | Post-employment obligations defined in contracts; exit interviews include security reminders. |
| A.6.6 | Confidentiality or non-disclosure agreements | Yes | Necessary to ensure personnel and external parties understand and agree to protect confidential information. | Implemented | NDAs executed with all employees, contractors, and third parties with access to confidential information. |
| A.6.7 | Remote working | Yes | Required to ensure information security is maintained when personnel work remotely. | Implemented | Remote working policy in place; VPN, endpoint protection, and secure access enforced for all remote workers. |
| A.6.8 | Information security event reporting | Yes | Necessary to ensure personnel report observed or suspected information security events through appropriate channels. | Implemented | Reporting channels established via ticketing system and direct escalation path; awareness training covers reporting. |
| 7 — Physical Controls (14 controls) — ALL EXCLUDED |  |  |  |  |  |
| A.7.1 | Physical security perimeters | No | Excluded — HealthSafe is a cloud-native SaaS organisation. All infrastructure is hosted by certified third-party cloud providers (e.g., AWS/Azure) who maintain their own physical security perimeters under their certified ISMS. HealthSafe does not own or operate data centres or server rooms. | Not Applicable | Physical security managed by cloud provider under their ISO 27001 / SOC 2 certification. |
| A.7.2 | Physical entry | No | Excluded — HealthSafe does not operate physical data centres. Office premises security is managed by building management; no sensitive information processing facilities require dedicated physical entry controls beyond standard office security. | Not Applicable | Office access managed by building management. |
| A.7.3 | Securing offices, rooms and facilities | No | Excluded — No dedicated secure rooms or facilities are required as all processing occurs in cloud environments. Standard office security is maintained by building management. | Not Applicable | Cloud-hosted infrastructure eliminates need for dedicated secure facilities. |
| A.7.4 | Physical security monitoring | No | Excluded — HealthSafe does not operate facilities requiring dedicated physical security monitoring. Cloud provider facilities include 24/7 physical monitoring under their own certifications. | Not Applicable | Cloud provider maintains physical security monitoring. |
| A.7.5 | Protecting against physical and environmental threats | No | Excluded — Protection against environmental threats (fire, flood, earthquake) for information processing facilities is the responsibility of the cloud service provider under their certified ISMS. | Not Applicable | Environmental protection managed by cloud provider. |
| A.7.6 | Working in secure areas | No | Excluded — HealthSafe does not maintain secure areas for information processing. All sensitive processing is cloud-based. | Not Applicable | No secure areas operated by HealthSafe. |
| A.7.7 | Clear desk and clear screen | No | Excluded — While good practice, formal clear desk/screen controls are not applicable as HealthSafe's workforce is predominantly remote/hybrid and no classified physical documents are maintained. Endpoint security and screen lock policies provide equivalent protection. | Not Applicable | Endpoint security policies provide equivalent protection. |
| A.7.8 | Equipment siting and protection | No | Excluded — HealthSafe does not site or protect information processing equipment in physical locations. All production infrastructure is cloud-hosted. | Not Applicable | Cloud-hosted; no on-premise equipment to site. |
| A.7.9 | Security of assets off-premises | No | Excluded — Organisational assets used off-premises are limited to employee laptops, which are protected through endpoint security controls (encryption, MDM) addressed under technological controls rather than physical controls. | Not Applicable | Endpoint security covers off-premises assets. |
| A.7.10 | Storage media | No | Excluded — HealthSafe does not use removable storage media. Data is stored exclusively in encrypted cloud storage. Policy prohibits the use of removable media. | Not Applicable | No removable storage media in use; cloud-only storage. |
| A.7.11 | Supporting utilities | No | Excluded — Supporting utilities (UPS, generators, HVAC) for information processing facilities are managed by the cloud service provider. HealthSafe office utilities do not support critical information processing. | Not Applicable | Cloud provider manages supporting utilities for infrastructure. |
| A.7.12 | Cabling security | No | Excluded — Network and power cabling for information processing infrastructure is within cloud provider data centres and managed under their certified ISMS. | Not Applicable | Cabling managed by cloud provider. |
| A.7.13 | Equipment maintenance | No | Excluded — Production equipment is cloud-hosted and maintained by the cloud provider. Employee endpoint devices are managed through MDM and vendor warranty/support agreements. | Not Applicable | Cloud provider maintains infrastructure; endpoints via MDM. |
| A.7.14 | Secure disposal or re-use of equipment | No | Excluded — HealthSafe does not dispose of data centre equipment. Cloud provider manages hardware lifecycle. Employee device disposal follows IT asset disposal procedure using certified data destruction services. | Not Applicable | Cloud provider handles equipment disposal; endpoints via certified destruction. |
| 8 — Technological Controls (34 controls) |  |  |  |  |  |
| A.8.1 | User endpoint devices | Yes | Required to ensure information stored on, processed by, or accessible via user endpoint devices is protected. | Implemented | MDM deployed; full-disk encryption, endpoint detection and response (EDR) on all devices. |
| A.8.2 | Privileged access rights | Yes | Necessary to restrict and manage the allocation and use of privileged access rights to prevent unauthorised access. | Implemented | Privileged access managed via PAM solution; just-in-time access for administrative functions. |
| A.8.3 | Information access restriction | Yes | Required to ensure access to information is restricted in accordance with the access control policy. | Implemented | Application-level access controls enforce data segregation; API access governed by OAuth 2.0 scopes. |
| A.8.4 | Access to source code | Yes | Necessary to prevent unauthorised access to source code to protect intellectual property and reduce risk of introducing vulnerabilities. | Implemented | Source code in private repositories with branch protection; access limited to development team. |
| A.8.5 | Secure authentication | Yes | Required to ensure secure authentication mechanisms are implemented based on the sensitivity of the information accessed. | Implemented | MFA enforced for all users; SSO via SAML 2.0/OIDC; adaptive authentication for high-risk actions. |
| A.8.6 | Capacity management | Yes | Necessary to ensure adequate capacity of information processing facilities to meet current and projected business requirements. | Implemented | Cloud auto-scaling configured; capacity monitoring dashboards with alerting thresholds. |
| A.8.7 | Protection against malware | Yes | Required to ensure information and information processing facilities are protected against malware. | Implemented | EDR solution deployed on all endpoints; email gateway with advanced threat protection. |
| A.8.8 | Management of technical vulnerabilities | Yes | Necessary to prevent exploitation of technical vulnerabilities through timely identification and remediation. | Implemented | Vulnerability scanning (weekly); patch management SLAs defined by severity; dependency scanning in CI/CD. |
| A.8.9 | Configuration management | Yes | Required to ensure hardware, software, services, and networks are configured securely and changes are managed. | Implemented | Infrastructure as Code (IaC); configuration baselines defined; drift detection automated. |
| A.8.10 | Information deletion | Yes | Necessary to ensure information is deleted when no longer required to comply with legal, regulatory, and contractual requirements. | Implemented | Data retention policies enforced; automated deletion workflows for expired data. |
| A.8.11 | Data masking | Yes | Required to limit exposure of sensitive data including PII in accordance with applicable policies and regulations. | Implemented | Data masking applied in non-production environments; PII anonymised in analytics. |
| A.8.12 | Data leakage prevention | Yes | Necessary to detect and prevent unauthorised disclosure of information from systems, networks, and endpoints. | Implemented | DLP policies configured on email gateway and cloud storage; endpoint DLP on managed devices. |
| A.8.13 | Information backup | Yes | Required to maintain backup copies of information and software to enable recovery after a loss event. | Implemented | Automated daily backups; encrypted off-site replication; restoration tested quarterly. |
| A.8.14 | Redundancy of information processing facilities | Yes | Necessary to ensure sufficient redundancy to meet availability requirements for critical services. | Implemented | Multi-AZ deployment; database replication; load balancing across availability zones. |
| A.8.15 | Logging | Yes | Required to produce, store, protect, and analyse logs that record activities, exceptions, faults, and security events. | Implemented | Centralised logging via SIEM; log retention per policy; tamper-evident log storage. |
| A.8.16 | Monitoring activities | Yes | Necessary to monitor networks, systems, and applications for anomalous behaviour and potential security incidents. | Implemented | 24/7 monitoring via SIEM with automated alerting; SOC escalation procedures defined. |
| A.8.17 | Clock synchronisation | Yes | Required to ensure the clocks of all information processing systems are synchronised to approved time sources for accurate logging. | Implemented | NTP synchronisation configured across all systems to authoritative time sources. |
| A.8.18 | Use of privileged utility programs | Yes | Necessary to restrict and control the use of utility programs that might override system and application controls. | Implemented | Privileged utilities restricted via endpoint policies; usage logged and monitored. |
| A.8.19 | Installation of software on operational systems | Yes | Required to ensure only authorised and tested software is installed on operational systems. | Implemented | Software installation restricted via MDM; application whitelisting on production servers. |
| A.8.20 | Networks security | Yes | Necessary to protect information in networks and supporting information processing facilities from unauthorised access. | Implemented | Network segmentation; WAF deployed; VPN for remote access; network security monitoring. |
| A.8.21 | Security of network services | Yes | Required to ensure security mechanisms, service levels, and management requirements of network services are identified and implemented. | Implemented | SLAs defined for network service providers; security requirements in service agreements. |
| A.8.22 | Segregation of networks | Yes | Necessary to segregate groups of information services, users, and systems to reduce the risk of unauthorised access. | Implemented | VPC segmentation; production, staging, and development environments isolated; micro-segmentation for critical services. |
| A.8.23 | Web filtering | Yes | Required to manage access to external websites to reduce exposure to malicious content. | Implemented | DNS-based web filtering; category-based blocking of high-risk sites. |
| A.8.24 | Use of cryptography | Yes | Necessary to ensure proper and effective use of cryptography to protect the confidentiality, integrity, and authenticity of information. | Implemented | Encryption policy defined; AES-256 at rest, TLS 1.2+ in transit; key management via cloud KMS. |
| A.8.25 | Secure development life cycle | No | Excluded- Software Devlopment is outsourced | Not Applicable | Not Applicable |
| A.8.26 | Application security requirements | Yes | Necessary to identify, specify, and approve information security requirements when developing or acquiring applications. | Implemented | Security requirements defined in user stories; acceptance criteria include security validation. |
| A.8.27 | Secure system architecture and engineering principles | No | Excluded- Software Devlopment is outsourced | Not Applicable | Software Devlopment is outsourced |
| A.8.28 | Secure coding | No | Excluded- Software Devlopment is outsourced | Not Applicable | Software Devlopment is outsourced |
| A.8.29 | Security testing in development and acceptance | No | Excluded- Software Devlopment is outsourced | Not Applicable | Software Devlopment and testing is outsourced |
| A.8.30 | Outsourced development | Yes | Necessary to ensure information security requirements are met when development activities are outsourced. | Implemented | Outsourced development governed by contractual security requirements; code review and security testing required. |
| A.8.31 | Separation of development, test and production environments | No | Excluded- Software Devlopment is outsourced | Not Applicable | Software Devlopment is outsourced |
| A.8.32 | Change management | Yes | Necessary to ensure changes to information processing facilities and systems are controlled. | Implemented | Change management process with CAB approval; automated deployment pipelines with rollback capability. |
| A.8.33 | Test information | No | Excluded- Software Devlopment is outsourced | Not Applicable | Software Devlopment and testing is outsourced |
| A.8.34 | Protection of information systems during audit testing | Yes | Necessary to ensure audit tests and other assurance activities involving assessment of operational systems are planned and controlled. | Implemented | Audit testing coordinated with IT; read-only access for auditors; testing in isolated environments where possible. |

| SoA Summary — ISO/IEC 27001:2022 |  |  |  |
| --- | --- | --- | --- |
|  |  |  |  |
| Category | Total Controls | Applicable | Excluded |
| 5 — Organisational Controls | 37 | 26 | 11 |
| 6 — People Controls | 8 | 8 | 0 |
| 7 — Physical Controls | 14 | 0 | 14 |
| 8 — Technological Controls | 34 | 34 | 0 |
| TOTAL | 93 | 68 | 25 |
| Percentage | 100.0% | 73.1% | 26.9% |
|  |  |  |  |
| Transition Note |  |  |  |
| This SoA was transitioned from ISO/IEC 27001:2013 (114 controls across 14 domains) to ISO/IEC 27001:2022 (93 controls across 4 themes) in November 2022 (Version 2.0). All controls were remapped from the 2013 structure to the 2022 Annex A. The 2022 standard introduced 11 new controls and consolidated/merged several existing controls. Applicability decisions were reviewed and updated during the transition. |  |  |  |

 

- [SecurePass for Visitor Management](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#main-content)

    - [How to Use SecurePass](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#how-to-use-securepass)
    - [Site/System Admin Guides](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#site-system-admin-guides)
    - [Set-up and Manage SecurePass Device](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#set-up-and-manage-securepass-device)
    - [SecurePass overview and FAQ’s](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#securepass-overview-and-faqs)
    - [Explore the People Menu](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#explore-the-people-menu)
    - [Explore the Sign in Settings Menu](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#explore-the-sign-in-settings-menu)
    - [Pre Registration Calendar/Group Booking](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#pre-registration-calendar-group-booking)
    - [Troubleshooting](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#troubleshooting)
    - [The Onboarding/Rollout process for SecurePass](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#the-onboarding-rollout-process-for-securepass)
- [SecurePass for Contractor Management](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#main-content)

    - [Contractor Business Admin Guides](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#contractor-business-admin-guides)
    - [Contractor Employee Guides](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#contractor-employee-guides)
    - [System Admins Gudies for Contractors](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#system-admins-gudies-for-contractors)
- [Dynamic Risk Management System](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#main-content)

    - [Admin Guides](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#admin-guides)
    - [User Guides](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#user-guides)
    - [Manager Guides](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#manager-guides)
- [Command Centre Integration](https://support.healthsafe.co/command-centre-integration?hsLang=en)
- [Integriti Integration](https://support.healthsafe.co/integriti-integration?hsLang=en)
- [ProtegeGX Integration](https://support.healthsafe.co/protegegx-integration?hsLang=en)
- [HS ISO27001 Documents](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#main-content)

    - [Official Certificate](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#official-certificate)
    - [Level 1 ISMS Manual](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-1-isms-manual)
    - [Level 2 Supporting Policies](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-2-supporting-policies)
    - [Level 3 Supporting Procedures](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-3-supporting-procedures)
    - [Level 4 Supporting Forms](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-4-supporting-forms)

[![HealthSafe\_Logo&Wordmark\_LightColour\_512x149-1](https://support.healthsafe.co/hs-fs/hubfs/HealthSafe_Logo%26Wordmark_LightColour_512x149-1.png?width=200&height=58&name=HealthSafe_Logo%26Wordmark_LightColour_512x149-1.png "HealthSafe_Logo&Wordmark_LightColour_512x149-1")](http://healthsafe.co.nz)

HealthSafe Help Centre

Copyright © 2026, HealthSafe NZ Limited