ISO 27001 compliance in Wazuh

[Haziq Mt Roslan]

Does Wazuh comply with ISO 27001? and if not, is there anyway I can create custom one for my company Regulatory system. Thanks in advance.

[Isaac Yusuf]

Hello Haziq,
  

Yes, Wazuh includes compliance with ISO 27001:

• https://github.com/wazuh/wazuh/issues/4091

Here's more information about security compliance:

• https://documentation.wazuh.com/current/getting-started/use-cases/regulatory-compliance.html
• https://wazuh.com/blog/announcing-soc-2-type-2-compliance-at-wazuh/

Furthermore, Wazuh is highly customizable so you can fine-tune any decoder/rules to detect and trigger alerts based on another criteria if needed.

I hope this helps with your concern!

[Muhammad Abdullah]

No, it's not.

 
Yes you can map NIST with ISO using following link: -
http://gocs.info/pages/fachberichte/archiv/178-sp800_53_r4_appendix-h_draft_ipd.pdf

But it will be a time consuming process to do it on my own on every rule that exists in Wazuh. So I guess, Wazuh team should announce that community members should give them rule numbers mapped with ISO 27001 security controls so everyone can contribute at some dedicated platform decided by Wazuh team where they can monitor and review each submission. The problem here is the platform where officially everyone can submit their mappings.