Know-how / ISO 27001

Password Depot Enterprise Server & ISO 27001

Technically enforced access control, strong authentication, and audit security for your ISMS.

Note: This page explains how Password Depot Enterprise Server supports your ISMS and your ISO/IEC 27001 requirements. Information about AceBIT GmbH ISO/IEC 27001 certification can be found separately in the Trust Center.

The ISO/IEC 27001:2022 certification requires effective measures for access control, the management of authentication information and the traceability of events. This is exactly where the Password Depot Enterprise Server comes in: It centralizes permissions, enforces password policies, logs security-relevant activities, and integrates with existing identity and monitoring solutions.

Annex A of ISO/IEC 27001:2022 includes 93 controls, many of which directly relate to password and access management (including A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, A.8.3, A.8.5, A.8.15). Password Depot enables these requirements to be implemented in a technically sound manner and documented in an audit-proof way.

At a glance – ISO-relevant features of the Enterprise Server:

Central password policies & quality checks (including compromised passwords)
Role- and group-based access control (RBAC) down to the folder/entry level
Strong authentication: 2FA (TOTP/email), FIDO2/WebAuthn, SSO (IWA/Azure AD/OIDC)
Encryption: databases protected with AES-256 at rest; transmission via TLS 1.2/1.3
Audit logs (including remote syslog) & reports for users, groups, databases
“Second password” option at the database level (four-eyes principle)

Relevant ISO 27001:2022 controls and implementation with Password Depot

A.5.15 – Access control

Requirement: Rules for physical and logical access to information and information processing facilities.

Implementation: Role- and group-based permissions with granular control down to the entry level. Administrators define users/groups, assign read/write/admin permissions, and thereby enforce the principle of least privilege. Thanks to Active Directory/Azure AD integration and SSO keep identities consistent.

A.5.17 – Authentication information

Requirement: Assignment and management of authentication information through a formal process.

Implementation: Configurable password policies (length, character sets, history) and a security check against leaked passwords (Pwned service, k-anonymity). Strong authentication via 2FA (TOTP/email) and FIDO2/WebAuthn; assignment/reset via AD/Azure AD processes.

A.5.18 – Access rights

Requirement: Provide, review, modify, and revoke access rights.

Implementation: Centralized lifecycle management of rights via groups/assignments, rapid lockout during offboarding, and auditability through server logs and reports.

Critical security features for ISO compliance

ISO 27001 Anforderung	Password Depot Feature	Compliance‑Nutzen
A.8.2 Privilegierte Zugriffsrechte	Server‑Rollen (z. B. Server/DB/Account/Group Admin), optional zweites Kennwort (Vier‑Augen)	Saubere Trennung privilegierter Aufgaben, Nachvollziehbarkeit
A.8.3 Informationszugriffsbeschränkung	Verschlüsselte Server‑Datenbanken (AES‑256) + Berechtigungsmatrix	Schutz vor unbefugtem Zugriff
A.8.5 Sichere Authentifizierung	2FA (TOTP/E‑Mail), FIDO2/WebAuthn, SSO (IWA/Azure AD/OIDC)	Erhöhte Sicherheit & klare Identitätsbindung
A.8.9 Konfigurationsmanagement	Versionen/Änderungshistorie auf Eintragsebene, Server‑Logs	Nachvollziehbarkeit von Änderungen
A.8.10 Informationslöschung	Sicheres Löschen externer Dateien (mehrfaches Überschreiben)	Regelkonforme Datenlöschung außerhalb der DB
A.8.15 Protokollierung	Audit‑Logs im Server; Live‑Export via Syslog (RFC‑5424) an SIEM	Beweise für Audits, zentrales Monitoring/IR

Practical implementation in the ISMS

Risk analysis: Identify critical systems/accounts. In Password Depot, entries can be grouped and tagged with attributes/“importance” to prioritize them based on protection requirements.
Policy definition: Define password policies in line with ISO 27001 & NIST 800–63B; Password Depot technically enforces minimum requirements (quality, reuse, HIBP check).
Rollout & training: Use AD/Azure AD sync, enforce SSO/2FA, and introduce it gradually in critical areas.
Continuous monitoring: Perform regular security checks (compromised passwords), review server logs, export reports, and conduct access reviews.

Audit preparation with Password Depot (practical):

Server reports for users, groups, users in groups, server databases export
Audit logs (locally or via Remote Syslog) save as evidence
Password policies document (definition & technical enforcement)
Security checks and access reviews perform regularly and document

Note: There is no dedicated “ISO 27001 audit report” in the menu – the reports/logs listed above serve as audit evidence.

Added value for ISO 27001 certification

1. Verifiable control: The server logs security-relevant actions (logins, changes, permissions). Via Syslog export, events can be centrally correlated (A.8.15).

2. Technical compliance enforcement: Policies for password quality and reuse are enforced; leaked passwords are detected and can be blocked (A.5.17).

3. Business continuity: Encrypted data storage, TLS transport, server backups and client-Offline mode support the requirements for A.5.29 – Information security during disruptions.

Integration into your security architecture

Active Directory/Azure AD/LDAP: SSO and centralized user management (A.5.16)
SIEM: Real-time export of server logs via Syslog (RFC 5424, UDP) for monitoring & incident response (A.5.24–A.5.28, A.8.15)
ITSM/Ticketing: Automation (e.g., password resets) can be implemented via REST API
Backups: Plan regular server backups and store them on the company side securely (e.g., encrypted) – corresponds to A.8.13 “Information Backup”

Limitations (you should know about)

No native complete ISO 27001 audit report – evidence is provided via logs/standard reports.
No integrated approval workflow (“two-person approval”) for secrets: four-eyes protection is possible via the second password at the database level; more advanced workflows require third-party systems or API automation.
Encryption in transit: Transport is TLS-based (not “AES-256 in transit” as a blanket statement). AES-256 refers to database encryption at rest.

Conclusion: The Password Depot Enterprise Server is an effective technical building block for ISO 27001 compliance: centralized rights management, strong authentication, secure encryption, audit capability, and SIEM integration. Combined with your ISMS (roles, processes, evidence), it accelerates certification – without marketing fluff.

Further sources

ISO 27001-compliant password management

Find out how Password Depot Enterprise Server supports your ISMS.

Explore Enterprise Server