PP-SPEC-054: Proof of Efficacy Mapping to ISO/IEC 27001:2022

Status: DRAFT v0.1 Author: Craig Ellrod / Nebulonium, Inc. / HACKERverse® License: Greater Good Commercial License 1.0 (GGL-C-1.0); text CC BY 4.0 under Part S. See LICENSE.md.

Normative specification: PP-SPEC-054-ISO-IEC-27001-Mapping.md

Purpose

This repository defines a Proof Protocol mapping between ISO/IEC 27001:2022 (including Amd 1:2024) and Proof Protocol evidence, efficacy, and proof semantics, using clause and Annex A control references only.

The external framework supplies context describing what may be tested or examined. Proof Protocol remains framework-agnostic and independently establishes whether a selected control performed as claimed.

Repository contents

• PP-SPEC-054-ISO-IEC-27001-Mapping.md: normative mapping specification
• README.md: repository overview
• LICENSE: license for original Proof Protocol material
• CONTRIBUTING.md: contribution guidance
• CITATION.cff: citation metadata

Architectural principle

Threat, control, audit, and regulatory frameworks are pluggable inputs to Proof Protocol. Proof Protocol is framework-agnostic.

External frameworks identify what may be tested. Proof Protocol independently establishes whether a control worked and what evidence proves the result.

Ownership and external-framework notice

This Proof Protocol mapping is independently authored. ISO/IEC 27001:2022 and ISO/IEC 27002:2022 are copyrighted works of ISO and IEC. External names, identifiers, trademarks, standards text, and upstream materials remain subject to their applicable ownership and licensing. Mapping establishes interoperability, not dependency, endorsement, certification, or transfer of ownership. No affiliation, endorsement, certification, or sponsorship by ISO or IEC is implied.

Required notice: ISO/IEC 27001:2022, ISO/IEC 27001:2022/Amd 1:2024, and ISO/IEC 27002:2022 are copyright ISO and IEC. "All ISO publications and materials are protected by copyright" (https://www.iso.org/copyright.html). This repository cites standard numbers, clause and control references, and titles for identification only and reproduces no ISO/IEC text. ISO does not perform certification, and no endorsement, approval, or certification by ISO or IEC is claimed.