Cryptography you can inventory and renew
Keep certificates and keys under governed issuance, renewal, delivery, and rotation - so cryptography is managed as a process, not a one-off ticket.
Supports ISO/IEC 27001:2022 A.8.24 and A.5.9
ISO 27001
ISO 27001 expects more than policies. CertLocker gives security and platform teams one place to manage certificates, cryptographic artefacts, secrets, just-in-time host access, and the audit trail that proves it.
When certificates live in spreadsheets, secrets sit on disk, and SSH keys never expire, ISO reviews get hard. CertLocker turns those operational gaps into controlled workflows with evidence.
Keep certificates and keys under governed issuance, renewal, delivery, and rotation - so cryptography is managed as a process, not a one-off ticket.
Supports ISO/IEC 27001:2022 A.8.24 and A.5.9
Store PEMs, tokens, and operational secrets with RBAC, scoped retrieval, and version history instead of shared folders and forgotten copies.
Supports A.5.17, A.8.3, and A.8.32
Issue time-limited SSH, RDP, and VNC access with 2FA and protocol, IP, and group constraints - then revoke when the work is done.
Supports A.5.15, A.5.18, A.8.2, and A.8.5
Answer who renewed a certificate, retrieved a secret, created a token, or accessed a host - with events useful for compliance reviews and incidents.
Supports A.8.15, A.5.28, and A.5.36
CertLocker does not write your policies. It gives you operational answers when reviewers ask how cryptography and access are controlled day to day.
A single inventory of certificates, hosts, secrets, and tokens - with ownership and history instead of tribal knowledge.
Scoped machine tokens, group-based access, and just-in-time sessions reduce standing privilege and shared credentials.
Endpoint probes check what TLS endpoints actually serve, so drift and expiry risk show up before an audit finding or outage.
Mapped to ISO/IEC 27001:2022 Annex A. Use this with your Statement of Applicability - as supporting operational evidence, not a claim that CertLocker covers every control.
| What you need to show | How CertLocker helps | Annex A |
|---|---|---|
| Cryptography is managed | Certificate inventory, ACME issuance and renewal, key custody, rotation, and governed delivery | A.8.24 |
| Authentication secrets are protected | Central custody of secrets, PEMs, and tokens with RBAC, scoped retrieval, and version history | A.5.17 |
| Actions are logged | Audit events for certificates, secrets, tokens, ACME, probes, and host access | A.8.15 |
| Access rights are controlled | Scoped tokens, groups and RBAC, rotate / renew / revoke, and time-limited sessions | A.5.18 |
| Privileged access is limited | Time-limited / 2FA SSH, RDP, and VNC instead of long-lived shared admin keys | A.8.2 |
| Authentication is stronger | 2FA at token and session issuance; protocol, IP, and group constraints | A.8.5 |
| Access follows need-to-know | One access model across artefacts, secrets, tokens, and hosts | A.5.15 |
| Assets are inventoried | Certificates, hosts, secrets, tokens, and related trust assets in one place | A.5.9 |
CertLocker strengthens cryptography, secret custody, privileged access, and logging for infrastructure trust. It is not your full information security management system.
You still own policies, risk assessment, Statement of Applicability, people and physical controls, supplier governance, and the accredited certification process. Describe CertLocker as supporting evidence for selected Annex A controls - not as making the organisation “ISO 27001 certified.”
In short: CertLocker helps you demonstrate how certificates, secrets, and host access are controlled and logged - so ISO 27001 reviews have operational proof behind the paperwork.
No. CertLocker helps you operate and evidence selected ISO/IEC 27001:2022 Annex A controls for cryptography, secrets, access, logging, and audit. Certification still needs your ISMS, risk assessment, Statement of Applicability, and an accredited audit.
Inventory of certificates and related assets, governed issuance and renewal, secret and credential custody with access history, scoped tokens, time-limited host access, endpoint verification, and a clear audit trail of who did what and when.
Use of cryptography (A.8.24), authentication information (A.5.17), logging (A.8.15), access rights (A.5.18), privileged access (A.8.2), secure authentication (A.8.5), access control (A.5.15), and inventory of assets (A.5.9), with supporting evidence for related access, monitoring, change, and evidence-collection controls.
See how CertLocker fits your certificate, secret, and access workflows - or talk through what auditors will see in your environment. Also exploring SOC 2 or Operator Trust?