ISO 27001 Aligned Software Engineering for Enterprise ERPs

Information Security Systems: ISO 27001 Aligned Architecture

Executive Summary

This is the software control set ERPStack builds into enterprise ERPs that will sit inside an ISO 27001 information security management system. The certificate belongs to your organisation, not to the application — but the application decides how much of the audit is a SQL query and how much is a project. Most access-control findings are evidence-collection failures rather than control failures, and that is an architecture problem solvable in advance, on Next.js, TypeScript, and PostgreSQL.

The Annex A Themes Software Actually Touches

ISO 27001 organises its controls into organisational, people, physical, and technological themes. Software reaches two of the four.

Access control. Authorisation is evaluated server-side on every query through RBAC mapped to your SSO directory groups over SAML 2.0 or OIDC, so a quarterly access review is a directory query rather than a spreadsheet exercise. Privileged actions are logged separately from ordinary reads.

Secure development and environment separation. Development, staging, and production are separate AWS accounts with separate PostgreSQL instances and no shared credentials. Production secrets live in a vault; no engineer holds standing production access, because deployment runs under a workload identity. Terraform describes every environment, so the 3 of them cannot drift apart silently.

Logging and monitoring. Authentication events, role changes, privileged actions, and failed authorisations land in append-only tables and stream to your SIEM. Retention follows your policy, not a vendor default you cannot change.

Backup, redundancy, and recovery. Encrypted snapshots, multi-AZ standbys with automatic failover, and restore drills that are actually run — because an untested backup is a documented assumption rather than a control.

Physical and people controls stay where they belong: software cannot vet your staff or lock your server room, and any vendor implying otherwise is selling you a gap.

Verification in the Pipeline

Deployment gates turn several clauses into artefacts nobody has to remember to produce.

// Pipeline gate in GitHub Actions: dependency audit, secret scanning,
// and API boundary review. A high finding fails the merge, not a ticket.
export async function runSecurityGate(commitSha: string) {
  const findings = await Promise.all([
    scanDependencies(),      // public vulnerability databases
    scanSecrets(),           // no credentials committed to the repository
    reviewApiBoundaries(),   // every route asserts RBAC server-side
  ]);
  const blocking = findings.flat().filter(f => f.severity === 'high');
  return { commit: commitSha, blocking: blocking.length, timestamp: new Date().toISOString() };
}

Semgrep SAST covers the TypeScript codebase, Zod validates every API boundary, and Playwright exercises permission boundaries on each release so a broken RBAC rule fails CI rather than an audit.

Operations and Recovery

PostgreSQL hot standbys sit in separate availability zones with automatic failover, exercised rather than assumed. Backups are encrypted with keys in AWS Key Management Service on a documented retention and destruction schedule. Connection-pattern monitoring raises alerts on anomalous access, tuned per tenant.

Operational Outcomes

Procurement review shortens because a buyer receives documented technical controls instead of a questionnaire answered from memory. Access reviews become exports — any date range, JSON or CSV, in under 1 minute. And because every control lives in your repository and your AWS account, the ERP keeps producing evidence long after the engagement ends.

Stack and Boundaries

Enterprise ERPs built to this standard run on Next.js and TypeScript with PostgreSQL behind Drizzle ORM, deployed by Terraform into your own AWS account. RBAC is enforced in the Next.js API layer, SSO carries identity over SAML 2.0, Redis caches non-sensitive data, and Zod validates 100% of API boundaries. Semgrep SAST, Vitest, and Playwright run in GitHub Actions on every commit, with Sentry for error telemetry. ERPStack operates 0 of it: after handover no ERPStack account reaches your PostgreSQL cluster or your AWS keys, so the ISO 27001 scope boundary sits cleanly around your own organisation.