ISO/IEC 27001 — Information Security
How AssetAI supports practices aligned with ISO/IEC 27001.
What ISO/IEC 27001 covers
Information security in a manufacturing plant is rarely just an IT problem — it touches who can close a work order, who can see another plant's data, and whether a failure record can be edited after the fact. For Indian manufacturers evaluating a CMMS against ISO/IEC 27001 expectations, the useful exercise isn't chasing a certification logo but checking whether the day-to-day mechanisms in the tool actually hold up to scrutiny.
Questions to ask before you buy
Most ISMS gaps in shop-floor software show up in a handful of predictable places. Before signing a contract, it's worth asking your vendor directly:
- Tenant isolation — is access segregation enforced at the query layer (so one company's data cannot leak into another's reports), or is it just a filter applied inconsistently across screens?
- Segregation of duties — can the same person both perform and approve a closure, or is there a distinct approval step for sensitive transitions like inspection sign-off?
- Record integrity — can a breakdown or corrective work order be closed without a documented cause and remedy, or is that left to operator discipline?
- Admin access — if a vendor's support team can see your data, is that access scoped and rule-based, or open-ended?
- Tenant lifecycle — can access for a decommissioned plant, contractor, or expired account be cut off cleanly?
None of these questions require the vendor to hold a certificate — they test whether the underlying mechanism would survive an internal auditor's walkthrough.
Common mistakes plants make
A few patterns come up repeatedly when Indian manufacturers assess software for ISMS alignment, and they're worth avoiding regardless of which platform you choose:
- Confusing "login required" with access control. A shared PIN or generic credential at the shop floor is not the same as individual authentication, and it should be flagged as a gap rather than assumed to be covered.
- Assuming a vendor's marketing page equals a Statement of Applicability. Alignment with practices is not the same as a completed audit — ask for what's actually documented, not implied.
- Treating multi-tenancy as a checkbox. Row-level scoping that rewrites every query to the caller's company is a materially different guarantee than an application-level filter that a future feature could bypass by mistake.
- Ignoring closure workflows. A maintenance system that lets any role close any work order, with no second check, undermines both traceability and the kind of segregation-of-duties evidence an auditor expects.
AssetAI's approach to these mechanisms — company-scoped queries, approval-gated inspection closures, and hard data-integrity checks on breakdown records — is described in detail on this page precisely so plant and IT teams can evaluate it against their own checklist rather than take it on faith. It sits alongside the platform's broader feature set and its use across other standards plants are tracked against.
If your team is mapping software controls to an ISMS review, or simply trying to understand where CMMS mechanics intersect with information security, our free resources cover related groundwork, and the fastest way to get specific answers is a working session — book a demo and bring your auditor's question list.
How AssetAI enforces these mechanisms in practice
Most CMMS vendors will tell you their platform is "secure." What matters for an ISMS review is whether that security is a marketing line or a mechanism you can point to in the code. AssetAI's approach is deliberately narrow and verifiable rather than broad and vague:
- Query-level tenant isolation — every tenant-owned record carries a company identifier, and a global query scope rewrites data requests to that company automatically. This isn't a screen-by-screen filter that a developer could forget to apply on a new report; it's enforced at the data-access layer itself.
- Closure gates as code, not policy — breakdown and corrective work orders cannot move to Completed or Closed without a recorded failure cause and remedy. This check runs independently in two separate code paths, so a bug in one doesn't silently let bad records through — a small but meaningful detail for anyone assessing record integrity.
- Approval steps for sensitive transitions — inspection work orders route through a distinct closure approval, typically held by a different role than the one who performed the work. A rejection reopens the work order to "In Progress" with an appended note, giving you a traceable approve/reject trail for that specific workflow.
- Scoped administrative access — when support needs to open a tenant's account, impersonation is limited to a specific, documented rule (the tenant's oldest active Company Admin), not open-ended access to any user or role.
- Tenant lifecycle control — each company record carries an active flag and a validity date, so access for a terminated contract or decommissioned site can be disabled at the account level.
These are the kinds of controls an ISMS reviewer actually tests — not whether a vendor uses the word "secure" on their pricing page, but whether the mechanism holds up under a direct question.
Where a CMMS fits — and where it doesn't
It's worth being direct about scope. AssetAI does not provide encryption specifications, audit/access logging (who viewed or changed a record, and when), a granular permission matrix beyond admin/user tiers and workflow approvals, or an incident-response and risk-register module — and using it does not, by itself, make a plant's ISMS compliant. Shop-floor breakdown reporting, in particular, authenticates by name plus a shared company scan PIN rather than individual logins, which is a weaker identity control than per-user credentials and should be weighed accordingly in any risk assessment.
For Indian manufacturers building out a broader ISMS — often alongside other frameworks referenced across ISO & standards — the practical path is to treat the CMMS as one control surface among several: strong on tenant isolation and record-integrity gates, but not a substitute for a documented risk register, encryption policy, or full audit trail. Compare how these mechanisms map to your specific plant setup across industries and typical use cases, and pull the full mechanism list under features before your next internal review. If you're preparing for an ISMS conversation with an auditor, it's worth booking a walkthrough so the technical team can answer questions like the ones above directly against your environment, alongside broader improvement work such as OEE tracking.
ISO/IEC 27001 — Information Security FAQs
How does AssetAI enforce segregation of duties to meet ISO 27001 access controls?
AssetAI enforces segregation of duties through approval-gated workflows that route work orders through separate closure approval steps, typically assigned to different roles than those performing the work itself. For example, inspection work orders cannot be closed by the same person who created them—they route to a designated approver. This built-in gate creates an audit trail showing who initiated, performed, and authorized each task, which is what an ISMS reviewer looks for when examining your access controls and authorization practices. The mechanism is automatic within the system, requiring no manual workaround.
Can AssetAI prevent one plant's maintenance data from being visible to another plant's staff?
Yes. AssetAI uses row-level multi-tenancy: every record carries a company identifier, and the system automatically rewrites all queries to show only that company's data. A user logged into Plant A cannot accidentally or deliberately query Plant B's work orders, spare-part costs, or failure logs—the database itself enforces this boundary. This is the kind of data-isolation control that ISO 27001 auditors expect to see documented. You configure user-to-company assignment once, and the filtering runs on every request without additional steps.
What happens if someone tries to close a corrective work order without documenting what actually failed?
The system prevents it. Breakdown and corrective work orders are coded with a hard data-integrity gate: they cannot be closed unless two separate fields are populated—a recorded failure cause and a remedy. This rule is enforced at the application level, not just suggested. The mechanism ensures traceability and record integrity, which ISO 27001 auditors verify when they review your incident logs and corrective-action documentation. No workaround exists; the form simply will not submit.
How do we disable access for a plant that has been sold or temporarily shut down?
Each company record in AssetAI has an active flag and a validity date. When you toggle the active flag off or set a validity date in the past, that tenant's access is disabled at the company level. Existing sessions may continue briefly, but new logins and API calls are refused. This is how you execute the deprovisioning step that standards require when a user or organizational unit leaves the system. It creates a clean record of when access ended rather than leaving orphaned accounts.
If an auditor asks us to prove who approved a specific maintenance decision, what does AssetAI show them?
The approval-gated workflow leaves a complete trail. When a work order routes through closure approval, the system records the approver's identity, timestamp, and the action taken. Combined with the hard requirement that corrective orders include a failure cause and remedy before closure, you have a documented chain: who reported the issue, what work was done, what the root cause was, what the fix was, and who signed off. This audit trail is native to how the system works—no configuration needed. Review the CMMS glossary page for how this fits into broader maintenance record-keeping.
Does AssetAI come with ISO 27001 certification?
No. AssetAI is not ISO/IEC 27001 certified. The features described here—multi-tenancy, approval gates, data-integrity rules, and lifecycle controls—are the kinds of technical controls that support an ISO 27001 information security management system, but they do not constitute certification. You remain responsible for your own ISMS, risk assessment, and compliance documentation. Visit /standards to see our full standards page, and contact your auditor about how these mechanisms fit into your Statement of Applicability.
How does AssetAI support the incident management requirements of ISO 27001 for Indian manufacturing plants?
AssetAI provides a maintenance log to track and document incidents, allowing plants to respond and recover quickly.
See AssetAI on your own assets
A 30-minute demo on your plant, not our slides.