# ISO 27001 and database access controls > Which ISO/IEC 27001:2022 Annex A controls on access rights, masking and logging QueryProxy helps you produce evidence for, and what stays with you. - Source: https://queryproxy.com/iso-27001-database-access-controls/ - Language: en-US - Author: Muhammet Şafak --- ISO/IEC 27001 is a standard for an information security management system (ISMS). A certification body grants certificates to organizations after an audit; products do not receive one. QueryProxy can help with evidence for a few of the Annex A controls that concern database access, which you can show an auditor as part of your own system. This page is not legal or audit advice. Your certification body decides what satisfies a control in your ISMS. ## Which Annex A controls relate to database access? The 2022 edition of ISO/IEC 27001 lists its controls in Annex A (titles checked on 2026-10-13 against secondary sources; the standard text was not read). You choose controls through a risk assessment and record the decision in a Statement of Applicability. The technological controls relevant to databases: - **A.8.2 Privileged access rights** - **A.8.3 Information access restriction** - **A.8.11 Data masking** - **A.8.15 Logging** The titles come from the 2022 edition. The standard is sold by ISO and national standards bodies; the edition is listed in ISO's [catalogue](https://www.iso.org/standard/27001). Take the control wording from your licensed copy, not from this summary. ## What evidence can QueryProxy produce? QueryProxy helps with evidence for these controls. It does not satisfy a control alone. | Annex A control | What QueryProxy produces | What it does not cover | | :-- | :-- | :-- | | A.8.2 Privileged access rights | Developers hold no production credential; it is stored encrypted (AES-256; see the [approval workflow reference](/docs/approval-workflow/)). Every request goes through a named approver who cannot be the requester. An administrator's override of that rule is flagged in the audit log. TOTP two-factor authentication can be required for administrators, DBAs or all users ([configuration](/docs/configuration/)). | Allocation and periodic review of privileged rights across the rest of your systems. | | A.8.3 Information access restriction | A developer reaches only the connections a DBA granted. Roles separate submitting, approving and auditing. Connections, requests, masking rules and audit logs stay within a team. Reads get a default `LIMIT` of 1000 and a hard cap of 10000 ([SQL guards](/docs/sql-guards/)). | Your access control policy, and the grants inside the database itself. | | A.8.11 Data masking | Column and content rules with `full`, `partial` and `hash` strategies, applied to every value before it is written, plus masking of error messages ([masking reference](/docs/data-masking/)). | Finding what is sensitive. Rules mask only what they match. | | A.8.15 Logging | An audit entry per step of a request, with requester, approver, channel, duration and affected rows, plus logins and grants. Entries cannot be edited or deleted through the application. CSV export for the Auditor role. | Protecting and retaining logs beyond the application, clock synchronization, and reviewing what the logs show. | For how a request travels and which entries it writes, see the [approval workflow](/sql-query-approval-workflow/) page and the [masking](/dynamic-data-masking/) page, or the reference pages for the [approval workflow](/docs/approval-workflow/) and [data masking](/docs/data-masking/). ## What stays with your organization? - The ISMS itself: scope, risk assessment, Statement of Applicability, policies, internal audit and management review. - Deciding which controls apply to you, and justifying those that do not. - Who gets privileged roles, and the periodic review of that list. - Retention periods. The documentation names no retention period for the audit log; result files follow a period you configure. - Securing the host, the reverse proxy and QueryProxy's own database. Behind a reverse proxy, list it in `TRUSTED_PROXIES`, or the log records its address instead of the user's. See [production hardening](/docs/production-hardening/). - The certification audit. ## What are the limits? - The audit log covers requests made through QueryProxy, not other routes to the database. - "Cannot be edited" describes the application, not someone with direct access to the database that stores the log. - Masking and the SQL guard have the limits their pages describe. The guard is a denylist, and a DBA's approval is the authorization boundary. - Using QueryProxy does not give you an ISO 27001 certificate. ## When do you not need this? If you are not pursuing ISO 27001, or databases are outside your ISMS scope, the controls above are not your concern. If you run a small team where one person administers everything, there is no second person to approve a statement. If your auditor is already satisfied by a bastion host and native database auditing, QueryProxy may add little; the [bastion host comparison](/compare/bastion-host/) shows what differs. Related reading: [SOC 2](/soc-2-database-access-controls/), [PCI DSS](/pci-dss-database-access-controls/) and [what database access control is](/what-is-database-access-control/). ## Frequently asked ### Does using QueryProxy get us an ISO 27001 certificate? No. Certification applies to your information security management system and is granted after an audit by a certification body. QueryProxy helps with evidence for some Annex A controls about database access. It does not replace the system, the risk assessment or the audit. ### Which Annex A controls does QueryProxy relate to? Controls 8.2 privileged access rights, 8.3 information access restriction, 8.11 data masking and 8.15 logging, all in the 2022 edition. Which controls apply to you is set by your risk assessment and your Statement of Applicability. ### Is Annex A mandatory? Annex A is a reference set of controls. You decide, through risk assessment, which ones you implement and record that in your Statement of Applicability, with a justification for those you leave out. Read the standard for the exact requirement. ### Does QueryProxy implement control 8.11, data masking? It helps with one part of it. Masking rules you define are applied to result values, and to error messages, before they are written. It masks only what your rules match, so choose and test rules for your own data. ### What evidence does QueryProxy give for logging? Each step of a request gets an audit entry, covering submission, decision, execution with duration and affected rows, result downloads, logins, grants and configuration changes. The Auditor role can filter it and export CSV. Time synchronization and retention are yours to arrange.