The ISO 27001 controls that actually matter when you connect two systems

Short summary

An integration engineer maps the ISO 27001:2022 Annex A controls that directly impact system-to-system data flows, covering cryptography, credential management, least-privilege access, data minimization, logging, supply chain agreements, and PII leakage prevention in logs. The author argues that applying controls matters more than certification, and that AI agents connected via MCP follow the same security framework as any other caller. Practical guidance includes TLS 1.2+ everywhere, scoped per-integration credentials, field-level data minimization, and masking sensitive data in log lines.

• •Maps 8 ISO 27001:2022 Annex A controls to real integration scenarios with concrete practices
• •AI agents via MCP are a new actor but the same controls apply: scoped credentials, traceability, data minimization
• •Tool choice (cloud iPaaS vs self-hosted n8n) changes your supply-chain scope and where data lives

Generated with AI, which can make mistakes.