Security management — ISO 27001 & GDPR applied to my own infrastructure
A structured way to decide which security risks matter, what to do about them, and how to prove it — applied to the server behind this site.
The need
Saying “it's secure” proves nothing. Organisations use the ISO 27001 standard to decide, document and prove what they do about security risks — I wanted to practise it on something real.
The idea
Treat my own server like a client's: define the scope, analyse the risks, choose the controls, audit — and publish the gaps instead of hiding them.
What I built
- A scope, and an inventory of what needs protecting.
- A risk analysis with EBIOS RM, the French national method.
- A review of the 93 controls of ISO 27001 (2022 edition), one by one — including 35 excluded, each with a written reason.
- A security policy, operating procedures and a GDPR register for the visitor data this site handles.
- An internal audit of 17 controls, with the gaps written out in full.
- Live proofs: some requirements are measured automatically every hour, not just declared.
The result
- 93controls reviewed one by one
- 35excluded, each with a written reason
- 17controls audited internally
- 14 · 2 · 1compliant · partial · gap
Of the 93 controls: 12 in place, 30 partial, 16 to do and 35 not applicable (counts re-checked on 12 Sept 2026). Public extracts are online; the full risk analysis and statement of applicability are shown in interviews.
In pictures
What I learned
Excluding a control with a solid reason is as revealing as applying it. And a security system that only lists its successes isn't one — it's a brochure.
Technical details Stack, architecture and decisions — for technical readers
Stack
- ISO/IEC 27001:2022
- EBIOS RM
- GDPR
- Ubuntu
- nginx
- systemd
- Cloudflare
- Litestream + restic
How it works
- Scope: production VM, application, database, visit data and administration access. Explicitly out of scope: personal workstation and third-party accounts.
- EBIOS RM in five workshops; residual risks accepted in writing. Workshops 4 and 5 deliberately not published.
- Statement of Applicability: 12 in place, 30 partial, 16 to do, 35 not applicable — mostly people and physical controls transferred to the cloud provider.
- GDPR: record of processing (art. 30), legitimate-interest balancing test, information notice (art. 13), data subject rights procedure (art. 15–21), breach procedure (art. 33), DPIA and DPO analyses (art. 35 and 37).
- Internal audit: 17 controls — 14 compliant, 2 partial, 1 structural gap written in full; incident log published.
- An automated OSINT aggregation feature was abandoned for lack of a solid legal basis under GDPR article 14.
- Known gaps: business continuity not tested since the backup machine was removed; no continuous vulnerability scanning.
Still missing
- Not certified — not possible for an individual
- Continuity not tested
- No continuous vulnerability scanning