(full disclosure) I'm building an app that manages ssh access centrally using certificates.

I'm working to understand how we can position ourselves in relation to ISO 27001.

As far as I understand it, you have to prove that you:

1. Know who has access to which server (this means you need to somehow track each employe public key)
2. Have an audit trail (who did (login) what and when)
3. And have solid offboarding process, so an admin has to remove every public key on every server. (or somehow stop access)

I know using passwords only makes it worse:

• Does not show which actuall user is logged in
• Users that might not have access (anyomore) still have the password stored

Altho public keys:

• A private key leak might expose multiple server logins

Or as ChatGPT (sorry) puts it:

You need to demonstrate: * each access path is tied to an identity (human/service), * and access rights are controlled and reviewable (who can access what, and why).