06 Nov 2026
Auditors and customers now ask how your domains are owned, protected and changed. ISO 27001 expects domains to be treated as information assets with clear owners, access control and change management. India's DPDP Act adds duties for personal data, including the contact details stored in domain registrations.
This guide maps the relevant controls to practical domain actions. It is general guidance, not legal or certification advice.
Your domain controls websites, email, apps and APIs. A hijacked or expired domain is a confidentiality, integrity and availability incident in one. That is why domain controls show up across several Annex A areas, even though no control names domains directly.
| Annex A control | What it means for domains | Evidence to keep |
|---|---|---|
| 5.9 Inventory of information and other associated assets | Every domain listed with owner | Domain inventory sheet |
| 5.15 Access control | Only authorised staff can manage registrar and DNS | Role list, access reviews |
| 8.5 Secure authentication | MFA on registrar and DNS logins | MFA settings screenshots |
| 8.32 Change management | DNS and contact changes approved and logged | Change tickets and logs |
| 5.19 Supplier relationships | Registrars and agencies assessed as suppliers | Supplier assessment |
| 8.16 Monitoring activities | Alerts on DNS, contact and expiry changes | Alert configuration and history |
| 5.30 ICT readiness for business continuity | Renewals and failover protect availability | Renewal policy, DNS failover tests |
Use the control numbers your ISMS already follows. Your certification body has the final say on what evidence works.
Domain registrations often include names, emails and phone numbers of individuals. Under the DPDP Act, that is personal data, and your company should handle it with reasonable security safeguards.
As DPDP rules and guidance evolve, confirm specifics with your legal or privacy team.
Client: Pharmaceutical group, Hyderabad
Challenge: Previous audit raised an observation on unmanaged domains and shared registrar logins.
What we did: Domain inventory added to the asset register, MFA and roles, DNS change tickets, quarterly review evidence.
Results:
Client: IT services company, Hyderabad
Challenge: Former employees' names and mobile numbers were still on client project domains.
What we did: Contact audit, change to role emails and company address, privacy on eligible domains, offboarding checklist update.
Results:
Domains fit neatly into ISO 27001 and DPDP practices once you treat them as assets with owners, access control and change management. The work is modest, and the evidence pays off in every audit and customer review.
Flying Stars helps through domain governance services in Hyderabad and governance, risk and compliance services.
