What

Create docs/compliance/iso-27001.md documenting how logger_system features map to ISO/IEC 27001 controls, and link it from the README's compliance section.

• Current: README mentions ISO 27001 in the feature list ("Compliance Support: GDPR, PCI DSS, ISO 27001, SOC 2") but no dedicated mapping document exists
• Expected: A control-by-control mapping document (similar to monitoring_system/docs/compliance/iso-mapping.md) plus a README link in a "Compliance" section
• Scope: docs only, no code changes

Why

• Closes a gap in common_system#645 (ecosystem-wide ISO compliance EPIC)
• Enterprise adopters request control-level evidence at procurement, not just feature claims
• Brings logger_system to parity with monitoring_system and database_system, which already publish compliance docs

Where

• New file: docs/compliance/iso-27001.md
• Modify: README.md (add a "Compliance" section linking to the new doc)

How

Technical Approach

1. Reference the structure of monitoring_system/docs/compliance/iso-mapping.md and database_system/docs/compliance/ISO_27001.md for consistency
2. Cover ISO 27001 Annex A controls relevant to logging:
   • A.12.4 (Logging and monitoring) — HMAC integrity from security: extend HMAC integrity protection to all writers (ISO 27001) #612, log retention
   • A.9.4 (Access control) — log file permissions
   • A.10.1 (Cryptography) — TLS for log shipping (if applicable)
   • A.18.1 (Compliance with legal requirements) — GDPR/PCI DSS overlap
3. Add README "Compliance" section with link

Acceptance Criteria

• docs/compliance/iso-27001.md exists with control-by-control table
• README has a "Compliance" section linking to the new doc
• Linked from common_system ISO_OVERVIEW.md (when that lands)

Part of #645 (kcenon/common_system).