ISO 27001:2023 class 2 surveillance audit successfully completed
On 6 May, our ISO 27001:2023 class 2 surveillance audit was completed. No outstanding non-conformities, certification remains in force.
What that is, and why it matters to you as a customer.
What a surveillance audit involves
An ISO 27001 certification is not a one-off moment. After the initial certification, a surveillance audit follows every year, in which an external auditor tests whether the information security management system still works as it should. Every three years, a full recertification follows. A surveillance audit is therefore not a formality, but the annual external confirmation that the standard is being complied with in practice, not just on paper.
What ISO 27001:2023 involves
ISO 27001 is the international standard for information security management. It does not assess a single isolated measure, but the entire system with which an organisation organises information security. Policy, risk analyses, technical controls, processes around incidents, suppliers, access, change management, and how all of that is governed and adjusted.
The 2023 version is the current edition and replaces the 2013 standard you still often see on vendor websites. Annex A has been restructured and eleven new controls have been added. The most important of these: threat intelligence, information security in cloud environments, data masking, secure coding, configuration management, and monitoring of activities. Each and every one of them areas that directly touch on how a SaaS platform for personal injury works.
What it concretely delivers for our customers
Under DORA and the GDPR, insurers and authorised agents must be able to demonstrate that chain partners have their information security in order. Until now, that was done with questionnaires, due diligence processes and separate substantiations per topic. With this certificate, and the annual external confirmation that it still operates as intended, they have one externally audited document covering the core of those questions.
For their compliance team, that saves time in vendor assessments. For their DPO, it provides substantiation for the TOMs in the data processing agreement. For their internal audit and the DORA reporting to the regulator, it is a building block they do not have to produce themselves. And for the conversations we have together, it means we no longer need to talk about checklists, but about their processes and their customers.
How this ties in with how we build
In our KubeCon retrospective, we wrote that many systems are 'built to fail' because information security is only brought in at the end. A certificate that exists only on paper does not solve that problem. The value of ISO 27001 lies in the discipline the standard enforces in daily practice: in code reviews, in incident response, in how we handle access rights, in choices that are sometimes uncomfortable towards customers and partners.
A surveillance audit is exactly the mechanism that keeps that honest. Once a year, someone from outside comes to check whether we do what we say.
What comes next
The threat landscape changes continuously and the standard moves with it. Our roadmap for the coming period includes further expansion of threat detection, extension of the portal ecosystem for new insurers, and continued development of the integration layer between Axon, QIS and Azori. Next year the next surveillance audit is on the schedule, the year after that the recertification.
Questions about scope or certificate number? Get in touch with us.