ISO 27001 notes
By Mira Holm · created 4 Sep 2023, 08:10 UTC · last updated 16 Oct 2026, 14:20 UTC · version 16
iso-27001auditcompliance
Owner: Maja Schulz, with Mira Holm
Certificate
- ISO/IEC 27001:2022, first certified in March 2024. Valid to March 2027.
- Scope: the development, operation and support of ACME's sign-in and access service; the Hamburg office and people working remotely; the AWS regions in Frankfurt, London and Virginia.
- Recertification audit planned for February 2027.
Audits
| Audit | Dates | Result |
|---|---|---|
| Certification | March 2024 | Certified, two minor findings |
| First surveillance | 10 Sep 2025 | No findings |
| Second surveillance | 15 Sep 2026 and 16 Sep 2026 | No major findings; two minor; three observations |
Second surveillance audit, September 2026
Maja prepared from July: Statement of Applicability v4, risk register, evidence per control.
| # | Finding | Owner | Closed |
|---|---|---|---|
| Minor 1 | Textbridge's yearly supplier review not done (last one before their contract) | Maja | 9 Oct 2026, review done |
| Minor 2 | Evidence for the Q2 GitHub access review incomplete | Rafael | 16 Oct 2026, with the Q3 review's evidence |
| Obs. 1 | Incident rehearsals: notes kept, attendees not | Mira | Attendees recorded from September |
| Obs. 2 | Laptop inventory kept by hand | Maja | Moving to Google Workspace's device list |
| Obs. 3 | AI coding tools: policy exists, no record of who uses them | Mira | Personal tokens in Emargen are in the Q4 access review |
The auditor noted the September credential-stuffing night (OPS-41) and the speed of the fix, and asked for the review, which we gave.
For questionnaires
Customers can have the certificate and the Statement of Applicability under NDA. Ask Maja.