Everything worth knowing, nothing that isn't.
The scope of the audit
SAS-SM is conducted by GSMA-accredited auditors (typically SRC GmbH or BSI) and covers the physical security of the data centre (CCTV, mantraps, dual-control access), HSM key custody (FIPS 140-2 Level 3 minimum), the operational procedures for key ceremonies, the personnel vetting policy, and the change-management process for the SM-DP+ / SM-SR / eIM software.
How it differs from SAS-UP
SAS-UP (SIM card UICC Production) audits the factory that produces physical SIMs and writes profiles into them at manufacture. SAS-SM audits the infrastructure that pushes profiles over the air to existing eUICCs. A vendor running an eSIM service needs SAS-SM; a vendor making physical SIM cards needs SAS-UP; a vendor doing both needs both certifications.
What loses certification
Three things. A key-ceremony procedural deviation (e.g. a single person holding both halves of a key share — instant fail). Physical access control failure during the unannounced re-audit. Failure to disclose a security incident to GSMA within 24 hours. Operators are notified of any SAS-SM suspension and immediately pause profile downloads from the affected vendor.
What it costs to maintain
The audit itself is typically 80–120k EUR every two years. The operational overhead — dual-control key ceremonies, HSM maintenance, personnel vetting — is the larger cost. BroadNet's own SAS-SM accreditation for its eSIM infrastructure is in progress (not yet awarded).