# SAS-SM certification — what it means for SIM and eSIM trust

> SAS-SM is the GSMA's Security Accreditation Scheme for Subscription Management — the audit that any vendor running SM-DP+, SM-SR, or eIM infrastructure must pass to be trusted by mobile operators for eSIM profile provisioning. Without SAS-SM, no tier-1 operator will exchange profile signing keys with you.

- Canonical URL: https://www.broadnet.me/answers/sas-sm-certification
- Language: en
- Last reviewed: 2026-09-29
- Publisher: BroadNet (https://www.broadnet.me)

## The scope of the audit

SAS-SM is conducted by GSMA-accredited auditors (typically SRC GmbH or BSI) and covers the physical security of the data centre (CCTV, mantraps, dual-control access), HSM key custody (FIPS 140-2 Level 3 minimum), the operational procedures for key ceremonies, the personnel vetting policy, and the change-management process for the SM-DP+ / SM-SR / eIM software.

## How it differs from SAS-UP

SAS-UP (SIM card UICC Production) audits the factory that produces physical SIMs and writes profiles into them at manufacture. SAS-SM audits the infrastructure that pushes profiles over the air to existing eUICCs. A vendor running an eSIM service needs SAS-SM; a vendor making physical SIM cards needs SAS-UP; a vendor doing both needs both certifications.

## What loses certification

Three things. A key-ceremony procedural deviation (e.g. a single person holding both halves of a key share — instant fail). Physical access control failure during the unannounced re-audit. Failure to disclose a security incident to GSMA within 24 hours. Operators are notified of any SAS-SM suspension and immediately pause profile downloads from the affected vendor.

## What it costs to maintain

The audit itself is typically 80–120k EUR every two years. The operational overhead — dual-control key ceremonies, HSM maintenance, personnel vetting — is the larger cost. BroadNet's own SAS-SM accreditation for its eSIM infrastructure is in progress (not yet awarded).

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is Remote SIM Provisioning (RSP)?](https://www.broadnet.me/answers/what-is-remote-sim-provisioning)
- [SGP.32 — eSIM IoT for M2M without the SM-DP+ dance](https://www.broadnet.me/answers/sgp-32-esim)
- [TripoSIM](https://www.broadnet.me/triposim)
- [Trust & security](https://www.broadnet.me/trust)
- [eSIM VSM platform](https://www.broadnet.me/operators/esim-vsm)