ISO/IEC 27001 — information security management.
Overview
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS): a risk-based framework for identifying information-security risks and applying controls to manage them. BroadNet holds ISO/IEC 27001 certification.
What the standard is
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS. Rather than mandating a fixed checklist, it requires an organisation to assess its own information-security risks and then select and operate controls to treat them. The current 2022 revision references a catalogue of 93 controls in Annex A, grouped into organisational, people, physical, and technological themes. Certification is issued by an accredited third-party registrar after a formal audit and is maintained through annual surveillance audits, with full re-certification on a three-year cycle.
Why it matters to an enterprise buyer
For a procurement or security team, ISO 27001 is independent evidence that a supplier runs security as a managed, audited discipline rather than ad-hoc effort.
- Accredited third-party attestation, not vendor self-assessment.
- A documented risk-treatment process covering the systems that handle your data.
- Recognised worldwide, so a single certificate satisfies many jurisdictions at once.
- Surveillance and continual-improvement requirements keep controls current between audits.
BroadNet's status
BroadNet holds ISO/IEC 27001 certification covering its messaging platform and supporting operations, including MobileValidate (a BroadNet brand), which is also covered by BroadNet's data-protection agreement (DPA). Certificate copies and the Statement of Applicability are shared with enterprise evaluators under NDA.
Scope & validity
The certified scope statement, certificate number, certification body and validity dates are printed on the certificate, which BroadNet shares with the Statement of Applicability under NDA — request both at trust@broadnet.me. To verify independently, search for “BroadNet” on IAF CertSearch (iafcertsearch.org), the IAF database of accredited management-system certificates.
Definitions
Trust artefact terminology used on this page is defined below. Acronym choices follow Shared Assessments (SIG) and Cloud Security Alliance (CAIQ) conventions.
- Audit report
- Independent attestation by a qualified auditor over a defined scope and period.
- SIG / CAIQ
- Standard Information Gathering and Consensus Assessments Initiative Questionnaire — completed annually.
- NDA
- Mutual non-disclosure agreement — pre-requisite for receiving non-public audit evidence.
- Evaluator package
- Curated bundle: certificate copies, audit letters, pen-test summary, SIG/CAIQ, and DPA.
Questions?
Need a document under NDA, an evaluator briefing, or evidence for procurement? Our trust team coordinates with security, legal, and finance.
legal@broadnet.me