# ISO/IEC 27001 — information security management.

- Canonical URL: https://www.broadnet.me/trust/iso-27001
- Language: en
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

TRUST

Last updated · April 18, 2026 Maintained by · Trust & Compliance Document · /trust/iso-27001

On this page

Procurement evaluator?

We provide a single evaluator package with the SIG, CAIQ, pen-test summary, and current audit letters.

[Request package](mailto:legal@broadnet.me)

## Overview

ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS): a risk-based framework for identifying information-security risks and applying controls to manage them. BroadNet holds ISO/IEC 27001 certification.

§01

## What the standard is

ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS. Rather than mandating a fixed checklist, it requires an organisation to assess its own information-security risks and then select and operate controls to treat them. The current 2022 revision references a catalogue of 93 controls in Annex A, grouped into organisational, people, physical, and technological themes. Certification is issued by an accredited third-party registrar after a formal audit and is maintained through annual surveillance audits, with full re-certification on a three-year cycle.

§02

## Why it matters to an enterprise buyer

For a procurement or security team, ISO 27001 is independent evidence that a supplier runs security as a managed, audited discipline rather than ad-hoc effort.

- Accredited third-party attestation, not vendor self-assessment.
- A documented risk-treatment process covering the systems that handle your data.
- Recognised worldwide, so a single certificate satisfies many jurisdictions at once.
- Surveillance and continual-improvement requirements keep controls current between audits.

§03

## BroadNet's status

BroadNet holds ISO/IEC 27001 certification covering its messaging platform and supporting operations, including MobileValidate (a BroadNet brand), which is also covered by BroadNet's data-protection agreement (DPA). Certificate copies and the Statement of Applicability are shared with enterprise evaluators under NDA.

§04

## Scope & validity

The certified scope statement, certificate number, certification body and validity dates are printed on the certificate, which BroadNet shares with the Statement of Applicability under NDA — request both at trust@broadnet.me. To verify independently, search for “BroadNet” on IAF CertSearch (iafcertsearch.org), the IAF database of accredited management-system certificates.

§05

## Definitions

Trust artefact terminology used on this page is defined below. Acronym choices follow Shared Assessments (SIG) and Cloud Security Alliance (CAIQ) conventions.

Quick reference

**Audit report**

Independent attestation by a qualified auditor over a defined scope and period.

**SIG / CAIQ**

Standard Information Gathering and Consensus Assessments Initiative Questionnaire — completed annually.

**NDA**

Mutual non-disclosure agreement — pre-requisite for receiving non-public audit evidence.

**Evaluator package**

Curated bundle: certificate copies, audit letters, pen-test summary, SIG/CAIQ, and DPA.

## Questions?

Need a document under NDA, an evaluator briefing, or evidence for procurement? Our trust team coordinates with security, legal, and finance.

[legal@broadnet.me](mailto:legal@broadnet.me)

We reply within one business day

Related documents

## Continue reading

[Trust center home](https://www.broadnet.me/trust)

[Document ISO 27001 compliance program](https://www.broadnet.me/compliance/iso27001) [Document ISO 9001](https://www.broadnet.me/trust/iso-9001) [Document ISO 22301](https://www.broadnet.me/trust/iso-22301) [Document Security overview](https://www.broadnet.me/security)