ISO 27001, SOC 2 and the standards behind them.
We are working towards ISO/IEC 27001 for information security, SOC 2 for assurance over the controls behind it, ISO/IEC 42001 for AI management and ISO/IEC 27701 for privacy. All four are in progress and none has been certified yet. This page sets out what each one covers, how we are approaching it and what you can evaluate while the work completes.
Discuss your security requirementsFour standards, one management system.
These standards overlap by design. ISO 27001 establishes the management system; 27701 extends it to personal data; 42001 applies the same discipline to AI; and SOC 2 reports independently on the controls underneath. Building them together means one set of risk assessments, policies and reviews rather than four.
ISO/IEC 27001
Information security management: the risk assessments, policies, controls and management reviews that protect the information we hold.
In progress. Target: to be confirmed. About the standard
SOC 2
An independent auditor's report on the controls behind security and the related Trust Services Criteria, written for the customers who rely on them.
In progress. Target: to be confirmed. About the standard
ISO/IEC 42001
AI management: how AI systems are governed across their lifecycle, including oversight, risk and the duties that attach to a high-risk use under the EU AI Act.
In progress. Target: to be confirmed. About the standard
ISO/IEC 27701
Privacy information management, extending ISO 27001 to the handling of personal data, which is most of what a performance system holds.
In progress. Target: to be confirmed. About the standard
Certification audits a system that already runs.
An auditor does not hand over a management system; they examine the one an organisation already operates. The work therefore sits in the product and the process rather than in the paperwork: identifying the information we hold and the risks to it, setting the controls that address those risks, assigning ownership, and reviewing the whole thing on a schedule rather than when something goes wrong.
For 42001 that discipline extends to the AI features. Performance management is a high-risk use of AI under the EU AI Act, and the oversight the regulation expects, a named person deciding, with the evidence in front of them, and a record of what was decided, is the same oversight an AI management system is certified against. The two pieces of work reinforce each other.
For 27701 the subject matter is the personal data a performance system holds, which is most of it: objectives, feedback, review content and the relationships between people. The controls that matter are access, retention, deletion and the lawful basis for each use.
Ask for the evidence, not the logo.
The questions your IT, privacy and procurement teams need answered are the same before and after a certificate exists, and they are the ones our security and data protection page is built around: hosting and service locations, encryption in transit and at rest, responsibility for keys and secrets, identity and access control, retention and deletion, sub-processors, and where any AI processing takes place.
Bring your security questionnaire to the evaluation and ask for the answers in writing. When each certificate and report is issued we will publish its reference, the body that issued it and its scope here, so you can verify the claim rather than take it on trust. For the data protection roles and the processing agreement behind all of this, see our GDPR page.
Your questions, answered.
Which standards are you working towards?
ISO/IEC 27001 for information security, SOC 2 for independent assurance over the related controls, ISO/IEC 42001 for AI management and ISO/IEC 27701 for privacy information management. All four are in progress.
Have any of them been certified yet?
Not yet. The work is under way on all four and no certificate or report has been issued. We will publish each reference, issuing body and scope here as they complete.
How should we record this in a supplier assessment?
As certification in progress. If your process requires a certificate in place before contract, raise it at the start of the evaluation and we will tell you where the work stands.
Why ISO 42001 as well as ISO 27001?
27001 governs information security; 42001 governs how AI systems are managed across their lifecycle. A performance product that uses AI needs both, and 42001 lines up with the oversight duties the EU AI Act places on a high-risk use.
What can we rely on in the meantime?
Written answers on hosting and data residency, encryption, access control, retention, sub-processors, AI processing locations and the data processing agreement. Our security page lists the questions worth asking.
Put your evaluation in context.
Explore the review experience, then bring your access, data and governance requirements to a conversation with our team.
Try the interactive preview
