Certified · active
ISO/IEC 27001:2022
Information security management system
CorebankOSTallinn
- Issued
- Feb 2025
- Valid until
- Feb 2028
- Certificate no.
- IS 000000
Certified · ISO/IEC 27001:2022 An ISMS that runs the
An ISMS that runs the
whole company.
Platform, people and offices - certified by an accredited body and audited every year.
Certification cycle
Three years, audited every year.
- Year 1
Certification audit
Stage 1 documentation review and stage 2 on-site audit.
Feb 2025 · passed - Year 2
Surveillance audit
Sample of controls, internal audits and management review.
Feb 2026 · passed - Year 3
Surveillance audit
Second surveillance, focused on changes and improvements.
Feb 2027 · planned - Year 4
Recertification
Full audit and a new three-year certificate.
Feb 2028 · planned
Annex A · 93 controls
Four themes, sized by weight.
Every control is listed in our Statement of Applicability with its status and justification.
- 37 37 controls:Organisational Policies, supplier security, incident management, business continuity, compliance.
- 34 34 controls:Technological Access control, cryptography, secure coding, logging and monitoring.
- 14 14 controls:Physical Secure areas, equipment, clear desk.
- 8 8 controls:People Screening, awareness, remote working.
Scope What the
What the
certificate covers.
No carve-outs for the parts that are hard to audit.
- Platform Core, apps, APIs and infrastructure In scope
- Engineering Secure development lifecycle In scope
- People Every employee and contractor In scope
- Offices Tallinn In scope
- Suppliers Cloud and critical sub-processors In scope
- Operations Monitoring, incidents, on-call In scope
One control set
Mapped across every framework.
We run one set of controls and map it - so evidence is consistent from audit to audit.
- Yes
- Partly
- Not required
| Control | ISO 27001 | SOC 2 | PCI DSS | DORA |
|---|---|---|---|---|
| Access reviews every quarter | Yes | Yes | Yes | Yes |
| MFA for all administrative access | Yes | Yes | Yes | Yes |
| Annual penetration test | Yes | Yes | Yes | Yes |
| Business continuity & DR tests | Yes | Yes | Partly | Yes |
| Supplier risk assessments | Yes | Yes | Yes | Yes |
| Threat-led penetration testing | Partly | Not required | Not required | Yes |