# ISO 27001 · Trust Center · CorebankOS

> An ISMS that runs the whole company: platform, people and offices, certified to ISO/IEC 27001:2022 by an accredited body and audited every year.

Source: https://corebankos.com/trust-center/iso-27001

## An ISMS that runs the whole company.

Platform, people and offices - certified by an accredited body and audited every year.

### ISO/IEC 27001 certificate

- **Feb 2025** Issued
- **Feb 2028** Valid until
- **IS 000000** Certificate no.

CorebankOS · Tallinn

Information security management system

ISO/IEC 27001:2022

Certified · active

Scan to check status on the accredited certification body's public register.

Verify this certificate

## What the certificate covers.

No carve-outs for the parts that are hard to audit.

- **Platform**: Core, apps, APIs and infrastructure
- **Engineering**: Secure development lifecycle
- **People**: Every employee and contractor
- Offices
- **Suppliers**: Cloud and critical sub-processors
- **Operations**: Monitoring, incidents, on-call

## Three years, audited every year.

- **Certification audit**: Stage 1 documentation review and stage 2 on-site audit.
- **Surveillance audit**: Sample of controls, internal audits and management review.
- **Surveillance audit**: Second surveillance, focused on changes and improvements.
- **Recertification**: Full audit and a new three-year certificate.

## Four themes, sized by weight.

Every control is listed in our Statement of Applicability with its status and justification.

- **Organisational**: Policies, supplier security, incident management, business continuity, compliance.
- **Technological**: Access control, cryptography, secure coding, logging and monitoring.
- **Physical**: Secure areas, equipment, clear desk.
- **People**: Screening, awareness, remote working.

## Mapped across every framework.

We run one set of controls and map it - so evidence is consistent from audit to audit.

- ISO 27001
- SOC 2
- PCI DSS
- DORA

Not required

Access reviews every quarter

MFA for all administrative access

Annual penetration test

Business continuity & DR tests

Supplier risk assessments

Threat-led penetration testing