Information Security Management System (ISMS)

The 2022 revision of ISO/IEC 27001 introduced several significant updates:

• Annex A controls streamlined: Controls were reduced from 114 to 93 and regrouped into four categories for clarity.
• New controls: Additional focus on cloud services, threat intelligence, data masking, physical security monitoring, and web filtering.
• Improved alignment: Structure now matches other ISO management system standards for easier integration.
• Emphasis on continual improvement: Enhanced guidance on responding to evolving threats and business needs.

Information security is essential for every business in today’s digital landscape. ISO/IEC 27001 is globally recognized as the benchmark for building and operating a secure and resilient organization.

• Reduces risks: Systematically identifies and mitigates information security risks.
• Builds trust: Demonstrates to customers, partners, and regulators that security is a top priority.
• Supports compliance: Helps meet legal, contractual, and regulatory requirements.
• Competitive advantage: Many organizations require suppliers to hold ISO/IEC 27001 certification.

Certification is voluntary — any organization can use ISO/IEC 27001 as a framework without being formally certified.

However, independent certification by an accredited body provides external assurance and can be a key differentiator in competitive markets, especially when customers or regulators require it.

Exoscale has maintained ISO/IEC 27001 certification by an accredited auditor since 2018.

To become certified, an organization must:

• Implement an ISMS in line with ISO/IEC 27001 requirements.
• Undergo an independent audit by an accredited certification body.
• Maintain certification through annual surveillance audits and regular improvement.

Certificates are typically valid for three years, subject to successful surveillance audits.

Important: Using ISO 27001-certified services like Exoscale supports your own compliance journey, but each organization must implement and demonstrate its own ISMS.

Yes, choosing an ISO 27001-certified provider like Exoscale means your cloud workloads run on infrastructure audited for best-practice security management.

However, customers remain responsible for the security of their data, applications, and their own compliance. Exoscale’s certifications and documentation make it easier to demonstrate your own due diligence to auditors and regulators.

Yes. Customers can access our current ISO/IEC 27001 certificate and Statement of Applicability (SoA) through the Exoscale Compliance Center. Additional audit reports and details are also available to customers under NDA.