Sentrix is ISO/IEC 27001:2022 certified

Sentrix has earned ISO/IEC 27001:2022 certification for its information security management system (ISMS). For a company that helps its customers prepare for this same standard, it is an important milestone: we applied to ourselves what we recommend.

What a certification audit checks

ISO/IEC 17021-1, the standard for certification bodies, sets out an initial audit in 2 stages. Stage 1 reviews the documentation and the readiness of the management system. Stage 2 assesses its implementation and effectiveness. The certification decision comes after.

The auditor checks clauses 4 to 10 of the standard: context, leadership, planning, support, operation, performance evaluation and improvement. The auditor also checks the statement of applicability. Annex A offers 93 reference controls; the organization selects those that apply to its risks, justifies each exclusion and adds other controls where needed. According to IAF MD 26, initial certifications have been made against the 2022 version since April 30, 2024, and the transition of 2013 certificates ended on October 31, 2025.

How we prepared

We prepared this certification with the Sentrix platform and the approach we apply with our customers: a clear scope, a risk assessment that justifies the controls selected, evidence linked to the requirements, then an internal audit and a management review before the external auditor, as clauses 9.2 and 9.3 require.

What it changes for our customers

When you assess Sentrix as a vendor, you can rely on a certification issued by an independent body rather than on our word alone. For a copy of the certificate and its scope statement, write to us. The Security page describes the controls we operate.

For the organizations we support toward their own certification, our ISO 27001 certification support and the ISO 27001 framework page describe the approach.

What it does not change

The certification covers a defined scope, that of our ISMS. It makes no customer compliant on their behalf, and it does not replace a SOC 2 attestation, which Sentrix does not claim. Nor is it earned for good. The certification cycle runs 3 years: the first surveillance audit takes place within 12 months of the decision, then at least once per calendar year, except in the recertification year. The ISMS has to keep running between audits.

What's next

Preparing your own ISO/IEC 27001 audit and want to know where you stand? Let's talk about your file.