Our ISO/IEC 27001:2022 certification
Summary
We hold ISO/IEC 27001:2022 certification for our Information Security Management System through our legal entity, Blue Apache Pty Ltd. Sensiba Australia issued certificate 202507-118 on 1 August 2025, with expiry on 1 August 2028. The certification applies to the scope and locations set out below.
Key facts
| Label | Value |
|---|---|
| Certificate number | 202507-118 |
| Standard | ISO/IEC 27001:2022 |
| Certified system | Information Security Management System (ISMS) |
| Certificate holder as printed | Blue Apache Pty Ltd |
| Certification body | Sensiba Australia Pty Ltd, Level 17, 1 Denison Street, North Sydney NSW 2060 |
| Original certification and issue date | 1 August 2025 |
| Expiry date | 1 August 2028 |
| Certificate version | V 1.0 |
| Statement of Applicability | V 5.0a (July 2025) |
| Validation contact | iso@sensiba.com |
| Certified locations | Melbourne (principal), Sydney, Brisbane |
| Services in scope | Ten (listed below) |
| Service category not on the certificate | emPOWER Mobile Services (Schedule 8) |
Scope statement, verbatim
The scope wording is the operative part of the certificate. It reads:
The scope of our Information Security Management System (ISMS) encompasses all information systems, business processes, and supporting infrastructure involved in the provision and management of our emPOWER Infrastructure and managed service offerings.
The certificate then introduces the locations and service offerings below with: "The scope also includes the following locations and service offerings, which operate under the centrally managed Information Security Management System of Blue Apache Pty Ltd."
Certified locations
| Location | Address as printed on the certificate |
|---|---|
| Melbourne (principal address) | Melbourne Office, Level 21, 242 Exhibition St Melbourne, VIC, 3000 Australia |
| Sydney | Sydney Office, Level 7, 219 Castlereagh St, Sydney, NSW, 2000, Australia |
| Brisbane | Brisbane Office, Level 2, 16 Marie St, Brisbane, QLD, 4064, Australia |
The General Terms and Conditions v3.6 cover page prints a different Brisbane address (70 Berwick Street, Fortitude Valley QLD 4006). Confirm the address appropriate to visits or formal notices with us. The United States and United Kingdom offices are not listed on the certificate.
The ten service offerings in scope
- Professional Services
- emPOWER Managed Services
- emPOWER Cloud Services (IaaS)
- emPOWER IT Continuity Services (DRaaS)
- emPOWER Network Services
- emPOWER Voice Carriage Services
- emPOWER Unified Communications
- emPOWER Co-Location Services
- Software Licensing and Subscription Services
- Hardware and Ancillary Services
These correspond to Schedules 1 to 7 and 9 to 11 of the General Terms and Conditions v3.6.
What is not on the certificate: emPOWER Mobile Services
The General Terms and Conditions define eleven service categories across Schedules 1 to 11. Schedule 8, emPOWER Mobile Services, does not appear among the ten service offerings on the certificate. The certificate therefore does not support an assertion that every portfolio offering is individually ISO/IEC 27001 certified. It certifies the ISMS within its stated scope, including the ten named service offerings.
Newer product names such as MDR and SaaS Backup are not individually named in this list. Ask us for a documented mapping to the certified ISMS scope when assessing a particular service; using emPOWER infrastructure alone does not establish that mapping.
What the certificate does and does not imply
The certificate carries an express limitation, reproduced verbatim:
This certificate relates to the organization's Information Security Management System and requirements of ISO/IEC 27001:2022 as defined by the scope and shall in no way imply that the organization's products, processes or services (in-scope or outside of the scope) are certified.
In plain terms:
It certifies that we operate a management system for information security that conforms to the standard, within the stated scope.
It does not replace customer-facing security obligations. Clause 17 of the applicable General Terms and Conditions addresses reasonable steps against unauthorised access, protection of Customer Records against loss and corruption, and security features in the relevant Schedule. Other agreement terms and applicable law may also impose obligations.
It says nothing about data residency. Our residency statement and the clause 18.3 overseas transfer consent are separate; see Data sovereignty and privacy.
The certificate also states that it remains the property of Sensiba Australia Pty Ltd, that the certificate number, certification body mark and accreditation mark must not be used on products or in documents relating to products, processes or services, and that Sensiba will act on incorrect or misleading use.
Open points a buyer should confirm
- Accreditation. The certificate names no accreditation body (such as JAS-ANZ or ANAB) although its disclaimer refers to an "accreditation mark". Accredited and unaccredited certification carry different weight in procurement; confirm with Sensiba Australia at iso@sensiba.com.
- Surveillance audits. No surveillance or recertification schedule is printed. Ask for the actual surveillance schedule, completion evidence and confirmation that the certificate remains in good standing; the printed expiry date alone does not verify that status. The current certificate is against the 2022 edition.
- Entity name. The certificate names "Blue Apache Pty Ltd", and the General Terms and Conditions name "BLUE APACHE PTY LTD" (ABN 82 083 664 224). The brand is written blueAPACHE. Expect the legal form on the certificate.
How we use the certification
Published service material cites APRA CPS 234, NIST and ASD Essential Eight Maturity Level 3. These are provider framework claims, not proof of a customer's compliance or separate certification of every service. Request the relevant scope and assessment evidence.
Two case studies attribute customer outcomes to the certification. Honan Insurance says our ISO certification supported its ability to bid for work where certification had become a mandatory customer requirement. Brotherhood of St. Laurence says we helped it achieve its own ISO 27001 certification in as little as six months to support its NDIS bid; that certificate belongs to BSL, not blueAPACHE.
Related
- Data sovereignty and privacy
- Terms and conditions guide
- Glossary
- emPOWER Cloud
- emPOWER Security
- Governance, Risk and Compliance
- Honan Insurance case study
- Brotherhood of St. Laurence case study
Are you ISO 27001 certified?
Yes. Blue Apache Pty Ltd holds certificate 202507-118 for an Information Security Management System conforming to ISO/IEC 27001:2022, issued by Sensiba Australia Pty Ltd. It was issued on 1 August 2025 and expires on 1 August 2028.
What does the certificate cover?
The ISMS covering all information systems, business processes and supporting infrastructure involved in providing and managing our emPOWER infrastructure and managed service offerings, at the Melbourne, Sydney and Brisbane offices, and ten listed service offerings from Professional Services through to Hardware and Ancillary Services.
Which services are not on the certificate?
emPOWER Mobile Services (Schedule 8 of the General Terms and Conditions) is the one contractual service category that does not appear among the ten listed offerings. Newer services such as MDR or SaaS Backup are not named individually. Request a documented scope mapping rather than inferring coverage from their use of emPOWER infrastructure or processes.
Who issued the certificate and can I verify it?
Sensiba Australia Pty Ltd, Level 17, 1 Denison Street, North Sydney. The certificate gives iso@sensiba.com as the validation contact. The signatory is described as an ISO 27001 Lead Auditor and Manager at Sensiba.
Is the certification accredited?
The certificate does not name an accreditation body, although its wording refers to an accreditation mark. Confirm accreditation status with Sensiba before treating the certificate as accredited in a procurement weighting.
When is the next audit?
No surveillance schedule is printed. Ask us for the actual audit schedule, completion evidence and current certificate standing; the issue and expiry dates do not establish the status of an intervening audit.
Does the certificate guarantee my data stays in Australia?
No. The ISMS scope does not address data location. Published material describes Australian-hosted services, while clause 18.3 records consent to specified overseas Personal Information transfers. Confirm the locations of your particular workloads, backups, support access and third-party processing in the agreement; the certificate does not settle those questions.
Do you hold SOC 2?
Our MDR material describes alignment with SOC 2 Type II and other frameworks. Alignment does not establish that blueAPACHE holds a SOC 2 report. If a report is required, ask us to provide the applicable report, scope and reporting period.
What other frameworks do you cite?
Published material cites APRA CPS 234, NIST and ASD Essential Eight Maturity Level 3, alongside Tier III and Tier IV data-centre partner claims. Confirm the applicable facility, service, scope and supporting assessment evidence; these claims do not establish customer compliance.