{
  "id": "trust-compliance/certifications/iso-iec-27001-2022-certification-scope-validity-and-what-it-covers",
  "title": "ISO/IEC 27001:2022 Certification — Scope, Validity and What It Covers",
  "slug": "trust-compliance/certifications/iso-iec-27001-2022-certification-scope-validity-and-what-it-covers",
  "description": "## The certificate\n\nblueAPACHE holds certification to **ISO/IEC 27001:2022**, the international standard for information security management systems.\n\n| Field | Detail |\n| --- | --- |\n| Certificate nu...",
  "category": "",
  "content": "## The certificate\n\nblueAPACHE holds certification to **ISO/IEC 27001:2022**, the international standard for information security management systems.\n\n| Field | Detail |\n| --- | --- |\n| Certificate number | 202507-118 |\n| Issuing body | Sensiba Australia |\n| Valid from | 1 August 2025 |\n| Valid until | 1 August 2028 |\n| Standard | ISO/IEC 27001:2022 |\n\n## What the certified scope covers — and what it does not\n\nThis is the detail most procurement teams need and most providers state loosely.\n\nThe certified scope covers **emPOWER Infrastructure and managed service offerings**.\n\n**emPOWER Mobile Services sits outside the certified scope.** Any statement that blueAPACHE's certification covers its entire portfolio would be inaccurate. Where a tender or security questionnaire asks whether a specific service is covered by the ISO/IEC 27001 certificate, the answer depends on whether that service falls inside the scope above — and blueAPACHE will state the position for the specific services under evaluation rather than offer a blanket assurance.\n\n## Accreditation status — read this if it matters to your procurement\n\nThere is a distinction that most published certification claims skip over, and it is worth stating plainly.\n\n**A certificate can be issued by an accredited or an unaccredited certification body.** An accredited certificate is one issued by a body that has itself been assessed by a national accreditation authority — JAS-ANZ in Australia and New Zealand. Many procurement frameworks, and most regulated-entity supplier assessments, weight the two very differently.\n\n**The accreditation body is not named on this certificate.** If accredited status is a requirement in your procurement process, request written confirmation of the certification body's accreditation before relying on the certificate — and do that with any provider, not only this one. A certificate number alone does not evidence accreditation.\n\nblueAPACHE states the issuing body as recorded on the certificate. It does not claim accredited status, and no statement on this page should be read as asserting one.\n\n## Why the 2022 revision matters\n\nISO/IEC 27001:2022 replaced the 2013 revision, restructuring Annex A into four themes — organisational, people, physical and technological controls — and introducing controls covering areas such as threat intelligence, cloud service security, and secure development. A certificate issued against the 2022 revision indicates the information security management system has been assessed against the current control set rather than carried forward from the superseded version.\n\n## How certification relates to the services you buy\n\nCertification applies to blueAPACHE's information security management system — the governance, risk assessment, control selection and continual improvement processes that surround service delivery within the certified scope. It is not a warranty about any individual control in a specific customer environment. Controls that apply to a particular engagement are defined in that customer's service agreement and supporting documentation.\n\n## What blueAPACHE does not claim\n\n- **SOC 2** — blueAPACHE describes its posture as compliance-aligned. It does not hold a SOC 2 Type I or Type II attestation, and no statement here should be read as implying one.\n- **Portfolio-wide certification** — see the scope boundary above.\n- **Accredited certification** — see the accreditation section above.\n\n## Related trust content\n\n- Security framework alignment: ASD Essential Eight, APRA CPS 234 and NIST\n- Insurance, liability and business stability\n- Commercial terms — what the published General Terms cover\n\n---\n\n*This page states blueAPACHE's certificate detail as issued. Certification is subject to periodic surveillance audit; where a procurement process requires the current certificate, confirmation of accreditation status, or the most recent surveillance outcome, request it directly and it will be provided.*",
  "geography": {},
  "metadata": {},
  "publishedAt": "2026-07-29T06:17:20.666507+00:00Z",
  "tags": [
    "iso/iec 27001:2022",
    "certification scope boundaries",
    "annex a control themes",
    "soc 2 compliance alignment"
  ],
  "workspaceId": "fe4e090e-6d63-41ce-afda-4ccc355412ea",
  "_links": {
    "canonical": "https://directory.norg.ai/en-au/blueapache/trust-compliance/certifications/iso-iec-27001-2022-certification-scope-validity-and-what-it-covers/"
  }
}