Security Policy (ISO 27001)
Last updated: October 2026
1. Management Declaration
CertiTrue LLC is committed to protecting the confidentiality, integrity, and availability of all information assets entrusted to us by our clients, employees, and partners. Top management formally endorses this Information Security Policy and mandates its implementation across the entire organisation.
This policy is reviewed at least annually and whenever significant changes to the business or threat landscape occur. All personnel are required to read, understand, and comply with this policy and the supporting procedures that flow from it.
2. ISMS Scope
The Information Security Management System (ISMS) of CertiTrue LLC covers all processes, systems, people, and facilities involved in the design, development, delivery, and support of certification services, including cloud-based platforms, remote working environments, and third-party supply chain relationships.
The ISMS is aligned with ISO/IEC 27001:2022 and applies to all permanent employees, contractors, consultants, and any other parties who access CertiTrue information assets.
3. Security Objectives — CIA Triad
CertiTrue establishes and pursues the following security objectives, reviewed annually by senior management:
Confidentiality — Ensure that information is accessible only to those authorised to access it. Access is granted on a least-privilege, need-to-know basis and reviewed quarterly.
Integrity — Safeguard the accuracy and completeness of information and processing methods. Changes to critical systems and data are subject to formal change management controls.
Availability — Ensure that authorised users have reliable and timely access to information and systems when required. Availability targets are defined in service-level agreements and supported by resilience and continuity plans.
4. Annex A Controls
CertiTrue implements a comprehensive set of controls drawn from ISO/IEC 27001:2022 Annex A, selected on the basis of risk assessment and documented in the Statement of Applicability.
Organisational Controls (Clause 5) — Information security policies, roles and responsibilities, segregation of duties, contact with authorities, threat intelligence, and supplier relationships are formally managed and documented.
People Controls (Clause 6) — Security awareness and training are mandatory for all staff at onboarding and annually thereafter. Background verification is performed prior to employment. Disciplinary procedures apply to security policy violations. Upon termination, access rights are revoked immediately.
Physical Controls (Clause 7) — Physical security perimeters, access controls, and protection against environmental threats are maintained for all premises. Clear-desk and clear-screen policies are enforced. Equipment is securely disposed of or repurposed following formal procedures.
Technological Controls (Clause 8) — User endpoint devices, privileged access management, information access restriction, authentication, cryptography, secure development lifecycle, vulnerability management, network security, and monitoring are governed by detailed technical standards. Logs are retained for a minimum of 12 months.
5. Risk Management and Statement of Applicability
CertiTrue follows a structured risk management process in accordance with ISO/IEC 27005. Risks are identified, analysed, evaluated, and treated on a regular basis and whenever material changes occur to the business or its environment.
Risk owners are assigned for each identified risk. Accepted risks are formally documented and approved by senior management. The risk register is reviewed at least annually.
The Statement of Applicability (SoA) lists all 93 controls from ISO/IEC 27001:2022 Annex A, indicating which are applicable, the justification for inclusion or exclusion, and the implementation status. The SoA is a controlled document maintained by the Information Security Manager and approved by the Chief Executive Officer.
6. Incident Management and Data Breach Notification
CertiTrue maintains a documented incident management procedure covering detection, classification, response, recovery, and post-incident review. All employees are required to report suspected security incidents immediately to the security team at info@certitrue.com.
In the event of a personal data breach, CertiTrue will notify the Spanish Data Protection Authority (AEPD) within 72 hours of becoming aware of the breach, as required by the GDPR and applicable Spanish legislation, where the breach is likely to result in a risk to the rights and freedoms of natural persons. Where feasible, affected data subjects will also be notified without undue delay.
Post-incident reviews are conducted for all significant incidents, and lessons learned are fed back into the risk management process and control improvement activities.
7. Business Continuity
CertiTrue integrates information security requirements into its business continuity planning. Business impact analyses identify critical processes and their recovery time and recovery point objectives.
Business continuity plans and disaster recovery procedures are documented, tested at least annually, and updated following any significant organisational or technical change. Backup procedures ensure that data can be restored within defined timeframes. Continuity plans are owned by senior management and are available to relevant staff at all times.
8. Internal Audit and Management Review
CertiTrue conducts internal audits of the ISMS at planned intervals, at minimum annually, to verify conformance with ISO/IEC 27001:2022, this policy, and applicable legal and regulatory requirements. Internal auditors are independent of the area being audited.
Audit findings are reported to senior management. Non-conformities are addressed through a formal corrective action process with defined owners and target completion dates.
Senior management reviews the ISMS at least annually. Inputs include audit results, risk treatment status, security incident trends, stakeholder feedback, and opportunities for improvement. Outputs include decisions on continual improvement actions, resource allocation, and any necessary policy changes.
9. Contact
For questions or concerns regarding this policy or CertiTrue's information security practices, please contact:
CertiTrue LLC
EIN 36-5132620
Miami, FL, United States