A Sound Basis for Technical Assurance: Our 5-Step Process

Our certification process is designed for organizations that require more than a compliance check. We deliver a rigorous, risk-based evaluation led exclusively by senior technical auditors, strictly following the ISO/IEC 17021-1 requirements.

Scroll

Pragmatism Over Bureaucracy: Our Core Philosophy

We believe that an audit should be a strategic asset, not a procedural burden. Our methodology focuses on the functional effectiveness of your controls within your specific operational context.

Senior-Led Engagement

Your audit is conducted by veterans who understand complex infrastructures from day one.

Risk-Based Focus

We prioritize high-impact security areas over trivial checklist items.

Academic Precision

Every evaluation is rooted in the “Sound Basis” principles established by our founders.

The Certification Cycle

01 Pre-Audit / Gap Analysis (Optional)

Before the formal process begins, we can conduct a preliminary assessment to identify potential gaps in your Management System. This proactive step provides clarity on your readiness for the official certification cycle.

02 Application & Scope Definition

The foundation of a successful audit is a precise scope. We work with your technical team to define the boundaries of the audit, ensuring it accurately reflects your risk profile and business objectives.

03 Initial Certification Audit

Stage 1: Documentation & Readiness Review We evaluate the design of your Management System (ISMS/PIMS) and assess your preparedness. This stage ensures that the documented framework is technically sound before proceeding to the operational deep dive.
Stage 2: Operational Effectiveness Audit Our senior auditors perform a thorough evaluation of your technical controls in action. We look for evidence that your security measures are actively mitigating real-world threats and functioning as intended.

04 Step 4 & 5: Independent Certification Committee & Decision

To ensure absolute impartiality, the final decision is decoupled from the audit team. Findings are reviewed by our Independent Certification Commission – a board of senior authorities who provide the final “Sound Basis” for awarding the certificate.

Pre-Audit / Gap Analysis (Optional)

Application & Scope Definition

Initial Certification Audit

Independent Certification
Decision

Surveillance & Recertification

Maintaining the Integrity of Your Certificate Certification is a three-year cycle focused on continuous improvement and resilience. Annual Surveillance: We conduct yearly audits to verify that your system remains effective and evolves alongside new threats and organizational changes. Recertification: Every three years, a full reassessment is conducted to renew your certification and align it with the latest standards. Short-Notice Audits: If significant changes or incidents occur, we may conduct focused audits at short notice to ensure continued compliance and protect the integrity of the certificate.

Governance & Formal Procedures

Professional Accountability & Trust As an accredited body (RvA C663), we maintain rigorous procedures for every stage of the certification lifecycle. Scope Adjustments: We manage the expansion or reduction of your certification scope as your organization’s technology stack and services evolve. Suspension & Withdrawal: To protect the value of the Noordbeek seal, we have clear procedures for suspending or withdrawing certification in cases of persistent non-compliance. Appeals & Complaints: We provide a transparent, impartial mechanism for resolving disputes. Every appeal is reviewed by the Independent Certification Commission to ensure a fair and technical resolution. Public Verification: All issued certificates are transparently listed and verifiable via our online search registry.

Protecting Your Information Confidentiality is the bedrock of our relationship.

Every member of our audit teams and the Certification Commission is bound by strict confidentiality agreements, ensuring that your technical architecture and business secrets remain protected throughout the entire process.