Certifications and their scope
UP2DATE publishes ISO 9001:2015 and ISO/IEC 27001:2022 (SR ISO/CEI 27001:2023) certifications issued by Management Certification. The information security certificate is identified as series SI-MC no. 1214, initially issued in 2023.
The stated scopes include software development, software products, IT consulting, data processing and website administration. During supplier assessment, the documents, validity and applicable scope are confirmed for the engagement. Organizational certification does not automatically certify every application or its use.
Access to code, environments and data
The project inventory identifies account owners and the access each role needs. We establish who approves access, how credentials are managed and how access is removed when the team changes or at handover.
We distinguish the client’s, UP2DATE’s and suppliers’ responsibilities for repositories, cloud services, app stores and integrated systems.
What data is used and where does it flow?
- We identify the source, destination, permitted roles and purpose of each flow.
- We agree on test datasets and the necessary anonymization or data minimization measures.
- We clarify hosting, retention, export and deletion in the project requirements.
- For AI, we include the model provider, accessible documents, user permissions and control of actions.
How do we verify the controls?
Acceptance criteria include access scenarios, boundaries between users or organizations and relevant errors. Security testing, configuration reviews and independent assessments are defined within the project scope.
For a product in a regulated field, the client and designated specialists establish the applicable requirements. Implementing a software feature does not replace a compliance assessment of the whole product.
Incidents, backups and recovery
The support agreement specifies what we monitor, service hours, incident severity, escalation and response times. Resolution time depends on diagnosis and dependencies.
For continuity, we define who is responsible for backups, restoration checks and rollback steps. Targets are set according to the system; we do not assume that 24/7 support is included in every project.
What do we clarify during supplier assessment?
Discuss your requirements with us before sharing sensitive data. Specific documents and the level of detail are agreed during the assessment of the engagement.
- Relevant certification scope and documents.
- Responsibilities for data, access and suppliers.
- Included checks, deliverables and exclusions.
- Contacts for security, incidents and handover.