ISMS operational, ISO 27001 certification in Q1 2027
Overview of our certifications, audits and compliance roadmap. Onesurance continuously invests in achieving and maintaining the highest security standards.
- ISO 27001 certification: Q1 2027.
- ISMS fully operational: information security management system active.
- Annual internal audits: most recent audit completed in September 2026; additional audit upon significant changes.
- External pentest programme: first external pentest planned for Q1 2027.
The status of every track
Detailed overview of all certifications and compliance frameworks that Onesurance pursues and adheres to.
ISO 27001
In progress
- Status: ISMS fully operational, external certification Q1 2027
- Scope: Information security management system
- Annex A (ISO 27001:2022): 93 controls in 4 themes
- Audits: Annual internal
Organisational controls
Information security policies, organisation of information security, asset management and access control. All organisational controls are defined, implemented and periodically reviewed.
People controls
Screening, terms of employment, security awareness training and disciplinary processes. All employees complete a security awareness programme and receive periodic training.
Physical controls
Physical security is ensured through Microsoft Azure data centres (ISO 27001 and SOC 2 certified) with 24/7 surveillance, biometric access control and environmental management.
Technological controls
Encryption at rest and in transit, network segmentation, vulnerability management, logging and monitoring. All technological controls are continuously monitored via Azure Security Center.
AVG / GDPR Compliance
Compliant
- Status: Fully compliant since inception
- DPO appointed: Menno Kooistra
- Data processing agreement: DPA available for all clients
- DPIAs: Conducted for all high-risk processing activities
- Register: Record of processing activities maintained and up to date
DORA
Aligning
- Status: Control measures established based on the 5 DORA pillars
- Sector: Specific to the insurance industry
- ICT risk management
- Incident reporting
- Digital operational resilience
- Third-party ICT risk management
- Information sharing
EU AI Act
In preparation
- AI systems classification: Limited / Minimal Risk
- Design: Human-in-the-loop design
- Status: Preparing for full compliance
- AI systems classified by risk level
- Transparency requirements implemented
- Human oversight in all AI processes
What has been done and what comes next
Overview of our planned and completed audits and security assessments.
| Type | Frequency | Last | Next |
|---|---|---|---|
| Internal audit | Annually | September 2026 | September 2027 |
| Penetration test | Annually | — | Q1 2027 |
| DPIA | On change | 06-11-2024 | Scheduled |
| DR test | Annually | — | To be scheduled |
Questions about our certifications?
Our Data Protection Officer is happy to assist you with questions about certifications, audits or compliance.