voluntary, asked for by customers
the standards customers ask for
Voluntary standards and audit reports. No law requires them, but customers, tenders and insurers often do.
- certificationISO 27001A voluntary standard for running security as a management system. No law requires it. Customers often do, and it gives the laws a structure to hang on.open
- certificationSOC 2A report from a licensed auditor on your controls, built on US audit standards and asked for in sales questionnaires. No law requires it, and new criteria were proposed in October 2026.open
- certificationISO 42001A voluntary standard for running AI as a management system. No law requires it, and it does not replace the AI Act. Customers and tenders ask for it, and it gives the work an owner and a yearly cycle.open
- certificationISO 22301A voluntary standard for running business continuity as a management system. No law requires the certificate. Customers and tenders ask for it, and it gives the continuity duties in NIS2 and DORA an owner and a yearly cycle to run on.open
- certificationTISAXAn information security assessment for the automotive supply chain, run by the ENX Association on the VDA ISA catalogue. No law requires it. Car makers and their suppliers ask for the label, and it is valid for three years.open
- certificationPCI DSSA security standard for payment card data. Card brands and acquirers decide who has to prove it and how, and no law requires it. It reaches whoever stores, processes or transmits card data.open
- certificationISO 27701A voluntary standard for running privacy as a management system, for organisations that decide how personal data is processed and for those that process it for others. No law requires it, and a certificate is not GDPR compliance. Since October 2025 it is a standalone standard.open