Governance & risk
Management system, risk assessment, treatment, audit and continual improvement.
TRUST & ASSURANCE
ISO/IEC 27001:2022 — ISMS Scope
ISO/IEC 27001:2022 certificate SIS351224I008 scope, evidence and applicability boundaries for Mobile-ID Sign.
ON THIS PAGE
ISO/IEC 27001
ISO/IEC 27001:2022 — ISMS scope and relevance to Mobile-ID Sign
The certificate applies to Mobile-ID’s Information Security Management System within the printed scope. GoPaperless and digital-signing solutions are named in that scope, but this does not make every API or component a separately “ISO-certified product.”
CERTIFIED SCOPE-BOUND
ISO/IEC 27001:2022
- Certified organization
- Mobile-ID Technologies And Services Joint Stock Company
- Certificate number
- SIS351224I008
- Certification body
- SIS Certifications Pvt. Ltd.
- Initial registration / issue
- 05/12/2024
- Printed expiry
- 04/12/2027
- Printed surveillance due
- 05/11/2025
- Statement of Applicability
- SOA.01 · Version V.02 · 01/10/2024
- SHA-256
2f98d1f19cea88d58c7bf32703e60ff6dc827bffc044fba167b7d1efa834e9d1
Solutions for digital identity, secure authentication and digital signing — Trusted Hub, GoPaperless, Mobile-ID, CheckID, Facial Sense, Trusted Pay, Trusted Care, TrustedID, Trusted Kioware, X-Avenue, MRConnect, Qrypto, Blockchain Services Infrastructure, Remote Signing, Time-Stamping Authority, PKI tokens, eID cards and ePassport certificates.
WHAT IT SUPPORTS
Assurance context, not a product-security shortcut
The certification is most useful as an organizational assurance anchor for security governance around Sign.
Identity & privilege
Unique accounts, need-to-know/use, MFA for critical systems and access revocation are stated in the public information-safety policy.
Response & RCA
Incidents are recorded/classified/handled, followed by root-cause analysis and corrective/preventive action.
APPLICABILITY
How ISO 27001 relates to Sign
Do not map individual Annex A controls unless an approved public Statement of Applicability supports that mapping.
If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.
| Security domain | Organizational assurance | Sign relevance | Evidence |
|---|---|---|---|
| Risk Management | ISMS governance | Platform/service risk process | Certificate + policy |
| Asset Management | Classification/ownership | Documents, configurations and evidence need defined handling | Security policy |
| Access Control | Need-to-know/use, MFA | Admin/API/operations access | Security policy |
| Incident Management | Record, classify, RCA | Signing-service incident response | Security policy |
| Audit & Improvement | Annual internal audit / review | Assurance governance | Security policy |
Not a blanket product certification
ISO/IEC 27001 certifies the management system within scope. FIDO2, OpenID, FIPS and QSCD/Common Criteria serve different assurance questions and must retain their own subject and scope.
ASSESSMENT DETAIL
Using the certificate in an assessment package
ISO/IEC 27001 should be used as evidence of the organization's information-security management system within the printed certificate scope, not as a blanket security seal for every API or signing transaction. A vendor/security assessment should retain the certificate number, certified organization, issuer, issue date, printed expiry, scope, source URL and the reviewed certificate file.
- Verify certificate identity. Match SIS351224I008, the certified organization and the certification body.
- Read the printed scope. Associate GoPaperless/digital signing with the ISO certificate only where the published scope supports it.
- Check current status. Printed expiry does not replace surveillance or issuer status; a formal assessment should verify the issuer record.
- Separate organizational from product assurance. FIDO2, OpenID, FIPS/QSCD and transaction evidence answer different questions and require their own evidence.
- Record limitations. ISO 27001 does not by itself prove legal compliance, cryptographic certification or a customer's production configuration.
The website therefore presents ISO together with security policy, the certificate registry and transaction evidence so assessors can evaluate an assurance chain rather than a single logo.