Compliance.
Where we stand, what these standards actually require, and how we help clients meet their own obligations.
Empreus is working toward ISO/IEC 27001 certification and a SOC 2 attestation. Neither is complete, and we will not imply otherwise.
We have said elsewhere that compliance is not a project with an end date but a standard of operation you either sustain or quietly lapse from. It would be a poor look to treat our own position any differently, so this page states it plainly and will be updated when that changes — with the certificate details, the issuing body and the scope, so the claim can be checked rather than taken on trust.
In the meantime, the controls both standards are built on — access review, documented change, tested recovery, layered endpoint protection, managed identity — are how we already run every client environment. That is the substance the certificate attests to, and it is worth more than the certificate.
ISO/IEC 27001
The international standard for an information security management system. It is less about any single control than about being able to show that risks are identified, decisions are recorded, and the whole thing is reviewed rather than set once and forgotten.
It is increasingly what larger clients and tender panels ask for as shorthand: evidence that security is run as a system rather than assembled from habits.
SOC 2
An independent auditor's report on how a service organisation handles customer data, assessed against trust services criteria — security first, with availability, confidentiality, processing integrity and privacy added as scope requires.
Where ISO 27001 certifies the system, SOC 2 reports on how it actually operated over a period. A Type II report covers months of evidence, not a moment in time.
What this means for you
If your own obligations require a certified supplier today, say so early and we will tell you honestly whether we can meet the requirement — and if we cannot yet, who might. That conversation is cheaper in the first week than in the sixth.
If what you need is help meeting a standard yourself — Essential Eight maturity, an IRAP assessment, DISP membership, or the evidence trail underneath any of them — that is work we already do. Our orientation on which standard applies is a reasonable place to start, and an IT audit gives you the honest picture the frameworks all begin from.
Where we already stand
- Panel
- DTA Hardware Marketplace
- Ownership
- Australian owned and operated
- Data
- Client data held in Australian regions
- Team
- Locally based, no offshore overflow desk
No pitch, no obligation