Atomicwork achieves ISO 27701, 27017, and 27018 second-time around with a brand-new audit

We're proud to share that Atomicwork has successfully achieved certification against ISO/IEC 27701, ISO/IEC 27017, and ISO/IEC 27018 — and that all three audits closed with zero non-conformities.

This year, we didn't have to run these audits at all. We chose to.

The easy path we didn't take

Most certification standards operate on a three-year cycle. After the initial audit, the following two years involve lighter “surveillance” audits to confirm that Atomicwork controls are still operating as designed. Which means that after our first successful achievement 2 years ago, we had runway left.

Instead, we made a deliberate decision to undergo a full, fresh certification audit — a complete re-assessment of our privacy, cloud security, and PII controls, in place of the lighter surveillance review the cycle would have allowed. We asked our certification partner, Intercert, to treat this as a first-look review — every control demonstrated fresh, every claim evidenced again, nothing carried forward on assumption.

Why fresh eyes matter

When the same systems get reviewed cycle after cycle, context accumulates and softens scrutiny. A full audit resets reviews and makes every control prove itself again and every claim evidence itself.

That's exactly the kind of pressure test we wanted to show we could pass for enterprise trust. A platform that touches employee data, access, and identity across an organization needs to pass the highest of bars and meet the most stringent security and governance standards possible.

Our commitment to our customers is simple: we will keep choosing the path that earns your trust, even when an easier one is available.

That’s why we opted for an audit that confirmed what we already believed — we wanted one that could challenge it. Passing a full, first-look audit across three standards, with zero non-conformities, is a far stronger signal than renewing on autopilot – it means that our security posture holds up under genuinely rigorous review, not just continuity.

In audit speak, a non-conformity is a gap between what a standard requires and what an organization can demonstrate. Even mature, well-run programs commonly have minor findings like a document that needs updating or a lack of evidence for a minor control.

Closing three simultaneous audits with none is the compounded result of everyday discipline: engineering teams who build controls in from the start, teams who treat evidence as a habit rather than a scramble, and a culture that assumes someone will always check the work. A clean result under a full, no-shortcuts audit is the clearest proof that these practices are real and repeatable.

What these three standards actually mean for enterprises

Certifications can blur into an alphabet soup, so here's what each one represents in plain terms — and why it matters if you trust Atomicwork with your data.

ISO/IEC 27701 — Privacy Information Management. An extension to the ISO 27001 information security framework that focuses specifically on how personal data is governed, processed, and protected. It maps closely to global privacy expectations, including GDPR principles.

ISO/IEC 27017 — Cloud Security. A code of practice for information security controls purpose-built for cloud services. It goes beyond generic security to address the specific responsibilities, configurations, and shared-responsibility realities of operating in the cloud — where Atomicwork lives.

ISO/IEC 27018 — Protection of Personal Data in the Cloud. Focused on safeguarding personally identifiable information (PII) when it's processed in public cloud environments. It sets expectations for how a cloud provider handles, isolates, and protects the personal data entrusted to it.

Together, these three standards cover the trifecta that matters most for a modern AI-native enterprise ITSM & ESM platform: privacy, cloud security, and the protection of personal data in the cloud. They complement the foundations we've already established, and they reflect the environment our customers actually operate in.

Atomicwork's certifications, audit reports, and security documentation are available in our Trust Center – please reach out to us at [email protected] to learn more.