We’ve passed our ISO 27001 audit, and Reformed IT is now certified. We’ve also passed ISO 9001, the standard for quality management. In plain terms, the way we look after your data has been independently checked and certified against an international standard.
What’s happened.
Our certificate of registration was issued by Peers Quality Assurance Limited (PQAL), a UKAS-accredited certification body. It records our initial assessment on 1 October 2026 and our registration on 13 October 2026, and it’s valid until 13 October 2029.
The certificate covers the provision of managed IT and cyber security services to private companies across the UK, assessed against ISO/IEC 27001:2022.
What ISO 9001 adds.
ISO 9001 is the international standard for quality management. Peers describe it as dealing with the fundamentals of quality management systems, which helps a business implement, develop and improve how it manages its own work. Where ISO 27001 is about protecting your information, ISO 9001 is about how we run our service day to day.
What ISO 27001 actually is.
ISO 27001 is the international standard for information security management. The standard says it specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system, and that those requirements are meant to apply to all organisations, regardless of type, size or nature.
In everyday terms: we had to write down how we protect information, who can access what, how we spot problems, how we respond when something goes wrong, and how we manage risk from suppliers and staff. Then an independent auditor checked that what we’d written is real and that we actually follow it.
How we got here.
This didn’t happen overnight. We passed Stage 1, the documentation review, at the end of June, which we wrote about in Reformed IT passes Stage 1 of ISO 27001. The hands-on audit followed, where the auditor checks that what’s on paper is what we do day to day, and the certificate is the result. Jamie Hissitt, our Head of Client Success, led the work to get us there.
Jamie Hissitt, Head of Client Success, led our ISO 27001 certification.
Why we did it.
It’s a voluntary standard. Nobody makes a business of our size go through it, and in our experience most don’t. It takes a lot of time and effort.
We did it because we spend our working days telling other businesses how to protect their information, and it felt right to hold ourselves to the same independent standard. If you trust us with your data, you should be able to ask how we protect it and get an answer that has been independently checked.
What this means for you.
Nothing changes about how we work with you day to day. What changes is the evidence behind what we tell you.
If you’re ever asked to show your own clients, insurers or regulators how your suppliers handle information security, you can point to this. The certificate is public proof that our own house is in order, not just advice we hand out.
If you’d like to know more about how we manage data, access and risk, or you need a copy of our certificate for your own records, just ask.
Every external claim above links to where it came from. The certificate details come from our own certificate of registration.
