CRACI is now ISO/IEC 27001 certified, three months after we started the project. The certificate was issued by Into Certification to CRACI Corporation Oy, and it covers the information security management system for the development and operation of the CRACI platform.
Making it official
Three months is fast for an ISO 27001 project. It was possible because we did not have to start from zero. Security has been part of how our team works from day one: CRACI exists to secure other companies' software supply chains, and we hold our own platform to the same standard. The practices were already in place. The certification is about making them official, documented and independently audited.
That matters for the teams that run their builds on CRACI. Every build CRACI runs handles source code, dependencies and credentials, and a security review should not have to rely on our word. Now it doesn't have to: an accredited certification body has audited how we manage information security, and will keep auditing it.
Who audited us
Into Certification is a subsidiary of Into Security, a Finnish information security auditing and consulting company. Into Security was founded by Niki Klaus, its CEO, who has more than 20 years in the cybersecurity industry and a background in information security auditing and certification, including leading Nixu Certification. His founding partners are experienced lead auditors whose work spans critical infrastructure audits, national security assessments under Katakri, and advice to the European Commission on the eIDAS Regulation.
Into Certification is accredited by FINAS, the Finnish Accreditation Service, as a certification body for ISO/IEC 27001. An accredited audit by a team with that background is exactly the independent check we wanted.
How we did it
We run our information security management system in Cyberday. It keeps our policies, risks, controls and evidence in one place, which turned a documentation effort into a working system. The same tool powers our public Trust Center.
See the details
The certificate scope and our security documentation are in the CRACI Trust Center. If your security or procurement team needs more for a vendor review, get in touch.