Held and maintained, not claimed

ISO 9001, held since 2003, is the quality management standard: the documented way GSA specifies, builds, tests, releases and supports software, audited every year by an external body. ISO 27001, held since 2010, is the information security management standard, and the one a police or NHS buyer asks for first: risk assessment, controls, incident handling and continual improvement across the business, not a single product. ISO 14001, held since 2014, is environmental management, and it sits behind the Carbon Reduction Plan published on this site.

Cyber Essentials has been held since 2014 and Cyber Essentials Plus since 2017: the Plus level adds an independent technical test of the controls, not a self-assessment. GSA’s NHS Data Security and Protection Toolkit assessment is graded Standards Exceeded, which is what allows NHS organisations to use Freedom for their own disclosure work.

The Police Assured Secure Facility at Bardon Hill is where development and support are done; the products themselves are hosted in the AWS Police Assured Landing Zone in London, so customer data stays in the UK. GSA is a signatory to the Police Industry Charter, which governs conduct between policing and its suppliers. Purchasing runs through G-Cloud 14 and Digital Outcomes and Specialists 7.