When you hand over your cloud environment to a managed services partner, you’re handing over a lot of trust. Trust is good, but evidence is better. That’s why we’re proud to announce that Cloudar has achieved ISO 27001 certification for our Dutch operations, alongside our existing certification in Belgium, which we have held since 2018. Extending it to the Netherlands shows that our approach is consistent across the countries we serve.
ISO 27001 is the international standard for information security management. It doesn’t just look at technology, but at how an organisation works: how risks are identified, how access is controlled, how incidents are handled and how improvements are made over time. Certification means an independent auditor has examined our processes and confirmed that we handle information securely.
Why this matters for a company like Cloudar
As a cloud partner, we sit in a privileged position. Our engineers work inside our customers’ environments every day, with access to infrastructure, workloads and, indirectly, the data that runs their business. A mistake on our side doesn’t stay on our side. That’s why information security is part of the service itself, not a side topic. ISO 27001 makes that discipline explicit and verifiable: risks are documented, responsibilities are assigned, and procedures are tested by an auditor who has no interest in giving us an easy pass. The certification covers not only our managed services, where we operate customer environments on an ongoing basis, but also everything we build for customers. Security isn’t an extra layer added per project: the same requirements apply from design to daily operations.
Managed services are built on continuity. Monitoring, incident response, patching, access management and backup often run around the clock, and each of them touches sensitive systems. That is why a management system works better than a one-off checklist. ISO 27001 requires us to review incidents and learn from them, run internal audits and adapt as threats change, and the certificate is re-examined in an audit every year.
For customers, this brings practical benefits:
- A recognised, independent reference for their own supplier assessments and audits
- Less time spent on security questionnaires, because many answers are already covered by the certificate
- Clear, documented processes for how we handle access, changes and incidents on their behalf
What it means within our AWS partnership
Cloudar and AWS share a straightforward view of security: it is a shared responsibility. AWS is responsible for security of the cloud: the data centres, hardware, network and the services themselves. Customers, and the partners who manage their environments, are responsible for security in the cloud: how those services are configured, who has access, how data is protected and what runs on top. That is where many cloud security incidents start, for example with overly permissive roles or publicly exposed storage.
ISO 27001 helps us live up to our side of that model in a structured way. Our processes for access, change and incident management are governed by audited procedures, not by the good intentions of individual engineers. It also supports the standards we already work to as an AWS partner, where proven operational and security capabilities are part of the game. For customers building on AWS, this creates a clear chain of assurance. AWS’s certifications cover the platform, ours covers how we operate on it. That makes it easier to build a compliant environment, and to prove that it is compliant.
NIS2 is already in force, and as a service provider Cloudar falls under the directive, which means we are legally required to meet its security and reporting obligations. ISO 27001 is not mandatory, but the two fit together well. A large part of what NIS2 expects, such as risk management, incident handling, supply chain security and business continuity, is covered by the ISO 27001 framework. That makes ISO 27001 a valuable help in meeting the NIS2 requirements, both for us and for customers who need to show that their suppliers take it seriously. NIS2 is something we have to comply with. ISO 27001 is something we chose, because customers deserve proof, not just promises.
