Still to standard, by design.

1. Purpose

This statement is a director’s self-declaration confirming that ibCom Pty Ltd (“ibCom”) continues to operate its Information Security Management System (ISMS) to the standard of its most recent external certification, during a planned transition to the current editions of the applicable standards. It is provided for the assurance of ibCom’s customers, partners and their auditors.

2. Prior certification

ibCom held external certification, issued by Best Practice Certification Pty Ltd (JAS-ANZ accredited), to ISO/IEC 27001:2013 (certificate no. 55040494277I) and ISO/IEC 27017:2015 (certificate no. 55040494277I2).

Initial certification: 20 March 2017. Most recent issue: 3 April 2023. Expiry: 19 March 2026. The certified scope, as issued, was “ibCom and the mydigitalstructure & entityOS cloud service, in accordance with Statement of Applicability version 2.1.”

3. Reason for the certification gap

The lapse of the certificate on 19 March 2026 was a deliberate and planned decision. ISO/IEC 27017 (information security controls for cloud services) was under revision, and ibCom elected to defer recertification until the new edition was published — so it could recertify against the current editions of both standards in a single transition, rather than certify to editions about to be superseded. ISO/IEC 27017:2026 was published on 27 July 2026; ISO/IEC 27001:2022, with its control set ISO/IEC 27002:2022, is the current edition of the management-system standard.

4. Attestation of continued conformance

As a director of ibCom Pty Ltd, I attest that:

• The ISMS remains fully operational and continues to be maintained and operated to the standard of the lapsed certificate (ISO/IEC 27001:2013 and ISO/IEC 27017:2015).
• The confidentiality, integrity and availability of customer data held on the entityOS cloud service continue to be preserved.
• The information security controls underpinning the certified ISMS remain in force without material change — the “least number of humans” operating model; the fixed, mature platform kernel on AWS; role-based least-privilege access with optional IP allowlisting and MFA; encryption in transit and at rest; real-time data-store duplication with daily test-restores; the continuous automated security-testing service; and the documented incident-management and customer-notification process.
• There has been no material adverse change to ibCom’s information security risk posture during the certification gap.
• ibCom’s Statement of Applicability has been updated (version 3.0) to align with ISO/IEC 27001:2022 and ISO/IEC 27017:2026; all Annex A controls and the four ISO/IEC 27017:2026 cloud-specific controls are applicable and implemented, with a single documented exclusion (8.30 Outsourced development).

5. Recertification commitment

ibCom is undertaking external recertification to ISO/IEC 27001:2022 and ISO/IEC 27017:2026, and commits to having the renewed certificate issued by 30 November 2026.

6. Status of this statement

This is a self-declaration by a director of ibCom Pty Ltd. It is not a substitute for accredited third-party certification, which is in progress. It should be read together with ibCom’s current Statement of Applicability (v3.0) and supporting Protection & Security documentation.