ISO 27001 information security management
We support security review with access controls and audit records, while your organisation assesses the wider management system and the technical arrangements it needs.
Set by ISO
Subject type: standard. ISO 27001 sets requirements for an information security management system, and a certification body assesses an organisation against it. This page describes controls and records available for review. It is not a certified management system.
Certification status
NextHealth does not claim ISO 27001 certification on this page. Ask our team for the current assurance documentation relevant to your deployment.
What is built
- Roles and permissions support controlled record access.
- Two-factor sign-in is available in the described product scope.
- Audit evidence records read and write activity for review.
What your team can ask for in procurement
Bring the access scenarios and technical questions relevant to your deployment. Review the application evidence alongside policies, responsibilities, supplier arrangements and security documentation, and agree with our team who answers each security question and in what form. Confirm encryption, resilience and recovery specifications separately rather than inferring them from authentication controls.
What these controls do not show
Specific application controls can contribute evidence to a wider review. Their presence does not establish the scope, effectiveness or certification status of any organisation’s management system, and selected controls are not equivalent to certification. Your organisation’s risk assessment and control decisions remain essential. No complete control mapping or independently assessed security effectiveness is asserted.
Official source
ISO/IEC 27001. ISO publishes the standard.
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
NextHealth does not claim ISO 27001 certification on this page. The page describes controls and records available for review. Ask our team for the current assurance documentation relevant to your deployment.
-
Ask for the encryption, backup and recovery specifications for your deployment, any security testing evidence, the incident arrangements and the identity integration scope. Agree in writing who answers each request, and rely only on what is confirmed.
-
No. Roles, two-factor sign-in and audit records are specific application controls. ISO 27001 concerns an organisation’s whole management system, and certification is decided by a certification body.
Not answered here? Contact the team
NXH Flow