ROC has achieved ISO/IEC 27001 certification, providing independent validation of how we manage information security risk and protect sensitive data. The certification gives enterprise and government customers an independently audited security baseline as they evaluate ROC’s American-made Vision AI.
What the Certification Means for Customers
ROC’s certification covers the information security management system (ISMS) supporting the development, delivery, and operation of our software products, SaaS offerings, and supporting cloud infrastructure. The certification was issued by an independent certification body accredited by the ANSI National Accreditation Board (ANAB).
For enterprise and government customers, this provides evidence of the security governance, risk management, and data-protection controls supporting ROC’s technology infrastructure. It can help streamline vendor-risk assessments and procurement reviews, particularly in regulated markets with demanding security requirements.
“Security and privacy are fundamental to ROC and align with how enterprise and government customers evaluate and procure technology. ISO 27001 is an independent validation of how we manage information security risk and protect sensitive data.”
What Is ISO/IEC 27001?
ISO/IEC 27001 is an internationally recognized information security standard that sets requirements for establishing, operating, monitoring, maintaining, and continually improving an information security management system (ISMS). The standard provides a framework for business, people, and IT processes that helps organizations identify, manage, and reduce information security risks. It addresses areas including risk assessment, access controls, incident response, business continuity, vendor management, and data protection.
In practical terms, ISO/IEC 27001 certification demonstrates that an organization’s ISMS has been independently assessed against the standard’s requirements for managing and continually improving their security posture.
How Does the Certification Process Work?
Pursuing ISO/IEC 27001 certification is a multistep process that begins with an internal audit. This assesses whether an organization’s ISMS has been developed, implemented, and maintained in accordance with its own requirements and those defined by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
Following the internal audit, organizations proceed to a two-stage certification audit:
- During Stage 1, an independent third-party auditor reviews the design of the organization’s ISMS, including its documentation, identifies potential nonconformities, and evaluates plans to address any issues.
- Organizations that successfully complete Stage 1 move to Stage 2, where the auditor tests the effectiveness of the ISMS, including whether identified areas of concern have been addressed.
At the conclusion of both stages, the certification body reviews the audit results and makes a final certification decision. ROC’s certification is valid for three years, subject to annual surveillance audits. Certification does not guarantee that security incidents will not occur.
Security Governance and Algorithm Performance
Customers evaluating technology consider both performance and security practices. ROC regularly tests its biometric technologies and submits algorithms for independent NIST evaluation, reflecting our ongoing commitment to testing and transparency. At the same time, ISO 27001 certification independently validates the information security management system supporting our products and services.
“Independent NIST evaluations of ROC’s algorithm performance and ISO 27001 certification of its information security management system provide complementary assurance. Together, these assessments can strengthen customer confidence in both the performance and governance of ROC’s technology.”
Future-ready insights.
Straight from the source.
Subscribe for Vision AI insights, product updates, and stories from the front lines of identity and intelligence.
