ISO 27001 surveillance audit passed: Galink remains certified ✅
ISO 27001 surveillance audit passed: Galink remains certified.
In September 2025, Galink achieved ISO 27001 certification. A certification only matters if it holds over time: every year, an independent auditor checks that our information security management system (ISMS) keeps delivering on its commitments. This year, once again, the surveillance audit confirmed our certification. ✅
What is a surveillance audit?
ISO 27001 certification is granted for a three-year cycle. Between the initial certification and recertification, an annual surveillance audit is carried out by an independent body. It does not repeat the initial audit; it checks that the system is genuinely alive:
Risks are reassessed and treatment plans are followed up,
Security controls are applied day to day, not just documented,
Internal audits and management reviews are carried out,
Identified gaps lead to corrective actions and continuous improvement.
In other words, the surveillance audit measures consistency, whereas the initial certification measures compliance at a given point in time.
Why it matters for our clients
Our platform holds the third-party risk data of CISOs, GRC teams and organizations across finance and insurance: assessment results, evidence and remediation plans. Sensitive information, by nature.
Every day, our clients ask their own vendors to demonstrate their security posture. It is only natural that they expect the same standard from us. For Galink, security isn't a box to tick: it's the foundation of the trust our clients place in us.
A commitment that continues
This result is not an end in itself. We keep strengthening our practices, raising our teams' awareness and evolving our ISMS in step with emerging threats and regulatory requirements, including DORA and NIS2, which apply to many of our clients.
Thank you to all Galink teams who bring these commitments to life every day. 🙌
👉 To learn more about our commitments, visit our security page.