Outsight Attains ISO 27001 Certification

Frequently Asked Questions

• What does ISO 27001 certification actually require a company to do?

  ISO 27001 requires an organization to define the scope of its information security management system, assemble a governing body from senior management and key stakeholders, document security controls and operational procedures, complete an internal audit, and pass an independent third-party external audit. The standard specifies a minimum set of documents that must exist before certification can be granted. It is not a one-time review: ongoing compliance requires periodic reassessment. Outsight attained ISO 27001 certification for the SHIFT platform, a milestone that carries particular weight given the security-sensitive nature of deployments such as datacenters and critical infrastructure facilities where the platform operates.

• How does ISO 27001 differ from SOC 2?

  ISO 27001 is an international standard (published by ISO/IEC) that certifies an organization's information security management system against a defined framework of controls. SOC 2 is a US-origin audit report (defined by the AICPA) that evaluates controls around security, availability, and confidentiality for service organizations. ISO 27001 results in a certificate recognized globally; SOC 2 results in an auditor's report primarily used in North American procurement. Many enterprise buyers, particularly in regulated industries, require both. Outsight, whose SHIFT platform processes real-time 3D sensor data across airports, factories, and transit infrastructure on five continents, holds both certifications, reflecting the compliance expectations of operators in those sectors.

• Does a LiDAR-based spatial intelligence system handle sensitive customer data?

  LiDAR sensors capture shape, position, and motion of objects, not faces, license plates, or biometric identifiers. A deployment does, however, handle operationally sensitive data: trajectory records, occupancy time-series, flow KPIs, and site layout. Outsight's SHIFT platform is designed around this distinction, processing all spatial data anonymously by definition while still generating rich operational intelligence. That operational data is governed by the vendor's information security practices, and certifications such as ISO 27001 and SOC 2 address how it is stored, accessed, and protected. Enterprise infrastructure buyers at airports, factories, and transit hubs increasingly treat these certifications as baseline procurement requirements before onboarding any spatial intelligence system.

• What is Vanta used for in an ISO 27001 certification process?

  Vanta is a compliance automation platform that continuously monitors a company's technical controls, such as access management, encryption settings, and audit logging, and maps them to the requirements of frameworks like ISO 27001 and SOC 2. It reduces manual evidence collection by pulling data directly from cloud services and infrastructure, which shortens the preparation time for both internal audits and external auditor reviews. Outsight used this kind of continuous monitoring approach as part of its path to achieving ISO 27001 certification, reflecting the information security standards expected of a platform that processes real-time 3D data across airports, transit hubs, and industrial facilities on five continents.

• Which certifications does Outsight hold for information and operational security?

  Outsight holds ISO 27001 for information security management, SOC 2 for service organization controls, TISAX for automotive-grade information security (required for suppliers to automotive OEMs such as BMW and Stellantis), and BASt certification from the German federal highway research institute for truck-parking monitoring with native 3D sensors. The BASt certification is the only one of its kind worldwide for that specific use case. These credentials underpin the SHIFT platform's deployments across security-sensitive environments, including datacenters and major transportation hubs on five continents.

• Is ISO 27001 required for selling spatial AI software to airports or government clients?

  ISO 27001 is not universally mandated by law, but it is widely required by procurement policy in aviation, public-sector, and critical-infrastructure contracts. Many airport operators and government agencies include it as a pass/fail criterion in vendor qualification, meaning a software vendor without it typically cannot reach the final evaluation stage regardless of technical merit. The certification functions as a baseline trust signal rather than a competitive differentiator in those procurement contexts. Outsight, whose SHIFT platform is deployed at facilities such as Dallas Fort Worth Airport and Paris-Charles de Gaulle, attained ISO 27001 certification precisely because airport and government clients treat it as a prerequisite for advancing through procurement processes.

• Who conferred the ISO 27001 certification and when was it announced?

  Outsight's ISO 27001 certification was conferred by Prescient Security Solutions, and Outsight announced it in January 2024. The certification followed a structured process in which Outsight used Vanta as a platform and received strategic advice from VioletX. Outsight thanked all three organisations for their roles and presented the milestone as assurance that its processes and Information Security Management System adhere to the highest global standards.

• What is an Information Security Management System (ISMS) in the context of ISO 27001 certification?

  An Information Security Management System (ISMS) is a set of documented security requirements and controls that govern how an organisation protects information and its supporting assets. A company demonstrates that it follows its ISMS by presenting policies, procedures and operational processes, and the ISO 27001 standard lists the essential documents that must at least be in place. For Outsight, which handles projects of varying sizes and extensive volumes of data, a robust ISMS is central to safeguarding sensitive information.

• What steps were followed to achieve ISO 27001 certification?

  Outsight's path to ISO 27001 followed four main steps. First, it scoped and implemented an Information Security Management System (ISMS). Second, it established an ISMS governing body made up of senior management and key stakeholders from across the company. Third, it ran an internal audit to assess the ISMS and how well it was implemented. Finally, it underwent an ISO audit with an external third-party auditor, Prescient Security Solutions, which conferred the certification.

• What role did VioletX play in the ISO 27001 certification journey?

  VioletX provided strategic advice to Outsight during its ISO 27001 certification process. Outsight combined this advice with the expertise of Vanta as a platform, while the certification itself was conferred by Prescient Security Solutions. The process covered scoping and implementing an Information Security Management System, establishing its governing body, performing an internal audit and undergoing an ISO audit with an external third-party auditor.

• Who sits on the ISMS governing body established during the ISO 27001 certification process?

  As part of its ISO 27001 certification process, Outsight established an ISMS governing body composed of senior management and key stakeholders from throughout the company. This was the second of four steps in the process. It followed the scoping and implementation of the Information Security Management System, and came before an internal audit of the ISMS and an ISO audit with an external third-party auditor. Outsight completed the process with the expertise of Vanta as a platform and the strategic advice of VioletX, and the certification was conferred by Prescient Security Solutions.

• What is the internal audit step in the ISO 27001 process and when does it occur?

  The ISO 27001 process Outsight followed includes an internal audit to assess the organisation's Information Security Management System and its implementation. This step comes after scoping and implementing the ISMS and establishing its governing body. It precedes the final step, an ISO audit with an external third-party auditor. Outsight's certification was ultimately conferred by Prescient Security Solutions. Outsight describes the path to ISO 27001 as a meticulous process ensuring a comprehensive information security approach, supported by Vanta as a platform and the strategic advice of VioletX.

• What documents does an ISO 27001 ISMS need to have in place?

  According to Outsight, an Information Security Management System consists of documented security requirements and controls. An organisation demonstrates adherence to and execution of its ISMS by presenting policies, procedures and operational processes. The ISO 27001 standard outlines the essential documents that must at least be in place. Outsight states that a professional organisation must manage data correctly to give clients confidence that their information is treated with care and diligence.

• What does ISO 27001 certification guarantee to customers?

  With ISO 27001 certification, Outsight's clients have assurance that the company's processes and Information Security Management System adhere to the highest global standards. Outsight describes the certification as a testament to the trust clients can place in it and as a signal that their data is handled with the utmost integrity and security. It reinforces Outsight's commitment to excellence in information security and to providing clients with the highest standards of data protection.

• Why is ISO 27001 called the global gold standard for information security?

  ISO 27001 is considered the global gold standard for ensuring the security of information and supporting assets. For Outsight, the certification proves the company's security practices to potential customers anywhere in the world. Achieving it involved implementing an Information Security Management System, setting up a governing body of senior management and key stakeholders, performing an internal audit and undergoing an ISO audit with an external third-party auditor.

• Why does a strong ISMS matter for projects that process large volumes of data?

  Outsight works on projects of varying sizes and processes extensive volumes of data, so it considers a robust Information Security Management System essential. Whether a project is small-scale or a large collaborative endeavour, safeguarding sensitive information is paramount. Outsight's view is that a professional organisation must manage data correctly to give clients confidence that their information is treated with the utmost care and diligence, and ISO 27001 certification formalises that commitment.

• Is people flow data a cybersecurity risk for an airport or station?

  Any connected system can be a cyber risk, so flow monitoring should be deployed with strong security practices and certified processes. The data itself carries lower risk when it is anonymous by design: 3D LiDAR data contains no images, faces or personal identifiers, so a breach exposes no personal information. Vendors should also hold certifications such as ISO 27001 and SOC 2. Outsight holds both, and processes 3D data at the edge before sending compact results.