Security due diligence
Enterprise customers demand certified security.
How we help: ISO/IEC 27001:2022 with risk-based Annex A controls.
Industry
Technology & Telecom
Customers ask technology providers to prove that data is secure, privacy is respected, services are reliable and AI is governed. We build one integrated system that answers all four, and prepare you for certification.
Challenges we solve
Pressures on technology providers
Security questionnaires, privacy law, AI regulation and uptime commitments arrive in the same sales cycle.
Privacy obligations
Processor and controller duties under data protection law.
How we help: ISO/IEC 27701:2025, now standalone, plus ISO/IEC 27018 for public cloud.
AI governance
Customers and regulators asking how AI is controlled.
How we help: ISO/IEC 42001 with AI risk and impact assessment.
Cloud controls
Shared responsibility with customers and providers.
How we help: ISO/IEC 27017 cloud controls assessed with ISO/IEC 27001.
Service reliability
SLAs, incidents and change control.
How we help: ISO/IEC 20000-1 service management.
Resilience
Outages and regulatory resilience expectations.
How we help: ISO 22301 continuity with tested recovery plans.
Recommended standards
Standards for technology and telecom
Core standards first, then the additions your customers, regulators or risks call for. Most run as one integrated management system.
ISO/IEC 27001
Information security, the base for every extension.
Core ISO/IEC 27701Privacy management, standalone since 2025.
Core ISO/IEC 42001AI management system.
Core ISO/IEC 20000-1IT service management.
ISO/IEC 27017Cloud security controls.
ISO/IEC 27018PII protection in public cloud.
ISO 22301Business continuity.
ISO 50001Data centre energy performance.
Regulatory context
Requirements that shape your system
Management systems help you meet these obligations and show evidence of control. They do not replace the obligations themselves.
Cyber resilience
NIS2 in the EU and similar critical-service rules elsewhere.
Financial-sector clients
DORA requirements on ICT third-party providers serving EU financial entities.
Data protection
GDPR and other data protection laws for personal data you process.
AI regulation
The EU AI Act, with obligations phasing in from 2025.
Which requirements apply depends on your jurisdiction and activities. We map your system to the ones that apply to you.
How we work with technology and telecom
One partner, gap to certificate
01
Consultancy
Gap assessment, implementation and integrated systems built around how technology and telecom operations really work.
02Certification support
Certification body selection, mock audits and Stage 1 and Stage 2 support.
03Training Academy
Awareness to CQI/IRCA Lead Auditor, in-house or public.
04Ongoing partnership
Outsourced internal audit, management review and 2026 transitions.
Experience
Technology & Telecom work we have delivered
Technology & consulting · Europe
Capgemini
ISO 50001 · 16 months · 9 countries
1stAttempt
0NCs
9Countries
The challenge
One energy management system across offices in nine European countries, each with different energy sources, metering and local practices.
What AEC did
Multi-country energy review, baselines and indicators, harmonised procedures, energy team training, multi-site internal audits and certification audit support.
Certified at first attempt, no nonconformities. One certificate covering sites in Paris, Utrecht, London, Rome, Warsaw, Berlin, Dublin, Machelen and Bertrange.
Selected clients in this sector: ASML, Capgemini, Atos, Ooredoo, Adyen. Names and trademarks belong to their owners and indicate client relationships only.
Training Academy
View the Training Academy
Training for technology and telecom teams
CQI/IRCA Approved Training Partner. Awareness, Implementer, Internal Auditor and Lead Auditor courses, in-house, public, virtual or hybrid.
Popular courses for this sector: ISO/IEC 27001, ISO/IEC 27701, ISO 22301.
Questions
Technology & Telecom FAQ
Does AEC issue the certificates?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body, or by the scheme-specific bodies some standards require. AEC prepares your organisation for those audits.
Can ISO/IEC 27001, 27701 and 42001 be one system?
Yes. All three use the harmonized structure, so they can share risk management, audits and management review.
Do we need ISO/IEC 27001 before ISO/IEC 27701?
Not for the 2025 edition, which is standalone. Integrating the two still saves effort if you hold or plan ISO/IEC 27001.
Plan your security, privacy and AI system
Tell us your services, data and customers' expectations. We reply with a proposal covering implementation and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.