ESG questionnaires sent to portfolio companies and suppliers<\/li>\n<\/ul>\n\n\n\nMuch of this ends up in regulated disclosures. Companies in CSRD scope must have their sustainability statements checked by an assurance provider (limited assurance). Principal adverse impact data currently feeds SFDR disclosures. If this data were leaked, altered or lost, our clients would face regulatory and reputational risk as well as a technical problem.<\/p>\n\n\n\n
Why it matters for our financial sector clients<\/h2>\n\n\n\n
Many of our clients are asset managers, funds and other financial institutions in the EU. Since 17 January 2025, the Digital Operational Resilience Act (DORA) has asked them to look closely at their software providers.<\/p>\n\n\n\n
Under Article 28(5), financial entities may only contract ICT third-party service providers that comply with appropriate information security standards. For critical or important functions, they must also consider whether the provider uses the most up-to-date and highest quality standards.<\/p>\n\n\n\n
DORA does not name a specific standard. In its Q&A DORA188-3200, EIOPA confirmed that the text refers to industry best practice. ISO\/IEC 27001 is one of the most widely recognised ways for a provider to show it meets that expectation.<\/p>\n\n\n\n
Our certificate does not replace a client’s own assessment. It makes that assessment faster and gives it independent evidence.<\/p>\n\n\n\n
How we look after your data<\/h2>\n\n\n\n
We have held ISO\/IEC 27001 certification since December 2024 and have passed two surveillance audits since, in September 2025 and October 2026.<\/p>\n\n\n\n
In practice, this is how we work:<\/p>\n\n\n\n
\n- Daily security testing.<\/strong> Automated scans and tests run every day, and we have kept the results since October 2024.<\/li>\n\n\n\n
- Clear ownership.<\/strong> We keep a register of risks, assets and access rights, and review who can access what.<\/li>\n\n\n\n
- Independent checks.<\/strong> An independent auditor from outside GIG carries out our internal audit each year, followed by a management review.<\/li>\n\n\n\n
- Findings closed properly.<\/strong> Every finding goes through a formal corrective action process with an owner and a deadline.<\/li>\n\n\n\n
- Cloud only.<\/strong> We are a fully remote team with no on-premise infrastructure, which keeps our environment simpler to control.<\/li>\n<\/ul>\n\n\n\n
What this means for you<\/h2>\n\n\n\n\n- Financial institutions:<\/strong> use our certificate in your ICT third-party due diligence and to support your register of information entries.<\/li>\n\n\n\n
- Companies and SMEs:<\/strong> share it with your auditors, investors and procurement teams as part of your own supply chain checks.<\/li>\n\n\n\n
- Security questionnaires:<\/strong> our team will help you complete them. Just ask us.<\/li>\n<\/ul>\n\n\n\n
Frequently asked questions<\/h2>\n\n\n\r\n\t\t\r\n\t\t\t\r\n\r\n\t\t\t\n\r\n\t\t
\r\n\t\t\t\r\n\t\t\t\n\n
Is GIG ISO 27001 certified?<\/h3><\/summary>\n
Yes. Generation Impact Global holds ISO\/IEC 27001:2022 certification (no. 0199990), issued by Intertek and valid until 4 December 2027. We have been certified since December 2024.<\/p>\n<\/details>\n\n\n\nDoes DORA require ISO 27001?<\/h3><\/summary>\n
No. DORA asks financial entities to use ICT providers that follow appropriate information security standards, without naming one. ISO\/IEC 27001 is one of the most widely accepted ways to show this.<\/p>\n<\/details>\n\n\n\nWhat does GIG’s certificate cover?<\/h3><\/summary>\n
The scope is our support and solution for data management and ESG reporting. This is the platform our clients use to collect, manage and report their ESG data.<\/p>\n<\/details>\n\n \r\n\t\t\t\r\n\t\t<\/div>\r\n\t\n \r\n\t\t<\/div>\r\n\t\n\n\n
![\"Intertek](\"https:\/\/generationimpact.global\/wp-content\/uploads\/GENERATION-IMPACT-GLOBAL-SA-ISO-27001.jpg?wsr\")