Fidem Certifications and Accreditations: ISO 27001, 27017, 27018, 9001 and CSA STAR
Fidem is an Italian cybersecurity company certified ISO/IEC 27001, 27017, 27018 and ISO 9001. The Defensio ecosystem is listed in the CSA STAR Registry (Level 1) of the Cloud Security Alliance.
On this page you will find what each standard attests and what it means, in practice, for anyone who entrusts us with their data.
ISO/IEC 27001: Information Security Management
ISO/IEC 27001 is the international standard for information security management systems (ISMS). The certification attests that the organization identifies risks, applies proportionate controls and has them verified periodically by an independent body.
For a security services provider it is the baseline credential: it means that the same disciplines we propose to our clients, such as risk management, access control, incident management and continuity, are applied to ourselves first.
ISO/IEC 27017 and 27018: Security and Privacy in the Cloud
ISO/IEC 27017 extends 27001 with controls specific to cloud services: shared responsibilities between provider and customer, segregation of environments, hardening of virtual machines.
ISO/IEC 27018 covers the protection of personal data in the cloud: transparency on where and how data is processed, no use for other purposes, support for the controller’s obligations.
Together they answer the question every company should ask its cloud provider: who processes my data, where, and with which verified guarantees? Our clients’ data stays on Italian infrastructure.
ISO 9001: Process Quality
ISO 9001 attests a quality management system: documented processes, defined roles, measured continuous improvement. In a sector where much is sold on words alone, 9001 certifies the method by which the work is delivered, from taking charge of an incident to delivering a forensic report.
CSA STAR Registry: Transparency on the Defensio Cloud
The Defensio® SaaS ecosystem is published in the Cloud Security Alliance CSA STAR Registry at Level 1: a CAIQ v4.0.3 self-assessment that is public and open to anyone, documenting how the platform implements the controls of the Cloud Controls Matrix.
It is a transparency tool: before signing, a client can read exactly how we manage encryption, access, logs and continuity. The registry entries: Fidem Srl · Defensio SaaS.
What They Mean for Your Company
In customer questionnaires. If a customer asks you for guarantees on your supply chain, the certifications of your security provider are part of the answer.
In tenders and public calls. Requirements such as the supplier’s ISO 27001 are increasingly used as admission or scoring criteria.
With insurers. Cyber insurance policies ask for documented technical measures: working with a certified provider makes the documentation stronger.
On the NIS2 and GDPR compliance path. ISO standards are the natural reference to demonstrate that the measures adopted are adequate.
Frequently Asked Questions about Certifications and Accreditations
Which certifications does Fidem hold?
Fidem is certified ISO/IEC 27001 (information security), ISO/IEC 27017 (cloud services security), ISO/IEC 27018 (protection of personal data in the cloud) and ISO 9001 (quality management). The Defensio SaaS ecosystem is also published in the CSA STAR Registry at Level 1.
What is the CSA STAR Registry and what does Level 1 mean?
The CSA STAR Registry is the Cloud Security Alliance’s public registry on the security of cloud services. Level 1 is a public CAIQ self-assessment, open to anyone, that documents how the service implements the controls of the Cloud Controls Matrix. It is not a third-party certification: it is a transparency tool anyone can verify.
Do the ISO certifications also cover Defensio’s cloud services?
Yes. The ISO/IEC 27017 and 27018 extensions specifically cover the security of cloud services and the protection of personal data in the cloud. Client data stays on Italian infrastructure.
Why do a provider’s certifications matter for my company?
Because they are verified by third parties and come up whenever you have to prove something: customer security questionnaires, tenders and public calls, cyber insurance policies, NIS2 and GDPR compliance. The provider’s certification becomes part of your own documentation.
Need the Documentation for an Audit or a Tender?
If you need evidence of our certifications for a supplier questionnaire, a tender or an insurance policy, contact us and we will send you the documentation.
Services delivered to these standards
vulnerability assessment · managed SOC · digital forensics and expert reports · DPO as a service · NIS2 compliance