Certifications

Active certifications

Standard	Status	Scope	Cadence
ISO 27001	Certified	Information security management system (ISMS) covering all ThreatAware engineering and operations	Annual surveillance audit; triennial recertification
Cyber Essentials	Certified (UK)	UK Government cyber baseline	Annual
GDPR	Compliant	Data protection by design across all ThreatAware data flows	Continuous

Audit reports and Statements of Applicability are available under NDA — contact your account manager.

How ThreatAware helps your compliance

ThreatAware’s job is to demonstrate your security controls work, which directly supports your own compliance posture:

ISO 27001 (yours)
NIST CSF
Cyber Essentials (UK)
CIS Controls
PCI DSS

Control	How ThreatAware helps
A.5.9 — Inventory of assets	Continuous, accurate device inventory
A.5.10 — Acceptable use	Tag-based controls; device classification
A.5.16 — Identity management	User Inventory + access reviews
A.5.17 — Authentication info	Multi-Factor Authentication (MFA) tracking via Entra/Okta integration
A.5.23 — Cloud services	Cloud integrations + monitoring
A.5.25 — Threat intelligence	Issues feed + Endpoint Detection and Response (EDR) data
A.8.1 — User endpoints	Device inventory + Vitals
A.8.7 — Malware protection	EDR Vitals + Issues
A.8.8 — Technical vulnerabilities	Vulnerability scanner integration
A.8.16 — Monitoring activities	Audit log + automation log

Function	How ThreatAware helps
Identify	Asset and software inventory across estate
Protect	Vitals validate controls are deployed + functioning
Detect	Issues + broken-agent detection via cross-tool correlation
Respond	Action Center automated remediation
Recover	Audit log + historical state

Requirement	How ThreatAware helps
Firewalls	Firewall state Vital (where exposed by EDR/MDM)
Secure configuration	Configuration check Vitals
User access control (MFA)	MFA enrolment tracking
Malware protection	EDR coverage + functioning checks
Patch management	Patch SLA tracking + Actions

Control	How ThreatAware helps
1 — Inventory of devices	Cross-tool deduplicated inventory
2 — Inventory of software	Software inventory per tag
3 — Data protection	Encryption Vitals
4 — Secure configuration	Config-check Vitals
5 — Account management	User Inventory + offboarding tracking
6 — Access control	Authentication + MFA Vitals
8 — Audit log management	Native audit log + SIEM integration
10 — Malware defenses	EDR Vitals + Issues
18 — Penetration testing	Vulnerability scanner integration

Requirement	How ThreatAware helps
5 — Anti-malware	EDR coverage + functioning
6 — Vulnerability management	Vulnerability scanner integration
7 — Access control	User Inventory + roles
8 — Identification + authentication	MFA tracking
10 — Logging	Audit log
11 — Security testing	Vulnerability scanner integration

What ThreatAware doesn’t certify

ThreatAware’s certifications cover the ThreatAware platform itself. They don’t:

Replace your own ISO 27001 certification — ThreatAware supports it, doesn’t substitute for it
Cover your endpoint devices — that’s the job of your EDR / MDM
Cover data processed in tools ThreatAware connects to — those tools have their own compliance

Use ThreatAware as evidence in your own audits, not as the certification itself.

Audit support

For your own audits / external assessments:

Need	How
Auditor read-only access	Create a custom role with view-only permissions; create a user with an expiration date
Evidence pack	Export Audit Log for the audit period; export saved-view evidence as CSV/PDF
Control narrative	Use the canonical mapping tables above as a starting template
DPA	Standard data-processing agreement available; contact your account manager
Penetration test summary	Annual independent test report; executive summary on request

Data residency

Default: UK (London region)
Other regions: Available on request; lead time varies

If your regulatory environment requires data in a specific jurisdiction, raise the requirement with your account manager during procurement.

Contact

Topic	Channel
Audit reports / SOA	support@threataware.com → DPA team
Subprocessor disclosures	support@threataware.com
Security questionnaires	Your account manager
Security disclosures	security@threataware.com

Security & Privacy

Top-level posture

Architecture

Technical deep dive

Audit Log

Evidence source

Get started

Inventory

Tags, Logic & Coverage

Vitals & Issues

Action Center

Integrations

Reporting

Access & Admin

Reference

Trust & Security

Active certifications

How ThreatAware helps your compliance

What ThreatAware doesn’t certify

Audit support

Data residency

Contact

See also

Security & Privacy

Architecture

Audit Log

​Active certifications

​How ThreatAware helps your compliance

​What ThreatAware doesn’t certify

​Audit support

​Data residency

​Contact

​See also

Security & Privacy

Architecture

Audit Log

Active certifications

How ThreatAware helps your compliance

What ThreatAware doesn’t certify

Audit support

Data residency

Contact

See also