Certification catalogue

Requirements Peppol imposes on members, and the certifications that qualify for each · read-only — switch to the Administrator user to edit

ISO/IEC 27001 — Information security management

Active Code ISO27001 · version 4 · last changed 12 Jun 2026 by Pieter Hendriks

Applies toAll members

Default validity36 months or certificate expiry if earlier

Lead time before expiry90 days

Members10 applicable · 7 verified · 7 in progress

Expected documentation

Valid certificate issued by an accredited certification body, and the certificate's scope statement showing that the Peppol service is covered. For assurance reports: the full report (not the bridge letter alone) and the auditor's opinion.

Qualifying certifications

1 primary · 1 full equivalent · 2 conditional

Certification	Classification	Conditions for acceptance	Validity	In use	Status
ISO/IEC 27001 certificate Certification body accredited under ISO/IEC 17021	Primary	None — the requirement itself.	Up to 36 months	6 members	Active
National scheme based on ISO/IEC 27001 e.g. BSI IT-Grundschutz (DE); issuer must be a national accreditation body or its licensee	Full equivalent	None — accepted as equal to the primary.	Up to 36 months	1 member	Active
SOC 2 Type II report AICPA Trust Services Criteria — Security (common criteria) in scope	Conditional equivalent	Case handler must confirm: System description covers the Peppol access point / SMP service Report period ended less than 12 months before submission Auditor's opinion is unqualified, or exceptions are documented and accepted	Up to 12 months	0 members	Active
ISAE 3402 / ISAE 3000 Type II assurance report Information security controls in scope	Conditional equivalent	Case handler must confirm: Control objectives cover the Peppol service Report period ended less than 12 months before submission Opinion is unqualified	Up to 12 months	0 members	Active

Re-verification. Deactivating a qualifying certification does not invalidate existing verifications; they run to expiry. To re-check members verified against a certification now, use "Re-verify" on that row — it opens a new case for each of them and sends the request e-mail.