As an OT security company, we have to meet our own standards. This page shows where we stand: certifications, security practices, compliance and how to report security issues to us. No marketing — only facts, updated when things change.
A transparent view of our certifications. For ongoing or planned certifications we indicate the expected completion date.
ISMS framework implementation underway. External audit planned: Q4 2026.
Certification planned following ISO 27001. Target: 2027.
We apply NIS2-compliant processes for risk management, incident reporting and supply chain security.
Records of processing, DPIAs, processor agreements and breach register are operational.
Active, certified implementation partner. Annual recertification.
The controls we apply to our own environment. This reflects what we also advise our clients.
Multi-factor authentication on all business systems. Just-in-time access to client environments. Periodic access reviews.
EDR on all workstations. Full-disk encryption. Centralised patch management with SLA for critical vulnerabilities.
Zero-trust network architecture. Encrypted connections for all remote access. Logging and monitoring of all business traffic.
Client data processed and stored exclusively within the EU. Logical and physical separation per client. Retention per contract and GDPR.
Hardware-backed key management. No shared credentials. No long-lived access keys.
Background screening for consultants. Mandatory quarterly security awareness training. Confidentiality agreements for all employees and subcontractors.
Limited list of vetted suppliers under processor agreements. No offshore subcontracting for client work.
Documented Business Continuity and Disaster Recovery plan. Tested annually.
We help clients with their compliance journeys for the frameworks below. These are not our own certifications — this is operational expertise we deliver.
Have you discovered a security issue on our website, our systems or a service we deliver? We value responsible disclosure and take every report seriously.
All ArmOTura-owned domains (armotura.com and subdomains). For vulnerabilities in Armis Centrix itself, please refer to the Armis vulnerability disclosure programme.
The documents below are available on request for enterprise clients and procurement teams (under NDA where applicable).
Request via security@armotura.com
Procurement, IT-security teams and compliance officers can reach us directly for in-depth discussions or documentation.