Certifications & Assurance

Certifications and controls supporting security and compliance

Certifications & Assurance

FMIS maintains a structured approach to information security, quality management, and operational control. This is supported by recognised certifications and ongoing internal and external review.

The certifications below provide assurance that FMIS applies defined processes for managing risk, protecting data, and maintaining service quality. These are supported by regular audits and continuous improvement through our Information Security Management System (ISMS).

Certifications

ISO 27001:2022

ISO 27001 defines how organisations manage information security through a formal management system.

At FMIS, this standard underpins how we:

Identify and manage security risks
Control access to systems and data
Monitor, review, and improve security controls

This includes policies covering areas such as access control, incident management, supplier management, and secure development.

What this means in practice

Security is managed as an ongoing process rather than a one-off activity. Controls are reviewed regularly, and risks are assessed and addressed through defined procedures.

View Certificate

ISO 9001:2015

ISO 9001 focuses on quality management and the consistent delivery of services.

At FMIS, this supports:

Structured processes across delivery and support
Consistency in how services are provided
Ongoing review and improvement of internal processes

What this means in practice

Processes are documented, monitored, and refined over time. This helps ensure that systems are delivered and supported in a consistent and controlled way.

View Certificate

Cyber Essentials Plus

Cyber Essentials Plus is a UK government-backed certification focused on core technical security controls. It includes independent testing of systems and controls.

At FMIS, this covers areas such as:

Secure configuration of systems
Protection against malware
Patch management
Access control

What this means in practice

Key security controls are tested externally to confirm they are in place and operating as expected.

View Cyber Essentials Certificate

View Cyber Essentials Plus Certificate

Ongoing Assurance

Certifications form part of a wider assurance framework.

FMIS maintains an Information Security Management System that includes:

Regular internal audits and management reviews
Defined policies and procedures covering security and data protection
Ongoing risk assessment and control monitoring
Staff training and awareness

These processes ensure that controls remain effective as systems and requirements evolve.

Independent validation

FMIS carries out regular independent testing to validate its security posture.

This includes annual infrastructure and application penetration testing (ITHC). Findings are reviewed, prioritised, and addressed through defined remediation processes.

What this means in practice

Security controls are tested from an external perspective, with any identified issues tracked and resolved as part of ongoing improvement.

Further information

If you require additional documentation or have specific security or compliance questions, please contact:

privacy@fmis.co.uk

Certifications & Assurance

Certifications & Assurance