#ISO/IEC 27001:2022 Readiness Statement

STM-GL-011 v1.0.0, Last Modified On 31 July 2026, Tier: Public

Edsol Edtech Pvt. Ltd. is not certified to ISO/IEC 27001 and has not begun a certification audit. This statement exists so that the gap is a schedule, not a mystery.

---

#Purpose

A hospital's reviewer asks two questions about a missing certificate: do you intend to get it, and when. This document answers both with a date, a named owner and a milestone list against which Pensieve Labs can be held to account in public.

The date below can be missed. If it is, this document is re-dated with a reason rather than quietly deleted. That is the point of publishing it.

---

#1. Current position

---

#2. Intended scope of certification

The scope that will be submitted to the certification body is the ISMS scope already published in STM-GL-010 Section 1: the design, development, deployment, hosting, operation and support of Pensieve delivered from Google Cloud Platform across deployment models DM-1 to DM-4, together with the corporate systems supporting it.

Two scope decisions worth stating in advance, because both are places vendors quietly narrow a certificate:

1. All four deployment models are in scope. A certificate that covers only the vendor's own hosted platform, while the hospital buys on-premise, certifies something the hospital is not buying.
2. The corporate office is in scope. It holds no hospital data at rest, but it holds the identities, the source code and the endpoints that reach production, so excluding it would be a scope gerrymander.

Pensieve Labs intends to add ISO/IEC 27017:2015 (cloud security controls) and ISO/IEC 27018:2019 (PII processing in public clouds) as extensions within the same certificate scope and the same Stage 2 audit. 27018 is the only ISO credential that certifies the processor role, which is Edsol Edtech Pvt. Ltd.'s role in all four deployment models. It is therefore the one most directly relevant to a DPA, and the marginal cost of bundling it is small.

---

#3. Milestones

Milestones 7 and 8 are the ones that cannot be compressed. A certification body will not proceed to Stage 2 without evidence of at least one complete plan-do-check-act cycle: an internal audit and a management review. A vendor promising a certificate in six weeks either has those already or is describing a certificate from a body that will not survive scrutiny.

---

#4. The impartiality constraint on who performs the gap assessment

An accredited certification body cannot certify a client to whom another part of its own group has provided consultancy for the same management system. Consequently Pensieve Labs will either buy the gap assessment (milestone 5) from a body it does not intend to certify with, or buy it from the intended body only as a non-consultative pre-assessment which that body confirms in writing will not bar it from certifying.

Getting this wrong costs a certification-body switch and roughly thirty days. It is recorded here so that the decision is made deliberately rather than discovered.

---

#5. What a hospital should do with this in the meantime

1. Do not wait for the certificate. Read STM-GL-010: it is the document the auditor will read first, and you can read it today.
2. Test the gaps that matter to you. The nineteen open items are listed in STM-GL-010 Section 9 with compensating controls. Decide which of them, if any, would change your decision.
3. Put the date in the contract if it matters. Pensieve Labs is content for Roadmap iso27001 target to appear as a covenant on the Order Form, with an agreed consequence if it slips. A published date a vendor will not contract to is not a date.
4. Ask every other vendor for the edition year on their certificate. Certificates against the 2013 edition were withdrawn at the close of the IAF transition period. A 2013-edition certificate presented in 31 July 2026 is not a live certificate.

---

#6. How this statement is kept honest

The change history below is the accountability mechanism. A reader can see every date this document has ever carried.

---

#7. Declaration

---

#8. Change history