# ISO 27001, ISO 27017 and ISO 27018 Maintained

> DFNS passes its first ISO/IEC 27001, 27017 and 27018 surveillance audit with a positive recommendation from MSECB on all three standards and the certifications are maintained.

- Author: Elis Veysalova (Trust & Compliance Officer)
- Published: 2026-10-19
- Category: Security
- Canonical: https://dfns.co/article/iso-27001-27017-27018-maintained/
- All DFNS articles: https://dfns.co/llms-full.txt

---

A year ago we shared that DFNS had earned ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certification. We said then that it was a milestone, not an endpoint, because ISO certification is a cycle rather than a plaque: a three-year term with an independent audit every year, and recertification at the end. The first of those annual audits took place in August. Today we can share the result. The certifications are maintained, with a positive recommendation from the auditors on all three standards.

## What a surveillance audit checks

A certification audit asks whether a management system exists and works. A surveillance audit asks a harder question a year later: is it still working, is it being measured and improved, and has it kept up with the organization around it? Over four days in early August, an audit team from MSECB, the accredited certification body that certifies DFNS, examined the information security management system behind the core banking platform for digital assets: Wallet-as-a-Service, Transaction Management, Treasury Management, the Tokenization Engine, Workflows, the Policy Engine, the Governance Engine, Node and Key Management, with all associated services and integrations, across SaaS and on-premises deployments, every employee in scope, and no clauses or controls excluded.

The method is process-based and sample-driven: interviews with the people who run the controls, observation of activities, and review of the documents and records that prove the controls operated. The evidence examined ranged from the weekly security meeting and the board's review of risks and opportunities, to the disaster recovery test and the plan updates that followed it, to backup restoration tests, incident handling records, and the tracking of security training completion. The auditors found the management system designed to achieve our policy objectives, structured to meet statutory, regulatory and contractual requirements, and with internal audit and management review processes established and adequate. No significant changes affected the system since the last audit, and no unresolved issues remain from it.

## A year of raising the bar

Since the first certification, the security program has kept moving. Our SOC 2 Type II examination completed for the period ending September 2025 with an unqualified opinion and no exceptions, and the next period is underway.

We shipped Transfer Screening against address poisoning, SIEM Export so clients' security teams can watch DFNS activity in their own tooling, and the Validation Gate for HSM-based deployments. We published a 42,000-word handbook on multi-party computation and a control analysis of the Bitget hack that names the limits any provider carries. Each of those is a control, a measurement, or a correction, which is what a management system is supposed to produce.

Two more are already in motion. ISO/IEC 22301, the international standard for business continuity management, will make our continuity and recovery capabilities, the disaster recovery tests and plan updates the auditors examined this year, independently certified in their own right, which is why the internal audit program now covers the business continuity management system alongside the ISMS. And SOC 1, the report on controls relevant to our clients' financial reporting, will give the institutions whose own auditors rely on DFNS for the integrity of balances and transactions the assurance those auditors ask for. ISO 27001 says our security is managed. ISO 22301 will say our operations survive disruption. SOC 1 will say our numbers can be trusted in someone else's books.

## What it means for clients

For a bank or payment company assessing DFNS, this year's result is evidence of continuity. The scope held, the controls operated, the system was examined by an accredited third party against three international standards, and the one gap found was acknowledged and closed. ISO/IEC 27017 and 27018 continue to make our cloud shared-responsibility model and personal data protections auditable, alongside SOC 2 Type I and II.

The MSECB audit report is available to clients under NDA, and as last year, we are glad to walk your security and compliance teams through how the clauses map to the controls you care about most.

## Get started

* Learn more about onchain core banking: [dfns.co](https://dfns.co/)
* Explore the platform and documentation: [docs.dfns.co](https://docs.dfns.co/)
* Request our audit reports: [sales@dfns.co](mailto:sales@dfns.co)