FAQ
Security & compliance
Does Node XR hold ISO 27001?
It is worth being precise here, because alignment and certification are different things and procurement teams treat them differently.
Alignment is not certification
ISO 27001 certification means an accredited certification body has audited an organisation's information security management system against the standard. Aligning to ISO 27001 means following its practices without that external certificate. Node XR describes its ISO 27001 alignment as in progress.
What Node XR does hold
- Cyber Essentials Plus, certified annually
- NHS DSPT compliance
- GDPR compliance, with a 24-hour breach notification SLA
- UK hosting on AWS London, with AES-256 at rest and TLS 1.2 or higher in transit
If your tender requires ISO 27001
If certification is a hard requirement, say so early and confirm the current position with Node XR in writing before submission rather than relying on a web page. The assurance NHS teams ask about most often, such as DSPT, a DPIA and Cyber Essentials Plus, is covered in our NHS procurement guide.