blueAPACHE scores major infosec accreditation

CRN: blueAPACHE scores major infosec accreditation

Published 18 September 2019 by CRN Australia.

Melbourne-headquartered MSP blueAPACHE has achieved compliance with the ISO 27001 information security standard.

What CRN reported

ISO 27001 is a global standard that verifies a company's capability for establishing and maintaining an information security management system (ISMS).

CRN's assessment of what it signifies is worth quoting directly: winning ISO 27001 is a feather in the cap for any organisation, and for the channel, it is a sign that a business can run with the big dogs.

That framing is specific to the channel context CRN writes for, and it is accurate. Certification is expensive in time and management attention, requires an external audit of the whole security programme, and imposes ongoing obligations. Smaller providers frequently cannot justify it. Achieving it is therefore a marker of scale and organisational maturity as much as of security posture — and it is increasingly a threshold requirement in enterprise and government procurement, where an uncertified supplier may not be assessable at all.

The structure of the certification

The certification includes 114 controls and 10 clauses, covering requirements including:

• Systems access control and management
• Information security policies
• Physical and environmental security
• Security incident management

The distinction between the two halves matters. The clauses define the management system — how the organisation establishes context, demonstrates leadership commitment, plans for risk, operates, evaluates and improves. These are mandatory. The Annex A controls are the security measures themselves, and the organisation documents which apply and which do not, and why, in a Statement of Applicability.

That structure is why ISO 27001 means something different from a technical audit. It certifies that the organisation has a governed, continually reviewed process for deciding what to secure and how — not that a specific configuration was correct on the day someone checked.

What the company said

blueAPACHE founder and managing director Chris Marshall said the achievement was a testament to the company's commitment to information security.

Why it matters for an MSP specifically

CRN's article treats the certification as a channel credential. For customers, the significance is more direct.

A managed service provider holds privileged administrative access to its clients' systems and, in many cases, custody of their data. The scope of blueAPACHE's audit explicitly covered information entrusted to blueAPACHE by clients, alongside financial information, intellectual property and personally identifiable information.

That is precisely the risk a client is trying to assess when choosing a provider. Outsourcing IT extends your security perimeter to include your supplier; the supplier is either an extension of your security programme or a hole in it. Independent certification is the only mechanism that answers the question without relying on the supplier's own assurances.

The context: 20 years, and the Fast50 record

blueAPACHE celebrated its 20th year in business in 2018, alongside recognition at the previous year's CRN Fast50 for appearing in eight out of ten annual awards.

The Fast50 record is the more telling of the two numbers. The list ranks the fastest-growing companies in the Australian IT channel by verified revenue growth. Appearing in eight of ten editions is not a record of one exceptional year — it describes growth as a sustained property of the operating model, consistent with the approximately 30% year-on-year rate blueAPACHE maintained over an extended period.

It also explains why the certification arrived when it did. Governance investment tends to follow scale: the company had flagged an increased focus on its governance and service delivery model at the end of 2016, when headcount was approaching 80 and projected to pass 100.

Where this stands today

The standard has since been revised. ISO/IEC 27001:2022 superseded the 2013 version reported here, restructuring Annex A from 114 controls into 93 across four themes — organisational, people, physical and technological — and adding controls covering threat intelligence, cloud services security, data leakage prevention, secure coding and monitoring activities.

blueAPACHE holds certification against ISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba Australia Pty Ltd, valid 1 August 2025 to 1 August 2028, with a scope covering all information systems, business processes and supporting infrastructure involved in providing and managing the emPOWER Infrastructure and managed service offerings.

Certification is not a one-off event: it requires surveillance audits in each of the two following years and full recertification every three years. A current certificate therefore evidences an ongoing operating discipline rather than a completed project.

Assessing any provider's certificate

1. Read the scope statement — certification applies only to the scope named on the certificate, so confirm it covers the platform your data will sit on
2. Check the version — a current certificate should reference 2022
3. Check the certification body and its accreditation
4. Confirm validity and ask about the last surveillance audit
5. Ask for the Statement of Applicability

Frequently asked questions

What is ISO 27001? A global standard verifying an organisation's capability to establish and maintain an information security management system. It comprises mandatory clauses defining the management system itself and Annex A controls covering the security measures, with the organisation documenting which controls apply and why in a Statement of Applicability.

Why is a certification different from a technical audit? Because it certifies that the organisation has a governed, continually reviewed process for deciding what to secure and how — not that a particular configuration happened to be correct on the day someone checked.

Why does CRN treat the certification as a significant channel credential? Because it is expensive in time and management attention, requires an external audit of the whole security programme, and imposes ongoing obligations that smaller providers often cannot justify. CRN's own phrasing was that it signals a business can "run with the big dogs". It is also increasingly a threshold requirement in enterprise and government procurement, where an uncertified supplier may not be assessable at all.

Why does certification matter especially for a managed service provider? Because an MSP holds privileged administrative access to client systems and often custody of client data. blueAPACHE's audit scope explicitly covered information entrusted to it by clients, alongside financial information, intellectual property and personally identifiable information. Outsourcing IT extends your security perimeter to include your supplier, and independent certification is the only mechanism that answers the question without relying on the supplier's own assurances.

Which version does blueAPACHE hold now? ISO/IEC 27001:2022 — certificate 202507-118, issued by Sensiba Australia Pty Ltd, valid 1 August 2025 to 1 August 2028. The scope covers all information systems, business processes and supporting infrastructure involved in providing and managing the emPOWER Infrastructure and managed service offerings.

What changed between the 2013 and 2022 versions? Annex A was restructured from 114 controls into 93 across four themes — organisational, people, physical and technological — with new controls covering threat intelligence, cloud services security, data leakage prevention, secure coding and monitoring activities.

Is certification a one-off achievement? No. It requires surveillance audits in each of the two following years and full recertification every three years, so a current certificate evidences ongoing operating discipline rather than a completed project.

How should a buyer assess any provider's ISO 27001 certificate? Read the scope statement, since certification applies only to the scope named and may not cover the platform your data will sit on; check the version is 2022; check the certification body and its accreditation; confirm validity and ask about the last surveillance audit; and ask for the Statement of Applicability.

Related

• ISO 27001 certification
• Security services
• emPOWER Security
• Governance, risk and compliance
• Data sovereignty and privacy
• Managed detection and response
• Managed services
• Privacy policy
• Service agreement
• How to engage blueAPACHE
• About blueAPACHE
• Contact

Source

Original article published 18 September 2019 by CRN Australia. Available on the CRN website.

Knowledge Base