We’re proud to announce that OpenLM has been recertified to ISO/IEC 27001:2022, upgrading from our previous ISO/IEC 27001:2013 certification. It’s the clearest way we can show, rather than just say, that we keep raising the bar on protecting the data of every organization that relies on our software license management platform.
This recertification follows a rigorous audit of our information security management system (ISMS) and reflects months of work across our team to align our security practices with the latest global benchmark for protecting sensitive information.
What is ISO/IEC 27001:2022?
ISO/IEC 27001 is the internationally recognized standard for establishing, implementing, maintaining, and continually improving an information security management system. The scope of this certificate for OpenLM includes ‘design, development, implementation, and operation of software license management solutions.’ It is valid till Feb 5, 2027.
The 2022 revision is the first major update to the standard since 2013, and it reorganizes and modernizes the framework to address the security landscape organizations actually operate in today.
Where the 2013 version organized its Annex A controls into 14 domains, ISO/IEC 27001:2022 consolidates them into 93 controls across four themes:
- Organizational controls (37)
- People controls (8)
- Physical controls (14)
- Technological controls (34)
The update also introduces 11 new controls covering areas like threat intelligence, cloud security, data masking, data leakage prevention, and secure coding — issues that simply weren’t front-of-mind for most security frameworks a decade ago.
Think of it like a building’s safety code. ISO 27001:2013 was the code written for the buildings of its era; ISO 27001:2022 is the updated code that accounts for the risks — cloud infrastructure, sophisticated threat actors, and distributed teams — that today’s “buildings” actually have to withstand. Recertifying means OpenLM’s ISMS was re-inspected against that newer, stricter blueprint, not simply renewed on paper.
Why this upgrade matters
Achieving ISO/IEC 27001:2022 certification, rather than simply renewing under the 2013 standard, matters for a few concrete reasons:
A more current risk framework. The added controls around threat intelligence and cloud security map directly to how modern software platforms — including SaaS-delivered license management tools — are actually deployed and attacked.
Continued, independent verification. Certification isn’t self-declared. It requires an external audit confirming that OpenLM’s security policies, risk assessments, and operational controls meet the standard’s requirements — and that they’re being followed in practice, not just documented.
A systematic approach to data protection. The ISMS at the core of ISO 27001:2022 requires OpenLM to continuously assess risk, monitor controls, and improve processes rather than treating security as a project with an end date.
What this means for OpenLM customers
For the IT, security, and procurement teams evaluating or already using OpenLM, ISO/IEC 27001:2022 certification is a concrete signal — not a marketing claim — that the platform managing your software license data meets a globally recognized bar for information security.
That matters especially for a platform like OpenLM, which sits close to sensitive operational data: license usage, access patterns, and — through capabilities like License Access Control and AI Proxy Monitoring — visibility into how software and AI tools are being used across your organization. OpenLM supports 100+ license managers across enterprise environments, which means the security of the platform itself has a direct bearing on the security posture of everything it connects to.
Backed by SOC 2 compliance, too
ISO/IEC 27001:2022 certification builds on OpenLM’s existing SOC 2 Type 2 compliance, which provides independent assurance around the security, availability, processing integrity, confidentiality, and privacy of our systems over time. Together, the two frameworks give customers overlapping, independently verified evidence of how OpenLM protects their data — from the design of our ISMS to the day-to-day operation of our controls.
You can read more about our SOC 2 report and broader security practices on our Security & Trust page.
A continued commitment to security
Certifications age. Threats don’t stand still, and neither do the standards built to address them — which is exactly why OpenLM chose to recertify against ISO/IEC 27001:2022 rather than simply let our 2013 certification lapse into renewal. It’s a continued investment in earning the trust of the organizations that depend on us to manage their software license data securely.
If you’re evaluating software asset management or license management vendors and security is part of that conversation, we’d welcome the chance to talk through OpenLM’s security practices in more detail — contact our team to learn more.
