Compliance Overview
Many regulations and standards require strong cryptography, protected keys and clear control over certificates. PKI-as-a-Service provides controls and evidence that help the customer meet these requirements. The customer remains responsible for its own compliance; PKI-as-a-Service supports it, it does not certify it.
PKI-as-a-Service helps organisations meet the following industry standards and regulatory requirements:
- NIST: NIST SP 800-57, NIST SP 800-53 Rev. 5 and NIST Cybersecurity Framework 2.0
- FIPS 140-3: CA keys in Level 3 HSMs
- PQC Standards: NIST post-quantum standards FIPS 203, 204 and 205
- CNSA 2.0: quantum-resistant algorithms for National Security Systems
- SPDM and DICE: hardware-rooted device identity
- ISO/IEC 27001: ISO/IEC 27001:2022
- PCI DSS: PCI DSS v4.0
- HIPAA: HIPAA Security Rule
- SOC 2: Trust Services Criteria
- GDPR: Article 32 security of processing
The requirement-by-requirement view is in Framework Mapping.
Encryption Consulting certifications and attestations
The list below covers EC as the operator of the service, separate from the customer's own compliance.
| Standard | Status | Evidence available |
|---|---|---|
| ISO/IEC 27001:2022 (EC) | Certified | Available on the Encryption Consulting website |
| SOC 2 Type II (EC) | Attested | Available on the Encryption Consulting website |
| HSM validation | FIPS 140-3 Level 3 | HSM model and NIST CMVP certificate number available on request |
| Microsoft Azure (hosting) | Microsoft maintains ISO/IEC 27001, SOC 1/2/3 and other attestations for Azure | Microsoft Service Trust Portal |