We're trying to replace a web hosting provider, but compliance requires ISO certification for the developer, hosting infrastructure and managed server service. The certified options we've found are outside our budget or would put the server overseas.
The site is informational, and newsletter signups are handled by a third party. How would you get these requirements clarified without letting the upgrade stall indefinitely?
Start by asking exactly which ISO standard they mean and what certification scope they expect at each layer. ISO 27001 certification covers an organization's information security management system, not an individual developer. A provider's certificate also needs to cover the relevant service, so a certified data center doesn't automatically make the managed server service certified.
Have compliance identify who needs to provide evidence: the infrastructure host, the company managing the server, and the development firm. That gives you something concrete to check rather than searching for a vaguely certified developer.
This sounds like a budget decision as much as a technical one. Put the available options and their costs in front of whoever owns the policy, including the overseas hosting option, and ask them to fund an acceptable choice or approve an exception.
Give them a clear decision to make. If the requirement covers every supplier, infrastructure certification alone won't solve the managed hosting and development pieces.
Ask compliance what risk they're trying to address and whether the same requirements apply to an informational site as to services handling sensitive data. Even if the newsletter signup goes to a third party, spell out how that integration works so they can assess it rather than assume there's no data involved.
They may still require certification, but a documented review could establish whether any narrower scope or exception is allowed.
Don't rule out a major cloud provider just because the server itself is covered. If you need someone else to manage it, check that company's certification and scope separately. Then compare the total managed cost with the budget, not just the infrastructure price.
t62+bracket_94:
And if the affordable option means hosting in another country, get compliance to confirm that location is acceptable too.
Answers are reviewed before publication.
f2!bracket.913:
Small development shops may still be companies, but finding one with the required certification at a low price could be difficult.