I'm currently navigating a vendor assessment process, and one of the compliance requirements is for any security tools we recommend to have certifications recognized by our auditors. It's a bit annoying, but hey, that's compliance for you. Specifically, I'm searching for VPN providers that have ISO 27001 certification since that keeps popping up in our compliance framework. Bonus points if they also have SOC 2 or other third-party security audits we can reference in our documentation.
I know the big enterprise solutions cover this, but we're looking for options suitable for a smaller deployment, as those enterprise solutions often feel excessive and way overpriced for our needs. I've considered consumer VPNs with business tiers, but finding actual certification documentation is a challenge since many of them market towards individuals and tend to hide the compliance details if they exist at all. Has anyone dealt with this before?
5 Answers
We managed to satisfy our auditors by just documenting our own security controls around VPN use instead of focusing on provider certifications, but your mileage may vary depending on your compliance framework.
You might want to look into NordLayer, which is NordVPN’s business-oriented offering. Here's a link to their security compliance info: https://help.nordlayer.com/docs/security-compliance.
Most consumer-focused VPNs don’t bother with these certifications because their target audience usually doesn’t ask for them. You might want to check out business-specific options that really take compliance seriously.
How many remote workers do you have? Do you really need a VPN? There are also remote support tools like Screenconnect and AnyDesk. Have you considered Tailscale as a solution?
I believe PureVPN has ISO 27001 certification along with KPMG audit reports. It could be worth checking their business documentation since they offer team plans that might fit smaller setups.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures