About
A certification body built around one idea: the certificate has to mean something
Sanvada was founded in 2020 by auditors who had watched certification become a box-ticking exercise and thought it could be done better. We certify information security management systems to ISO/IEC 27001 and assess security controls against NIST SP 800-53 and NIST SP 800-171.
- Founded
- 2020
- Frameworks
- ISO 27001NIST SP 800-53NIST SP 800-171
Principles
Four things we will not compromise on
We audit. We do not advise.
We audit management systems and assess controls. We do not design them, write policies or system security plans, or run internal audits. That work belongs to your consultancy or your own team, and our auditors form their own view of it.
The auditor never decides.
Every certification decision is made by a reviewer who was not on the audit team, from the full audit file. It is slower than signing off at the closing meeting, and it is the right way to do it.
Findings are explained, not just recorded.
A finding names the clause or control, the evidence examined, and why it matters. If a client cannot explain a finding to their board without calling us, we have not written it well enough.
Everything we issue can be checked.
Anyone can ask us to confirm the scope, status, and expiry date of a certificate we issued, and we answer within one business day. Suspensions and withdrawals are disclosed too. A body that only confirms good news is not worth trusting.
Auditors
Practitioners first, auditors second
Our auditors have run security programs, built platforms, and handled incidents. That is why they ask the right questions and why their findings are worth acting on.
- Lead auditor qualification for ISO/IEC 27001 with logged audit days
- NIST SP 800-53 assessments led by assessors experienced in the Risk Management Framework
- Five or more years in hands-on security, engineering, or IT operations roles before auditing
- Sector allocation: cloud and software, financial services, health, public sector, professional services
- Technical review of every audit file by a reviewer who was not on the audit team, before the decision
- Continuing professional development, including on ISO 27002:2022 and cloud platforms
Governance
How we are held accountable
ISO/IEC 17021-1 sets the requirements for bodies that audit and certify management systems: impartiality, competence, responsibility, openness, confidentiality, and responsiveness to complaints. ISO/IEC 27006-1 adds requirements specific to certifying information security management systems, including auditor competence and audit time.
Any client can appeal a certification decision or complain about our service. Both are handled by people independent of the original work.
Ready to scope your audit?
Tell us about your organization, your ISMS scope, and your target date. We reply with a fixed-fee quote and available audit dates within two business days.