About Inmarsat
- What it is: a British satellite telecommunications company, founded in 1979 and headquartered in London, providing mobile satellite voice and data services worldwide: to shipping, airlines, governments and aid agencies, including the Global Maritime Distress and Safety System it provides as a public service.
- Scale: a fleet of geostationary communications satellites and around 1,500 staff at the time of its 2019 change of ownership.
- Listing: Inmarsat was listed on the London Stock Exchange until December 2019, when it was taken private by a consortium of Apax Partners, Warburg Pincus, the Canada Pension Plan Investment Board and Ontario Teachers’. In May 2023 it was acquired by Viasat, which is listed on the NASDAQ; London remains the combined group’s international headquarters.
Company facts from Inmarsat, Viasat and published acquisition announcements, checked November 2026.
Where did Inmarsat start?
A satellite operator of Inmarsat’s scale does not have an information security problem in one place. It has people, systems and responsibilities spread across countries, time zones and ways of working, all of which have to amount to the same standard of care.
My starting point on any implementation is the same: to remove any mystique or confusion surrounding what ISO 27001 actually requires, and to understand what the organisation is genuinely trying to protect. In this case that meant understanding the business across three regions before writing a single policy.
What did I do at Inmarsat?
In brief, I led the implementation of the management system end to end:
- Agreed a certification scope that reflected how the organisation actually operated across the three regions.
- Built the risk assessment with the people who owned the risks locally, so the register described real operations in each country.
- Produced the Statement of Applicability and the policy set once, centrally, then made sure they could be evidenced locally: the same requirement, met in ways that fitted each site.
- Put the operating rhythm in place: internal audit, management review, and the routine checks that keep a system honest between external audits.
- Prepared the organisation for independent assessment and supported it through certification.
What was the difficult part?
The standard is the same in every country, while people, working practices and the distance between a policy written in one office and a control operated in another all vary. The difficult part of a multi-region implementation is rarely technical.
The real work is keeping one system coherent (one set of decisions, owned by named people in each location) while allowing each region to work in the way it works.
That is why I work the way I do: I have built my business on mutual trust and understanding, and on implementations the organisation can keep running after I have stepped back. A management system should outlast the consultant, so I build for the day I leave.
What was the outcome at Inmarsat?
Inmarsat achieved independent ISO 27001 certification for the agreed scope, with the management system operating across England, Holland and North America. I remained involved for the full engagement, through the surveillance years and subsequently to re-certification.
That continuity matters, because a system proves itself over repeated audits. Certification was, as it always is, the decision of the independent certification body; my role was to make sure the organisation met that assessment prepared, and could retain the certificate afterwards.
Is your situation similar?
If you operate across more than one country, or your customers are asking questions your current arrangements cannot answer consistently, the route is the same as it was here: understand first, scope honestly, and build something your own people can run. I have set out how I approach this sector on my satellite, telecoms and technology page, and what an implementation involves on the implementation service page.
I am always happy to answer questions, so feel free to drop me an email, anytime.