Why do satellite and telecoms operators certify?
- Customer assurance: enterprise, government and wholesale customers audit their connectivity and space-services suppliers hard; a certificate with the right scope answers most of it once.
- Regulatory structure: telecoms security duties, and the expectations of sophisticated space-sector customers, both demand demonstrable risk management, and the ISMS is the framework that holds it.
- Supply-chain position: primes and larger operators flow security requirements down their chains; certification is increasingly the entry ticket.
- Operational discipline: change, access and incident control across network and ground systems benefit from being run as one system.
What is different about ISO 27001 in this sector?
The scope decision dominates everything. Corporate IT, network operations, ground segment, customer platforms: each candidate sits somewhere relative to the boundary.
What sits inside that boundary determines audit cost, evidence burden and whether the certificate persuades the customers it was bought for. I settle this first, in writing, against your customer contracts; my implementation guide shows how scoping works.
Engineering evidence replaces paperwork. Auditors in this sector test change records, privileged access to operational systems, network segregation, logging and monitoring, and vulnerability management (Annex A 8.8, 8.15, 8.16, 8.20 to 8.22). If your NOC and engineering tools already produce that evidence, the ISMS should consume it directly.
Availability is a security property here. Continuity and ICT readiness controls (5.29, 5.30) and tested backup (8.13) carry unusual weight when customers buy uptime, so expect auditors to probe failover claims against test records.
Suppliers include the exotic. Launch, ground-station, transponder, cloud and network-equipment suppliers sit alongside ordinary IT vendors in the supplier register, with assurance proportionate to what each can do to you. The same register discipline described in my security questionnaires guide applies, with higher stakes.
What is the route to certification for an operator?
- Scope workshop covering corporate, network and ground estates, tested against customer requirements.
- Gap analysis with engineering leads, using ISO/IEC 27011 guidance where it sharpens control design.
- Risk assessment that treats operational and corporate risks in one register with different owners.
- Statement of Applicability; control gaps closed inside existing engineering processes.
- Evidence period, internal audit (including operational sampling) and management review.
- Stage 1 and Stage 2 with a certification body that has genuine sector competence, so ask who will audit you.
Fees follow scope and headcount in the usual way, and my UK cost guide sets out the bands. Operators with multiple sites or 24-hour operations should expect the upper-middle of the range.
Post-certification, surveillance audits land more comfortably when the system is owned day-to-day. My guide to surveillance audit preparation explains what auditors sample each year.
For how this ran in practice, I have written up my implementation of ISO 27001 for a major satellite communications company across operations in England, Holland and North America.