Press Release
CELUS has achieved ISO/IEC 27001 certification and SOC 2 Type 2 attestation, an important milestone in our ongoing commitment to information security, reliability, and responsible data management. Both were independently assessed, and they give libraries additional assurance that CELUS has rigorous processes and controls in place to manage information security and protect the systems and data entrusted to the platform.
For libraries that increasingly rely on cloud-based services and interconnected technology platforms, information security has become an important part of technology procurement and vendor assessment. CELUS works with libraries around the world to collect, process, normalize, and analyze e-resource usage statistics from publishers and content providers. The ISO 27001 certification and SOC 2 attestation independently validate the security and governance practices behind these services.
“Libraries rightly expect their technology partners to treat information security with the same seriousness that they do. Achieving ISO 27001 certification and completing our SOC 2 assessment gives our customers independent assurance that security is not simply a technical feature of CELUS, but an integral part of how we operate as a company. As CELUS continues to grow and serve more libraries internationally, maintaining that trust is essential.”
Tomáš Novotný, CEO and Co-Founder of CELUS
ISO/IEC 27001 is the internationally recognized standard for information security management systems (ISMS). It sets requirements for identifying and managing information security risks, and for implementing, maintaining, and continually improving appropriate security controls.
SOC 2 is an independent examination of an organization’s controls for the secure operation of its systems and services, based on the AICPA Trust Services Criteria. A Type 2 report goes further than a point-in-time Type 1 snapshot: the auditor tests whether the controls actually worked throughout an extended period.
Together, the two provide complementary external assurance. ISO 27001 shows how we manage information security as an organization, and SOC 2 confirms that our controls operated effectively in practice over time.
Here are some of the controls the auditors examined:
If your institution runs a security review before purchasing or renewing, you don’t need to wait for us. Both documents are freely available, and you’ll also find them in the footer of every page on celus.net:
Independently audited documents like these can often answer the questions that self-assessed security questionnaires such as HECVAT ask, so feel free to share them with your IT or compliance team as part of your review.
Does your IT team have more questions? Shoot us a message at ask@celus.net.
Certification is a milestone, not a finish line. CELUS will keep reviewing and strengthening its information security practices, complete ongoing ISO 27001 surveillance audits, and continue its SOC 2 examinations.
About CELUS
CELUS provides librarians with an online, cloud-based platform for the dynamic harvesting, reporting, and management of electronic resource usage statistics. It is the result of a collaborative effort with CzechELib, the Czech national consortium of academic libraries, which boasts approximately 130 member institutions and an annual e-resources budget of $50 million. This partnership has enriched CELUS with a wealth of experience and expertise in the field of e-resource usage statistics (www.celus.net).
Keep reading
