We're glad to share that zeroG has achieved ISO/IEC 27001:2022 certification: the internationally recognized standard for information security management systems (ISMS), effective 25 August 2026.
What ISO 27001 means
ISO/IEC 27001 is one of the most widely recognized standards for how organizations manage and protect information. The certification means an independent auditor reviewed our policies, processes, and controls and confirmed they meet the standard's requirements for identifying, managing, and reducing information security risk.
The certification, issued by DNV, covers our development and consultancy work specialising in data and AI in the aviation and transport sectors, in line with our Statement of Application (V1, 2 June 2026).
How we got here
The decision to pursue certification goes back around 18 months, with the last 12 months focused on hands-on preparation: building out our Information Security Management System in alignment with our parent company, Lufthansa Systems (LSY), which already holds ISO 27001 certification and whose organization and processes we were able to build on.
Along the way, we strengthened our documentation and process descriptions, introduced ongoing process monitoring and security KPIs, ran internal audits, updated our secure software development standards, improved asset management, adopted new code security tooling, added attack surface monitoring, and brought our compliance roles together into a more collaborative setup.
None of this happened in isolation: Timo Friedrich, Technology Hub lead and BISO for zeroG, and David Künzel, BISO deputy, led the effort together, with the Technology Hub (Shared IT Services) helping prepare our systems, tools, and documentation, and the Lufthansa Systems Information Security team guiding and mentoring us throughout the process. It was a genuine team effort.
What this means for you
For our customers and partners, particularly in aviation and transport, where data and AI work carries real security stakes, this certification is an independent, third-party assurance that zeroG manages information security formally and rigorously. It's increasingly a baseline expectation for vendors handling sensitive data, and we're glad to now meet it without exclusions.
