Norcaster · Trust center
Our own work toward ISO/IEC 27001, ISO/IEC 42001 and a SOC 2 Type II report, step by step. Updated each time a step moves.
Jump to: ISO/IEC 27001 · ISO/IEC 42001 · SOC 2 Type II
Information security management system (ISMS): how Navego AB protects the Norcaster platform, the data customers send through it, and the company that runs it.
Started and ongoing. Scoping and the gap assessment are under way.
2 of 10 steps started · 0 done
AI management system (AIMS): how Navego AB governs the AI it builds into Norcaster and the AI it uses to build and run the company.
Started and ongoing. Scoping and the gap assessment are under way.
2 of 10 steps started · 0 done
We run ISO/IEC 27001 and ISO/IEC 42001 as one integrated management system: one scope, one policy set, one risk register, one internal audit and one management review, with the AI-specific parts of ISO/IEC 42001 added on top. Many of the controls are the same ones we evidence for SOC 2 Type II, whose observation window opens 1 November 2026, so the three programmes share one set of records.
Decide what the management system covers: the Norcaster platform (managed cloud and self-hosted releases), Navego AB as its operator, and the people and requirements around them.
Read today's controls against the standard's clauses and Annex A, and list what is missing.
One policy set for information security and AI, with a named owner for every control.
ISO/IEC 27001: information-security risk assessment and treatment plan. ISO/IEC 42001: AI risk assessment and an impact assessment for each AI system in scope.
Which Annex A controls apply, why, and how each one is implemented.
Controls run long enough to leave records an auditor can sample. Many are the same controls we evidence in the SOC 2 Type II observation window that opens 1 November 2026.
An audit of the management system by someone independent of the work being audited.
Leadership reviews results, risks and audit findings, and records its decisions.
An accredited certification body reviews the documented management system.
The certification body audits the controls in operation and decides on certification. A certificate is linked here once issued.
An independent CPA firm examines how the controls behind the Norcaster platform operate over a period of months, and reports on them.
Window opens Nov 2026Readiness work is under way for an observation window from 1 November 2026 to 31 January 2027. The report follows the examination, expected in Q2 2027, and is available under NDA.
A SOC 2 report is an attestation: an independent CPA firm examines the controls and reports on how they operated. There is no certificate. Request the report under NDA.
4 of 9 steps started · 1 done
Read today's controls against the Trust Services Criteria and list what must be operating before the observation window opens.
Evidence: Gap assessment (3 June 2026) and pre-window readiness review (6 October 2026), kept in Norcaster's compliance records.
Decide which Trust Services Criteria are in scope and write the system description the auditor reviews: the Norcaster platform, the infrastructure and people that run it, and where self-hosted installs sit outside it.
Every policy the controls rely on is approved, with a named owner.
An independent CPA firm agrees the scope and the observation period.
A compliance platform collects evidence from the systems that run Norcaster, next to Norcaster's own audit bundles.
Controls operate and leave records from 1 November 2026 to 31 January 2027.
A third-party test inside the observation window, with a retest of anything it finds.
The auditor samples records from the whole window and tests how the controls operated.
The CPA firm issues its report, expected in Q2 2027, available under NDA.
For ISO/IEC 42001 we plan to run our own AI use through Norcaster, so the runtime records behind our AI controls come from the same evidence store our customers use: policy decisions, model changes, incidents with corrective actions, and audit-bundle exports. We will say here when that is live.
This page is about Navego AB's own programmes. Separately, Norcaster customers can already export ISO/IEC 27001-, ISO/IEC 42001- and SOC 2-scoped evidence bundles for their own programmes; see framework views. Norcaster supplies evidence; your certification body or CPA firm decides.
Last updated 22 October 2026. Questions about our programmes: security@norcaster.com