Leadership & policy
Defined scope, accountable ownership, security objectives, policy decisions and management review.
Bayes Pharma / BayesPeaQ / Information security
Trust is a system.
Evidence is the work.
We are developing an Information Security Management System (ISMS) for BayesPeaQ, guided by ISO/IEC 27001:2022. Our focus is to make security responsibilities, risks, controls and verification evidence inspectable.
Certification status: Bayes Pharma / BayesPeaQ is not currently claiming ISO/IEC 27001 certification. This page describes preparation, not a completed audit, certified product or verified compliance.
Evidence-ledDocument decisions, tests, sources and limits.
Human accountableManagement and qualified reviewers retain authority.
Scope-awareSecurity management and pharmaceutical validation are distinct.
The ISMS model
Security management beyond a checklist.
ISO 27001 concerns how an organization governs information security—its policies, risks, people, processes and technology. We are organizing BayesPeaQ work around four evidence-backed areas.
Assets & risk
Information asset inventory, data flows, threat assessment, documented risk ownership and planned treatment.
Operational controls
Identity, least privilege, secure software changes, backup, monitoring, incident response and supplier controls.
Evidence & improvement
Control effectiveness testing, corrective actions, internal audit, independent assessment and continuous improvement.
Responsibility & transparency
What we can demonstrate—and what remains open.
Features and configured cloud controls are starting points. Implemented governance requires approval, operational records, independent testing and proof of continued effectiveness.
Foundational work
What we are building on
BayesPeaQ uses role-governed quality workflows and an AWS-based platform. Technical controls and draft process records are being reviewed for inclusion in a controlled security programme.
- Cloud configuration review. Initial evidence for monitoring, encrypted storage and backup configurations.
- Control mapping. Work to relate safeguards, owners, tests and records to security requirements.
- Documented remediation. Identified technical findings are tracked for human-led resolution and verification.
Still required
Open assurance gates
We do not equate a deployed security feature, automatically generated report or AI-authored policy with ISO certification.
- Human management approval. Formal adoption of scope, policies, risk treatment and ownership.
- Operational and technical proof. Authenticated tests, recovery exercises and independent security assessment.
- Independent certification. Impartial internal audit, management review and an accredited certification body's assessment.
Progress without inflated claims
From preparation to independently assessed assurance.
Each stage requires attributable evidence and the appropriate human approval. This is a process map, not an estimated certification date or percentage completion score.
Define & govern
Approve scope, policy, responsibilities and interested-party requirements.
● DRAFTS PREPAREDAssess & treat
Evaluate risks, decide control applicability and address security gaps.
● INITIAL ASSESSMENTOperate & test
Collect dated access reviews, release tests, incident and recovery evidence.
○ EVIDENCE BUILDINGAudit & improve
Complete impartial internal audit, management review and accredited assessment.
○ NOT YET COMPLETEFrequently asked questions
Scope matters.
Is BayesPeaQ ISO 27001 certified?
No certification is claimed. Bayes Pharma is developing and assessing the organizational ISMS. A certificate, when obtained, would specify the certified organization and the approved management-system scope.
Does ISO 27001 certify a pharmaceutical eQMS product?
ISO/IEC 27001 certifies an organization's information security management system within a defined scope. Customer computerized-system validation, electronic-record controls, FDA 21 CFR Part 11 and EU GMP Annex 11 obligations require separate assessments.
Can I see the detailed internal risk register or audit findings here?
Not on this public page. Security findings, privileged configuration and customer information are shared through an appropriate controlled review process. Authorized parties may request scoped evidence.
Who approves security decisions?
Bayes Pharma's authorized human leadership and designated control owners. AI assistance can help organize evidence but cannot independently approve residual risks or sign an audit.
Evidence enquiries
Assess the actual scope.
For qualified customer or audit enquiries, request a controlled discussion of information security scope, evidence availability and the assurance boundaries relevant to your intended use.