Articles

ISO Article

<hr /> Security will always be a critical pillar for modern software, particularly as more threats permeate the perimeter. But security is more than just a technology consideration, and requires the fortification of best practices and policies to complete the picture. As an open source content management system with multiple products in its ecosystem, <a target="_blank" rel="noopener noreferrer" href="https://cmscritic.com/products/umbraco">Umbraco</a> continues to invest in bolstering its own security posture – and just announced that it has achieved the globally recognized <a target="_blank" rel="noopener noreferrer" href="https://www.iso.org/standard/27001">ISO/IEC 27001:2022</a> certification.According to Umbraco CEO <a target="_blank" rel="noopener noreferrer" href="https://cmscritic.com/the-right-person-to-lead-umbraco-appoints-mats-persson-as-ceo-reflecting-growth-ahead">Mats Persson</a>, this certification reflects the CMS’s growth and adoption by larger, multinational enterprises and organizations operating in highly regulated industries. It also enhances an already strong foundation of security-focused benchmarks that the company has attained.  <figure class="image image-style-align-center image_resized" style="width:36.25%"><img src="https://cmscritic.com/ms-content/uploads/2026/01/image-1769732833624.png" /></figure>Umbraco CEO Mats Persson “We already implement robust information security processes to comply with the NIS2 Directive and EU Cyber Resilience Act,” Persson said. “ISO 27001 certification provides our global partners and customers with the reassurance that Umbraco follows international best practices governing the way that our products process, store, and protect sensitive data.”<h3 id="setting-a-higher-bar-for-security">Setting a higher bar for security</h3>ISO – the <a target="_blank" rel="noopener noreferrer" href="https://www.iso.org/standard/27001">International Organization for Standardization</a> – maintains a rigorous process for achieving ISO/IEC 27001 accreditation. It’s well-regarded as the world's best-known standard for information security management systems (ISMS), and defines the core requirements it must meet.The ISO/IEC 27001 standard provides companies of any size – from all sectors of activity – with guidance for establishing, implementing, maintaining, and continually improving an information security management system.ISO 27001 provides a proven framework for several key requirements, starting with identifying and managing security risks and ensuring consistent and documented security practices are in place. Recipients of the certification must also support accountability and transparency across their teams, and continuously review and update their security systems and practices as their products and organizations evolve.Meeting ISO/IEC 27001 means Umbraco has instituted a system to manage risks related to the security of data that is owned or handled by the company, and that its system respects all the best practices and principles outlined in this standard.<h3 id="enhancing-security-to-support-the-partner-ecosystem">Enhancing security to support the partner ecosystem</h3>The ISO/IEC 27001 certification applies specifically to Umbraco’s product organization and follows an extensive audit of its people, processes, and technologies by an independent security specialist. It validates the company's fierce commitment to maintaining the confidentiality, integrity, and availability of sensitive data within its products.While the accreditation is a technical achievement, the investment in the process was also part of Umbraco’s ongoing support for its digital agency partners, which are increasingly winning deals with global enterprises – particularly brands and organizations with large workloads handling sensitive data. This includes complex websites and e-commerce sites.“Gaining the ISO 27001 certification shows that independent auditors have scrutinized the processes used to develop, operate, and maintain Umbraco products, and confirmed that the company reviews and manages security risks on an ongoing basis,” Persson added. “This is a milestone on a continuous security journey.”<h3 id="why-it-matters">Why it matters</h3>Umbraco is already demonstrating its ambitions for global growth, and this ISO certification is further evidence of its drive towards the enterprise layer. Having already complied with the <a target="_blank" rel="noopener noreferrer" href="https://www.google.com/search?q=NIS2+Directive&amp;rlz=1C5CHFA_enUS763US764&amp;oq=NIS2+direct&amp;gs_lcrp=EgZjaHJvbWUqDAgAEAAYQxiABBiKBTIMCAAQABhDGIAEGIoFMgYIARBFGDkyBwgCEAAYgAQyBwgDEAAYgAQyBwgEEAAYgAQyBwgFEAAYgAQyBwgGEAAYgAQyBwgHEAAYgAQyDAgIEAAYQxiABBiKBTIHCAkQABiABNIBCDMyMTFqMGo3qAIAsAIA&amp;sourceid=chrome&amp;ie=UTF-8&amp;ved=2ahUKEwiYhOmJg7KSAxV-1fACHXraPBYQgK4QegYIAQgAEAM">NIS2 Directive</a> (the comprehensive, EU-wide cybersecurity legislation that strengthens security for critical infrastructure and digital services) as well as the <a target="_blank" rel="noopener noreferrer" href="https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act">EU Cyber Resilience Act,</a> Umbraco is well-positioned to sell into regulated industries with the most important product of all: trust. <hr /><h3 id="-upcoming-events"> Upcoming Events</h3> <img style="width:30.06%" src="https://cmscritic.com/ms-content/uploads/2026/01/cms-summit-26-logo.jpg" alt="" /><h4 id="cms-summit-26"><a target="_blank" rel="noopener noreferrer" href="https://www.boye-co.com/conferences/cmssummit26">CMS Summit 26</a></h4>May 12-13, 2026 – Frankfurt, GermanyThe best conferences create space for honest, experience-based conversations. Not sales pitches. Not hype. Just thoughtful exchanges between people who spend their days designing, building, running, and evolving digital experiences. CMS Summit brings together people who share real stories from their work and platforms and who are interested in learning from each other on how to make things better. Over two days in Frankfurt, you can expect practitioner-led talks grounded in experience, conversations about trade-offs, constraints, and decisions, and time to compare notes with peers facing similar challenges. Space is limited for this exclusive event, <a target="_blank" rel="noopener noreferrer" href="https://www.boye-co.com/conferences/cmssummit26/tickets">so book your seats today.</a> <img style="width:30.13%" src="https://cmscritic.com/ms-content/uploads/2025/12/image-1765546475634.png" /><h4 id="umbraco-codegarden-2026"><a target="_blank" rel="noopener noreferrer" href="https://codegarden.umbraco.com/">Umbraco Codegarden 2026</a></h4>June 10–11, 2026 – Copenhagen, DKJoin us in Copenhagen (or online) for the biggest Umbraco conference in the world – two full days of learning, genuine conversations, and the kind of inspiration that brings business leaders, developers, and digital creators together. Codegarden 2026 is packed with both business and tech content, from deep-dive workshops and advanced sessions to real-world case studies and strategy talks. You’ll leave with ideas, strategies, and knowledge you can put into practice immediately. <a target="_blank" rel="noopener noreferrer" href="https://codegarden.umbraco.com/">Book your tickets today.</a> <img style="width:40.76%" src="https://cmscritic.com/ms-content/uploads/2026/01/open-source-cms-26.jpg" /><h4 id="open-source-cms-26"><a target="_blank" rel="noopener noreferrer" href="https://www.boye-co.com/conferences/opensourcecms26">Open Source CMS 26</a></h4>October 20–21, 2026 – Utrecht, NetherlandsJoin us for the first annual edition of our prestigious international conference dedicated to making open source CMS better. This event is already being called the “missing gathering place” for the open source CMS community – an international conference with confirmed participants from Europe and North America. Be part of a friendly mix of digital leaders from notable open source CMS projects, agencies, even a few industry analysts who get together to learn, network, and talk about what really matters when it comes to creating better open source CMS projects right now and for the foreseeable future. <a target="_blank" rel="noopener noreferrer" href="https://www.boye-co.com/conferences/opensourcecms26/tickets">Book your tickets today.</a>

Umbraco Lands ISO 27001 Certification, Bolstering Its Security Posture

cms-critic-staff

Ask anyone at <a href="https://www.cmscritic.com/aws-joins-mach-alliance-as-enabler-member-reflects-growth-of-cloud-native-solutions/">AWS</a> about the importance of security, and they're likely to say it's  "job zero" – and for good reason.
Unless you've been living under a rock, you probably know that cybersecurity threats and data breaches are on the rise, reaching epic proportions last year. According to <a href="https://www.sonicwall.com/news/sonicwall-the-year-of-ransomware-continues-with-unprecedented-late-summer-surge/" target="_blank" rel="noopener">SonicWall,</a> a leading security provider, there were nearly 500 million ransomware attacks through September 2021, with a staggering 1,748 attempted attacks per organization.
That's equivalent to a single business receiving 9.7 ransomware attempts every day. Yikes.
While many software platforms have embraced security standards in an effort to validate their trust, not all content management systems (CMS) have invested in these credentials. However, as more CMS platforms move to SaaS delivery and enterprise self-service, security is becoming a more pressing issue than ever before.
While new benchmarks for security compliance continue to emerge, the International Organization for Standardization – <a href="https://www.iso.org/home.html" target="_blank" rel="noopener">also known as ISO</a> – has long been an institution for normalizing critical business practices and product requirements. Along with providing a heightened degree of technical governance around key information security requirements, ISO's 27001 certification might offer a new model for CMS platforms to project a more secure posture across global markets.
To that end, <a href="https://www.storyblok.com/" target="_blank" rel="noopener">Storyblok</a> – an enterprise headless CMS that enables developers and marketers to deliver powerful content experiences on any digital platform – recently announced that it had received <a href="https://www.certipedia.com/quality_marks/9000020037?locale=en&amp;certificate_number=01+153+2100668" target="_blank" rel="noopener">ISO 27001 certification</a> from TÜV Rheinland, an independent third party. This critical certification verifies that all of Storyblok’s products, operations, support processes, and data storage protocols meet the highest international security standards when it comes to managing information security. 
To understand more about how users view their CMS security, Storyblok surveyed 530 professionals who personally use a CMS in the United States, UK, Germany, Sweden, and the Netherlands. We had a chance to chat with <a href="https://www.linkedin.com/in/sgierlinger/" target="_blank" rel="noopener">Sebastian Gierlinger</a>, VP of Engineering at Storyblok, about the data they received from the survey – as well as some of his insights on the headless CMS market. You can read our Q&amp;A below. 
<h2>Understanding the perception of security for CMS users</h2>
If you don't already know from personal experience (and we hope you don't), security problems can be very expensive for enterprises – and in some cases, even sink a business. 
In a report called <a href="https://www.forrester.com/report/The-Four-Tenets-Of-SaaS-Application-Security-And-Protection/RES165119" target="_blank" rel="noopener">The Four Tenets Of SaaS Application Security And Protection</a>, analyst firm Forrester said: “Losing data in a SaaS application because of insufficient data protection is every CISO’s and compliance officer’s nightmare. Mitigation costs can exceed $3 million to $3.5 million per incident — and that’s a conservative estimate.”
Once again, we'll insert a yikes for dramatic purposes. 
Storyblok conducted its survey to better understand the collective psyche of CMS users as it relates to security. The results were quite revealing and reflect the elevated concern felt across software markets. Here are a few of the most telling data points gleaned from respondents:
<ul>
<li>64.3% worry about the security of their CMS</li>
<li>80% said security is extremely important or very important to them when choosing a CMS</li>
<li>More than half (55.5%) said their CMS has new security issues on a monthly, weekly, or daily basis</li>
<li>46.4% had a CMS security issue affect their content</li>
<li>21.7% conduct security updates 5-9 times per month</li>
</ul>
<h2>The rise of headless and the impact on CMS security</h2>
There's no question that <a href="https://www.cmscritic.com/top-free-headless-cms-platforms/">headless</a> has been powering the energy in the CMS market for the last few years. More businesses are making the move from traditional monolithic platforms to decoupled systems that provide greater agility with API-first architectures. This has been reflected in the rapid rise of composable solutions and <a href="https://www.cmscritic.com/mach-alliance-releases-study-on-adoption-of-mach-technologies-by-tech-leaders-qa-with-sonja-keerl/">MACH</a> (Microservices, APIs, Cloud-first SaaS, Headless) architectures – and the proliferation of the <a href="https://www.cmscritic.com/mach-alliance-releases-study-on-adoption-of-mach-technologies-by-tech-leaders-qa-with-sonja-keerl/">MACH Alliance</a>. 
There are many advantages to using a headless CMS. While they don't provide the same backend rendering capabilities as a traditional CMS, they do offer more flexibility, scalability, and ease of use. But there's also one key advantage of headless that is often overlooked: security. By maintaining a separated frontend and backend, a headless architecture is much less susceptible to security threats like distributed denial of service (DDoS) attacks.
To learn more about Storyblok’s commitment to the highest standards of security, visit its <a href="https://www.storyblok.com/trust-center" target="_blank" rel="noopener">Trust Center.</a>
<h2>Q&amp;A with Sebastian Gierlinger, VP of Engineering at Storyblok</h2>
CMS Critic had an opportunity to connect recently with Sebastian Gierlinger. He shared some of his views on the headless CMS market, particularly around security, as well as the rise of MACH. 
As Gierlinger noted in the company's press release, “Traditional CMSs have a bad reputation for the security headaches they cause, and for a good reason. Getting the ISO 27001 certification was especially important to us because it ensures that any enterprise using Storyblok to share their content with the world is doing so on the most secure, enterprise-grade headless CMS available on the market.”
<hr />
CMS Critic (CC): Where are the top security advantages with a headless CMS versus traditional?
Sebastian Gierlinger (SG): Generally speaking, Headless CMS reduces the exposure of infrastructure that’s front-facing. This reduces the surface of potential attacks. In addition, the hosting infrastructure of a Headless CMS is less complex compared to a traditional CMS.
<hr />
CC: The headless CMS market is growing, but so too are the platform options. How important is the ISO certification to differentiating across an expanding field of competitive players?
SG: Security is a major concern for many enterprises, and the ISO certification of Storyblok recognized that all our products, operations, support processes, and data storage protocols meet the highest standards. Customers do expect best-in-class security, and we believe that Storyblok’s ISO certification provides more proof that we deeply care about the modern enterprise tech stack and making it as secure as possible.
<hr />
CC: How is infrastructure (ie, Cloud) playing into the overall security posture for CMS users – particularly with headless?
SG: A headless CMS is built on top of a best-of-breed approach that sits on cloud infrastructure solutions. While on-premise hosting has been the default situation up until recently (a few years ago), we would argue that cloud infrastructure tends to be more secure as it comes with security resources, 24/7 support, and uptime guarantees. With those things in place, there’s hardly anything that could really go wrong. Sure, cloud infrastructure isn’t 100% safe from security attacks or other issues; however, the likelihood of an AWS outage tends to be much smaller than that of an on-premise infrastructure managed by you and your team.
<hr />
CC: How specifically is the ISO certification reinforcing trust for Storyblok? Are there specific tenants of the ISO standards that were challenging to meet – but now provide heightened security that other platforms aren’t able to meet?
SG: During the ISO certification process, we did not apply for any exemptions in the statement of applicability (SoA) and met all specific requirements right away. 
We are really proud that the ISO certification covers the entire operation, maintenance, and development of Storyblok’s CMS and all related services. In order to fulfill those requirements, we had to make sure that Storyblok establishes secure processes and standards in all departments across the organization.
<hr />
CC: On the same topic: how is the ISO certification supporting Storyblok’s global growth strategy? Do you foresee this as an opportunity to grow your customer base in other markets where the ISO certification is preferred or even required?
SG: We do see existing and potential customers in all regions requesting security standards that are now being met with the ISO 27001 certification. Also, leading analyst firms reassured us that ISO 27001 certification is a top priority amongst many enterprises. Other security certifications can be mapped and fulfilled with ISO 27001.
Overall, ISO 27001 is definitely an important requirement in many European countries; however, we also see US-based companies requesting this certification.
<hr />
CC: As of late, there’s been increased attention around MACH. We see that you are a member of the MACH Alliance – can you talk about the importance of being an open, best-of-breed technology in this ecosystem? Is this proving to be a differentiator?
SG: The MACH principles provide an innovative solution for creating and launching the modern enterprise tech architecture and building new experiences quickly and efficiently. Additionally, as the MACH principles adhere to the best-of-breed approach, organizations can easily add and replace tools as needed, unlike in monolithic structures.
Due to working with structured or atomic content, the way in which content moves within its ecosystem has been radically transformed. 
Content creators are now decoupled from developers due to CMS platforms, giving them the freedom to power on without leaning on developers for minuscule changes or edits. Simply put, the way we work has evolved along with our technology.
Overall, we believe that the MACH principles are becoming the standard way that the modern enterprise stack should look like. And with the MACH Alliance, we've found a group that tells this story on a global scale.
<h2>About Storyblok</h2>
Storyblok is an enterprise headless CMS that enables developers and marketers to deliver powerful content experiences on any digital platform. Developers create flexible components that are independently managed by content teams through a collaborative visual editor and customizable workflow. Published content is delivered through an API, so changes are made once and will appear everywhere: websites, mobile, IoT, the metaverse, and beyond. This approach reduces maintenance and makes content management more efficient. Leading brands such as Adidas, Pizza Hut, and Marc O’Polo use Storyblok to manage and share their content with the world. Storyblok was named the #1 CMS for 2022 by G2.
For more information, visit <a href="https://www.storyblok.com/" target="_blank" rel="noopener">https://www.storyblok.com</a> and follow Storyblok on <a href="https://www.linkedin.com/company/storyblok" target="_blank" rel="noopener">LinkedIn</a> and <a href="https://www.twitter.com/storyblok" target="_blank" rel="noopener">Twitter</a>.

Storyblok Earns ISO 27001 Certification for Secure, Enterprise-grade Headless CMS: Q&A with Sebastian Gierlinger

paris-tuzun

Storyblock featured image of ISO 27001 logo with Storyblok logo icon and headshot of Sebastian Gierlinger

Explore a wide range of informative articles on ISO, insights, and industry updates. Stay informed and ahead of the curve with our diverse collection of news and posts covering the latest trends and developments in the industry

News

Umbraco Lands ISO 27001 Certification, Bolstering Its Security Posture

Storyblok Earns ISO 27001 Certification for Secure, Enterprise-grade Headless CMS: Q&A with Sebastian Gierlinger