CESPHN achieved certification against ISO 27001 for information security management and ISO 9001 for quality management in March 2026. The external audit identified no major or minor non-conformities, providing independent assurance that CESPHN has robust systems for protecting information, managing risk and supporting consistent, high-quality work.
The certification process strengthened policies, risk assessments, system controls and security monitoring. It also supported organisation-wide process mapping, clearer documentation, improved procurement and compliance processes, and standard operating procedures for critical systems.
Staff capability was strengthened through information security awareness, data governance and system risk training. Together, these improvements have embedded more consistent ways of working and strengthened the protection of personal, clinical and organisational information.
CESPHN will maintain certification through annual internal audits, external surveillance audits and ongoing improvement. Current priorities include addressing audit observations, responding to opportunities identified through Business Continuity Plan testing and continuing to strengthen staff awareness of information security.