Is Ubicquia ISO 27001 certified?

Yes. Ubicquia is audited to ISO 27001 and ISO 27002, covering the Information Security Management System (ISMS) and the code of practice for information security controls. Certification is maintained through recurring external audits.

Is Ubicquia SOC 2 compliant?

Yes. Ubicquia has completed a SOC 2 Type 2 audit, which attests to the operational effectiveness of its security controls over an extended observation period (not just a point-in-time snapshot). SOC 2 Type 2 is the standard cloud vendors are expected to meet for enterprise procurement.

What encryption does Ubicquia use?

TLS 1.2 or higher for data in transit, meeting NIST FIPS recommendations. AES-256 for data at rest on disk and backup media. On-device certificate and key management use the Trust M Security controller for MQTTS and HTTPS protocol integrity.

Does Ubicquia collect personally identifiable information (PII)?

Generally no. Ubicquia's services are designed around infrastructure telemetry — voltage, current, temperature, imagery of public infrastructure — not personal data. Data collection is limited to what's operationally required, minimizing regulatory exposure and privacy risk.

What is CTIA IoT certification and does Ubicquia have it?

CTIA (Cellular Telecommunications and Internet Association) IoT security certification validates IoT device security controls. Ubicquia's UbiCell networked lighting controller is certified under CTIA IoT security level 1 v1.2.3, with plans for CTIA Level 1 v2.1 certification across Smart Streetlighting, Smart Grid, and Public Safety.

How often does Ubicquia perform penetration testing?

Periodic internal and external penetration testing is conducted to simulate real attack methods against Ubicquia systems and infrastructure. Findings are logged, prioritized, assigned to an owner, and tracked through remediation. Third-party assessments provide independent validation of the security posture.

How does Ubicquia handle security incidents?

A documented Integrated Security Incident Response Team (ISIRT) process governs every incident. Pre-designated stakeholders address specific incident types; root cause analysis is conducted for each event; and remediation lessons are folded back into the ISMS through the continuous improvement cycle.

Does Ubicquia assess vendor and supply chain security?

Yes. New vendors are evaluated for cybersecurity posture during onboarding. Risks are flagged and mitigated with the vendor before engagement. All vendors must comply with Ubicquia's cybersecurity commitments as a contractual condition, with reviews at renewal or annually based on engagement risk level.

The Ubicquia Security Program: Certifications, Encryption, and Vulnerability Management

Q: How is customer data segregated in Ubicquia's cloud?

Customer data lives in AWS RDS databases with encryption at rest and is logically segregated per customer — no shared tables across accounts. Access is controlled through role-based access control (RBAC) in the UbiVu platform, restricting operational data to authorized personnel only.

How Ubicquia protects critical infrastructure with ISO 27001, SOC 2 Type 2, NIST 800-171, CTIA IoT certification, and continuous third-party vulnerability testing.

Ubicquia operates an audited, continuously improving information security program covering every product, service, and internal system. The program is built on ISO 27001 certification (audited) and SOC 2 Type 2 attestation (audited), and aligned to NIST 800-171, NIST CSF, PCI SAQ-C, CMMC level 1, and CTIA IoT device certification standards.

This isn't a certifications-only exercise. Ubicquia's Information Security Management System (ISMS) governs encryption, data segregation, secure software development, incident response, vulnerability management, and supply-chain risk — all validated through recurring third-party audits and independent penetration testing.

Certifications and standards

ISO 27001 / 27002 — AuditedFull Information Security Management System (ISMS) certification with recurring external audits. The baseline standard for enterprise security posture.

SOC 2 Type 2 — AuditedAttests to operational effectiveness of security controls over a sustained period. Standard for cloud infrastructure handling utility and municipal data.

NIST 800-171 & NIST CSFAligned to the federal frameworks used for controlled unclassified information (CUI) and cybersecurity risk management across critical infrastructure sectors.

CTIA IoT Device CertificationUbiCell certified under CTIA IoT security level 1 v1.2.3. CMMC level 1 performed through SPRS. PCI SAQ-C compliant for cardholder data segments where applicable.

Encryption and communication security

Every connection between Ubicquia IoT devices and cloud services uses TLS 1.2 or higher for transport, with encryption implementing the highest recommended NIST Federal Information Processing Standards (FIPS). Sensitive data at rest — on disk or backup media — is encrypted with AES-256.

Devices communicate over cellular LTE, segmented within the carrier network via an Access Point Name (APN) and delivered to AWS via VPN. This isolates Ubicquia telemetry from public internet exposure. The Trust M Security controller manages MQTTS and HTTPS certificates on-device, protecting the cryptographic identity of every deployed unit.

Data protection and customer segregation

Customer data lives in AWS RDS with encryption at rest, and is logically segregated per customer — no shared tables across accounts. Access is controlled through the UbiVu asset management platform's role-based access control (RBAC), so operational data reaches only the personnel authorized to see it.

Ubicquia generally does not collect personally identifiable information (PII). Data collection is limited to what's operationally required to deliver the service — a design choice that reduces regulatory exposure and privacy risk for customers and their end users.

Vulnerability management and incident response

The security program continuously monitors for new threats using automated scanning, internal security audits, and periodic external penetration testing. Identified vulnerabilities are logged, prioritized, assigned to an owner, and tracked through remediation. Incident response follows a documented process — pre-designated ISIRT (Integrated Security Incident Response Team) stakeholders, root cause analysis for every incident, and remediation lessons folded back into the ISMS.

Vendors and third parties are evaluated during onboarding for cybersecurity posture and re-reviewed at contract renewal or annually based on engagement risk. All vendors must comply with Ubicquia's cybersecurity commitments as a condition of engagement.

Download the Ubicquia Security Program white paper

Full detail on certifications, encryption, data protection, vulnerability management, and supply-chain risk for enterprise and government procurement teams.

Download PDF