On 9 October 2026, Cyprus Shipping News reported that Marpoint, a Managed IT Services and remote technical support provider for shipping companies, had added two new ISO certifications: ISO/IEC 27701 for privacy information management and ISO 22301 for business continuity management. Both sit on top of the ISO/IEC 27001 information security certification the company already holds.
For anyone who buys, manages, or supplies technology services, the interesting part is where Marpoint sits in the chain. It does not own the vessels. Its services run inside its customers' environments: fleet-wide IT management, secure remote access, configuration management, security updates, and support for onboard connectivity, firewall, and IT infrastructure. A provider with that kind of access carries a piece of every customer's risk.
This article starts from the news, then asks what a procurement team, a ship manager, or a quality lead can learn from it: what these two standards actually require, how they build on ISO 27001, and what to ask a service provider who shows you the certificates.
📌 Case Study: Marpoint (Managed IT for shipping), ISO/IEC 27701 and ISO 22301, October 2026
According to Cyprus Shipping News (9 October 2026), Marpoint achieved two new certifications: ISO/IEC 27701 (privacy) and ISO 22301 (business continuity). The report describes its existing ISO/IEC 27001 certification as the foundation for the new ones.
The company says the privacy certification is especially relevant to services that access customer environments, such as Managed IT Services and remote technical support, and gives it a structured approach to personal data that supports GDPR compliance. The continuity certification is said to improve preparedness to respond to disruption and restore essential operations. The report also links the move to IMO guidance that identifies ISO/IEC 27001 as a relevant maritime cyber risk standard.
Fact summary: ISO/IEC 27701 and ISO 22301 (new), ISO/IEC 27001 (existing). Source: Cyprus Shipping News, 9 October 2026. The report does not name the certification body, the standard editions, or the formal scope.
What the report does not say: the certification body, the editions, and the formal scope are not stated. If a certificate matters to a purchasing decision, check these three items on the certificate and its scope statement rather than relying on a press report.
Why This Matters Beyond Shipping
Marpoint had earlier announced ISO 27001:2013 certification (reported by The Maritime Executive), following IMO Maritime Safety Committee approval of maritime cyber risk management guidelines. It has now extended that base to privacy and continuity. The pattern is the useful part: certifications stacked in layers, each one resting on the discipline built by the one before.
The second lesson is about the supply chain. When a shipping company outsources IT management, a failure at the provider, whether a leak, a misused credential, or an outage at a support centre, shows up on the customer's vessels and in the customer's office. Buyers across Asia-Pacific are increasingly asking providers for independent proof, not assurances.
What ISO/IEC 27701 Adds to ISO 27001
ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS). It is designed as an extension to ISO/IEC 27001 and 27002: an organization that already runs an information security management system adds privacy-specific requirements and controls for personal data. It distinguishes two roles, the controller, which decides why and how personal data is processed, and the processor, which processes it on someone else's behalf. A managed IT provider working inside customer systems usually sits in the second role.
Because it builds on 27001, 27701 is rarely a first step. An organization without a working security management system will struggle to add privacy controls on top of nothing. The editions in force are worth confirming with your certification body, since the report does not name them.
What ISO 22301 Asks of a Service Provider
ISO 22301 specifies a Business Continuity Management System. The organization identifies its critical services, runs a business impact analysis and a disruption risk assessment, sets continuity strategies and recovery plans, and then proves the plans work through exercises. ISO 22301:2019 is the current edition, with a 2024 amendment on climate change considerations.
For a provider whose customers depend on round-the-clock remote support, the standard turns an uncomfortable question into an auditable one: if your support centre, network, or key supplier fails, how fast is the critical service back, and where is the evidence?
A Buyer's Checklist: What the Certificates Prove and What They Do Not
| Question to Ask a Provider | What a Certificate Helps Show | What You Still Need to Verify |
|---|---|---|
| Do you protect our information? | ISO/IEC 27001: a risk-based security system audited by a third party | That our services and the sites you use are inside the certificate scope |
| How do you treat personal data you can see? | ISO/IEC 27701: a managed approach to personal data, with defined controller and processor roles | Your data processing agreement, and the laws that apply to your data |
| Will support continue if something fails? | ISO 22301: analysis, plans, and exercises for critical services | Recovery targets in your service agreement, and recent exercise results |
| Who certified you, and when? | The certificate shows body, edition, scope, and validity dates | That the certification body is accredited, and the certificate is current |
Regulation note: a privacy certification supports compliance but does not replace legal obligations. The Marpoint report ties its privacy certification to GDPR. Organizations in Indonesia are subject to Law No. 27 of 2022 on Personal Data Protection, and other jurisdictions in the region have their own regimes.
5 Lessons from Marpoint's Certifications
Build in Layers on a Proven Base
Marpoint used ISO 27001 as the base for 27701 and 22301, and had announced its 27001 certification well before. Extending step by step is more realistic than chasing every standard at once, because policies, asset registers, risk assessment, and audit habits already exist. Start with the standard that most threatens your business, then add the next layer.
Access to Customer Environments Brings Privacy Duties
The report stresses privacy relevance for services that access customer environments. A provider that can see systems, files, and data needs to know which personal data it touches, on what basis, and how it is protected. Map your personal data processing, including what you see incidentally during technical support.
Service Continuity Is a Promise to the Customer
For a service customers need at all hours, a continuity plan is not a backup document. Define critical services, recovery targets, and supplier dependencies, then test them through exercises. An ISO 22301 auditor looks for exercise records and the improvements that followed, not only a written plan.
Integrate Rather Than Pile Up Paperwork
All three standards share the same high-level structure, so one integrated system avoids duplicated policies, audits, and meetings: one risk register, one internal audit programme, one management review. For a lean services team this is where the saving is.
Use the Certificate as an Evidence Base in Customer Conversations
Marpoint links its certifications to customer confidence, cyber risk management, and regulatory obligations. An independently audited certificate makes it easier to answer security questionnaires and supplier due diligence. It still has to be read together with its scope, because scope decides which services are actually covered.
Bottom line: an ISO certificate shows that a system has been independently audited, not that risk is zero. The value comes from the discipline of running risk assessment, exercises, internal audit, and improvement every year.
Where to Start If You Provide IT Services
Whether you run managed IT, a data centre, or a development team with access to client systems, the path is broadly the same:
Gap analysis
Compare current practice against Clauses 4 to 10 of ISO 27001 and, where relevant, the added requirements of 27701 and 22301.
Define scope and map data
Decide which services, sites, and teams are inside the system, then map the customer data and personal data you access or process.
Run risk assessment and business impact analysis
Identify threats to security, privacy, and critical services, then set priorities and recovery targets.
Build policies, procedures, and continuity plans
Document access control, personal data handling, incident management, and recovery plans, and train the whole team.
Test through exercises and internal audit
Run recovery exercises and internal audits, and report the results to top management in a management review.
Certification audit
An accredited certification body verifies documentation and implementation. Certificates are typically valid for three years with periodic surveillance audits.
Frequently Asked Questions
What is the difference between ISO 27001 and ISO/IEC 27701?
ISO 27001 governs the security of all information in an organization. ISO/IEC 27701 adds specific requirements for protecting personal data, including the distinction between controller and processor roles. It is designed as an extension to 27001, so organizations normally build 27001 first.
Is ISO 22301 the same as a disaster recovery plan?
No. Disaster recovery usually focuses on restoring IT systems. ISO 22301 is broader: business impact analysis, continuity strategies for every critical service (people, processes, suppliers, technology), plans, exercises, and continual improvement.
Does ISO/IEC 27701 certification guarantee compliance with data protection law?
No. It is a voluntary standard that helps structure personal data management but does not replace legal obligations such as GDPR or Indonesia's Law No. 27 of 2022. Compliance must still be assessed against the laws that apply to your organization.
Are ISO 27701 and ISO 22301 only for maritime or IT companies?
No. Both apply to organizations of any size and sector. Companies that process a lot of personal data, or provide services that cannot stop, such as finance, healthcare, logistics, and telecoms, often have strong reasons to adopt them.
How long does it take to certify against these standards?
It depends on system maturity, scope, and resources. An organization with a well-run ISO 27001 system is usually quicker to add 27701 or 22301 than one starting from scratch. The stages include gap analysis, risk assessment, documentation, training, internal audit, and the certification audit.
Ready to Build a Privacy and Continuity System to ISO Standard?
Arafar Nusa supports organizations across sectors in building ISO-standard management systems, from gap analysis to certification audit day. Your first consultation is free.
💬 Free Consultation via WhatsApp