On 15 October 2026, Pasqal, the France-based neutral-atom quantum computing company, announced that its Information Security Management System (ISMS) is now certified to ISO/IEC 27001:2022. The announcement came in a press release distributed by GlobeNewswire from Paris. SGS carried out the independent audit under COFRAC accreditation, and the certificate covers Pasqal's sites in France, Canada, and Saudi Arabia.
Most certification news is about a single plant or a single office. This one is different because of the way the scope is drawn: three countries, hardware and software, factory floor and legal department, all under one management system. For any company that designs, builds, and supports a technical product across borders, that is the real story, and it is where many ISO 27001 projects either succeed or stall.
📌 Case Study: Pasqal (France), ISO/IEC 27001:2022, 15 October 2026
According to Pasqal's press release, distributed through GlobeNewswire on 15 October 2026, the company, founded in 2019, achieved ISO/IEC 27001:2022 certification for its ISMS following an independent audit by SGS under COFRAC accreditation.
The scope covers the design, development, industrialization, deployment, maintenance, and support of quantum computing solutions and related services. It applies to sites in France, Canada, and Saudi Arabia and to functions including hardware R&D, QPU production, software development, product management, sales, procurement, and operations, as well as corporate functions such as legal and intellectual property.
"In quantum computing, trust is not a feature you add once the technology works. It has to be built in from the first qubit," said Wasiq Bokhari, CEO of Pasqal. He added that customers are preparing to run highly sensitive workloads on quantum computers and that Pasqal built information security into its design, development, production, and support processes.
Read closely, the scope statement describes a product life cycle rather than an IT department. It starts with design and ends with support, and it names procurement and intellectual property along the way. That matters because ISO 27001 does not certify a company in the abstract. It certifies a defined scope, and the auditor tests whether the controls inside that scope actually operate. A narrow scope is legitimate, but the assurance it gives customers is correspondingly narrow, so a broad scope like this one carries more weight with a procurement team reviewing a vendor.
For a deep-tech manufacturer, the information worth protecting is unusually concentrated in a few places: hardware designs, firmware and control software, process know-how in production, and the data customers will eventually run on the machines. Because those assets sit in different teams and different countries, the hard part is rarely choosing a firewall. The hard part is deciding who owns each asset, which risks matter most, and how a single set of rules works in several jurisdictions. ISO 27001 gives a structure for exactly that, built around a risk assessment and a Statement of Applicability rather than a fixed checklist.
To see how the 2022 edition supports this, it helps to look at what changed. The 2022 revision reorganized Annex A from 114 controls in 14 domains into 93 controls in four themes, and it introduced 11 new controls. Several of the new ones speak directly to organizations that build and ship technology.
| New 2022 Control | Reference | Why a Technology Manufacturer Cares |
|---|---|---|
| Threat intelligence | A.5.7 | Informs which attacks against designs, code, and supply chain are realistic |
| Information security for use of cloud services | A.5.23 | Covers simulation, storage, and collaboration platforms used by engineering teams |
| ICT readiness for business continuity | A.5.30 | Supports customer commitments on availability and support |
| Physical security monitoring | A.7.4 | Relevant to laboratories and production areas |
| Configuration management | A.8.9 | Keeps control software and equipment settings consistent and traceable |
| Secure coding | A.8.28 | Applies to firmware and software shipped with the product |
The other new controls are information deletion (A.8.10), data masking (A.8.11), data leakage prevention (A.8.12), monitoring activities (A.8.16), and web filtering (A.8.23). The Annex A themes break down as organizational (37 controls), people (8), physical (14), and technological (34). None of this is a mandatory list: an organization selects controls through the risk treatment process in Clause 6.1.3 and records its decisions in the Statement of Applicability.
Timing note: the transition period for ISO 27001:2013 certificates ended on 31 October 2025, so new certification now means the 2022 edition. Amendment 1:2024, published on 23 February 2024, added climate-change considerations to Clauses 4.1 and 4.2 but did not create a new edition. There is no ISO 27001:2026.
With the scope and the standard in view, the practical lessons for other organizations become clearer. The five below are drawn from what the release says Pasqal certified, read alongside how ISO 27001 audits work in general.
Draw the scope around the product life cycle, not the org chart
Pasqal's scope runs from design to support. Mapping where information is created, changed, stored, and handed over, across the whole life cycle, usually reveals risks that a department-based scope would miss.
Treat security as a design input
The CEO's remark about building trust from the first qubit is a useful test: are security requirements written into product design and production procedures before launch, or reviewed afterwards? Auditors look for evidence that risk assessment happens early.
Use one system across several countries
With sites in France, Canada, and Saudi Arabia in scope, consistency becomes the main challenge. A common policy, one risk method, and one Statement of Applicability, with local procedures where local law requires, keeps the system auditable as a whole.
Bring procurement and legal into the room
Procurement, legal, and intellectual property are named in the scope. Supplier controls, confidentiality agreements, and ownership of designs are frequent audit topics, and they only work when those functions own their processes.
Choose an accredited certification body and keep the evidence ready
The audit was performed by SGS under COFRAC accreditation. Accreditation is what makes a certificate recognizable to customers' procurement teams, so verify a body's accreditation for ISO/IEC 27001 before you commit.
If you want to follow the same path, the sequence is familiar from other management system standards, with a stronger emphasis on risk. The six stages below show how a project typically unfolds from the first gap analysis to certification.
Gap analysis
Compare current practice with Clauses 4 to 10 and the Annex A controls to size the work.
Scope and asset inventory
Decide which sites, systems, and data fall inside the ISMS and assign an owner to every asset.
Risk assessment and treatment
Identify threats and vulnerabilities, rate the risks, select controls, and write the Statement of Applicability.
Policies, procedures, and awareness
Document the rules people follow and train everyone, including leadership and non-technical teams.
Internal audit and management review
Find nonconformities yourself, then report results to top management for decisions.
Two-stage certification audit
Stage 1 reviews documented readiness and Stage 2 verifies implementation. The certificate runs for three years with annual surveillance audits.
A certificate does not make an organization immune to incidents, and it does not replace legal obligations such as data protection law in each country where a company operates. What it does provide is evidence that a defined system exists, that it was examined by an independent party, and that it will be re-examined every year. For companies selling to large customers, that evidence often shortens the security questionnaire stage of a sale considerably.
Frequently Asked Questions
What did Pasqal announce on 15 October 2026?
Pasqal, a France-based neutral-atom quantum computing company, announced ISO/IEC 27001:2022 certification of its ISMS after an independent audit by SGS under COFRAC accreditation. The certificate covers sites in France, Canada, and Saudi Arabia, according to the GlobeNewswire press release.
What is the difference between ISO 27001:2022 and ISO 27001:2013?
The 2022 edition reorganizes Annex A into 93 controls in four themes (organizational 37, people 8, physical 14, technological 34), compared with 114 controls in 14 domains in 2013. It adds 11 new controls, including threat intelligence, cloud services security, ICT readiness for business continuity, data leakage prevention, and secure coding. The transition for 2013 certificates ended on 31 October 2025.
Do all 93 Annex A controls have to be implemented?
No. Annex A is a reference set. An organization selects controls through the Clause 6.1.3 risk treatment process and records its choices, with justification for any exclusion, in the Statement of Applicability.
Can an organization certify only part of its business?
Yes. ISO 27001 certifies a defined scope, and the certificate states it. A narrower scope is easier to achieve but gives customers less assurance, which is why many organizations extend the scope to cover the full product or service life cycle.
How long is an ISO 27001 certificate valid?
A certificate is valid for three years and is maintained through annual surveillance audits, with a recertification audit towards the end of the cycle.
Ready to Build an ISO 27001 Information Security System?
Arafar Nusa supports organizations across sectors in building ISO-based management systems, from gap analysis to certification audit day. Your first consultation is free.
💬 Free Consultation via WhatsApp