> How has GH ever been able to become ISO certified last year [0], when they didn't even place their keys in a HSM? ISO 27001 certification does not require yo

> How has GH ever been able to become ISO certified last year [0], when they didn't even place their keys in a HSM? ISO 27001 certification does not require you to put keys into an HSM. The standard requires you to have controls in place, be aware of your risks and to maintain a risk register. But in no way does the standard require HSM's. The standard would even be OK with storing this on a floppy drive if the risks surrounding that were identified and mitigated (or accepted).