Iron Mountain
Global provider of records and information management, secure storage, document destruction, data centres and IT asset disposition.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| ISO/IEC 27001:2022 | Not stated by vendor | Product-scoped: Iron Mountain InSight in a secure cloud-hosted environment. Not company-wide or UK operations. | — | — | Current |
| ISO/IEC 27701:2019 | Not stated by vendor | Privacy information management extension to ISO 27001. | — | — | Current |
| ISO 9001:2015 | Intertek | Asset lifecycle management (ITRenew): receiving, sorting, demanufacturing, testing, resale and data destruction of electronic equipment. | — | — | Current |
| ISO 14001:2015 | Intertek | Electronics / asset lifecycle management operations. | — | — | Current |
| ISO 45001:2018 | Intertek | Safety in equipment processing operations. | — | — | Current |
| SOC 2 Type 2 | AICPA | Report is non-public; obtained via an Iron Mountain account representative. | — | — | Current |
| NAID AAA | i-SIGMA | Data destruction including hard drive shredding. | — | — | Current |
| NCSC Assured Sanitisation Service (CAS-S) | UK National Cyber Security Centre | Data sanitisation at the Milton Keynes, UK facility - the UK-scoped assurance. | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Partial
Certification is product-scoped (InSight), not UK records storage or shredding operations.
ISO 9001:2015
Partial
Scoped to the ALM/ITRenew electronics business, certified by Intertek.
ISO 14001:2015
Partial
Scoped to electronics/ALM operations, certified by Intertek.
SOC 2 Type 2
Partial
SOC 2 Type 2 report available under account representative request, not public.
GDPR 2016/679
Partial
Standard DPA referenced for customer personal data; SCCs and transfer mechanisms not detailed publicly.
Legal & Privacy
- Privacy Policy View ↗
Copyright © 2026 SnapGRC