ISO27001 and open software : <p>The company am employed considers to obtain an ISO27001 certification. Have already implemented a Linux testbed running Open VPN without issues. However am told a company cannot be ISO27001 certified unless their VPN is materialized using commercial only solutions, <em>implying open solutions such as Open VPN are considered unacceptable and un-certifiable under ISO27001</em>. Was surprised to hear this, would like to know from more knowledgeable people if there is any substance on that.</p>

<p>kind regards</p>

<p>K</p>
