Migration Manager successfully passed its latest ISO 27001 audit, reinforcing our commitment to protecting the sensitive information entrusted to Australian immigration professionals. 

We’re pleased to announce that Migration Manager has successfully passed its latest ISO 27001 audit, reaffirming our ongoing commitment to internationally recognised information security standards. 

For more than 20 years, we’ve supported Australian immigration lawyers and registered migration agents. Throughout that time, security, compliance and reliability have remained fundamental to how we develop and maintain software for the profession. 

Our latest audit is an achievement worth sharing. It also offers an opportunity to explain why independent security assurance matters - and why practitioners should look beyond a software provider’s claims, features and subscription price. 

Security isn’t just a promise. It’s a commitment we continue to prove. 

What does passing an ISO 27001 audit mean? 

ISO/IEC 27001 is an internationally recognised standard for information security management systems (ISMS). It sets requirements for identifying, assessing, treating and continually reviewing information security risks. 

Unlike a statement that a business considers its software secure, accredited ISO 27001 certification involves assessment by an independent certification body. The assessment concerns the organisation’s information security management system within its defined certification scope - not simply a single application or feature. 

A functioning ISMS addresses information security governance, risk management, access controls, supplier relationships, incident response, business continuity, internal audits, management review and continual improvement. Appropriate technical controls, including those relevant to secure development and vulnerability management, are selected and managed according to assessed risks. 

Certification generally follows a three-year cycle, with surveillance audits between certification and recertification. Maintaining it requires continuing investment in people, expertise, processes, technology and independent assessment. 

No certification can guarantee that an organisation will never experience a cyber incident. What independent ISO 27001 certification does provide is evidence that an organisation’s approach to managing information security risks has been assessed against a recognised standard. 

Why this matters to immigration professionals 

Immigration practices routinely manage passports, identity documents, address histories, financial information, medical records, police clearances, family details and sensitive employer information. Across an established caseload, that can represent thousands of highly confidential records. 

A security incident can affect far more than software availability. It may expose clients to identity theft, fraud and privacy harms, while creating operational disruption and serious consequences for a practice. 

Australian immigration lawyers and registered migration agents have professional obligations concerning confidentiality and the handling of client information, although the precise rules differ between professions and jurisdictions. Engaging a software provider does not automatically transfer those responsibilities to the provider. 

The technology may be outsourced. The professional responsibility to protect confidential information cannot simply be outsourced. 

This makes supplier due diligence an important part of selecting and reviewing practice-management software: where is data stored and processed, who can access it, how is it protected, and what evidence supports the provider’s security claims? 

Not all security credentials provide the same assurance 

Security badges and certificates can represent different things. Some schemes use self-attestation or director’s attestation, in which a company director formally declares that specified security controls have been implemented. Such declarations can create accountability, but they are not the same as independent auditing of those controls. 

Other assessments may examine a particular integration, application or technical component. These can be useful, but their scope should be understood rather than assumed to extend across the entire organisation. 

Independent ISO 27001 certification is different: an external certification body assesses the organisation’s information security management system against the standard, within a stated scope. 

The right question is not simply “Do you have a security certificate?” It is “Who assessed you, what did they assess, and was the assessment independent?” 

Cloud hosting certification is not software-provider certification 

Major cloud platforms invest heavily in security and hold recognised certifications. However, using a certified cloud provider does not automatically make the software business itself ISO 27001 certified. 

Under shared-responsibility arrangements, the cloud provider and software company have different security obligations. The application provider remains responsible for matters such as its software, configurations, access controls and relevant data-handling practices. 

Practitioners should determine whether a claimed certification belongs to the software provider itself, its hosting company, or another service involved in delivering the product. 

Innovation is accelerating. Security must keep pace. 

AI-assisted development - including approaches sometimes called “vibe coding” - can help teams create and improve software faster. This is an exciting development, but speed of delivery is not evidence of secure engineering. 

A polished interface or impressive demonstration cannot establish that an application has been appropriately tested, maintained and governed. Equally, lower-priced software is not inherently less secure, and higher-priced software is not automatically safer. 

What matters is the evidence: secure development practices, appropriate testing, vulnerability management, incident readiness, knowledgeable people and ongoing oversight. 

The concern is not how quickly software is developed. It is what may be overlooked if speed and affordability are prioritised without adequate safeguards. 

The investment behind dependable software 

Information security investment is not always visible in a product demonstration. It includes specialist expertise, documented processes, training, monitoring, independent assessments and the work required to address weaknesses and maintain effective controls. 

For a software company supporting a regulated profession, these are not peripheral costs. They are part of the responsibility of operating a platform that holds sensitive information. 

At Migration Manager, our ISO 27001 and NSW Law Society certifications, relating to trust accounting, reflect different aspects of our commitment to the security and professional requirements of Australian immigration practice. 

Seven questions to ask your software provider 

1. Is your organisation ISO 27001 certified? Can you provide the certificate and its scope?
2. Are your security credentials independently audited or based on self-attestation?
3. What security testing has the application undergone, and how are vulnerabilities addressed?
4. Where is client information stored and processed, including by third parties?
5. What controls protect access, encryption, backups and incident response?
6. How does the product support the professional obligations relevant to our practice?
7. How is security reviewed, tested and improved over time?

A commitment that continues 

Passing our latest ISO 27001 audit is an achievement we are proud of - but its real significance is the work behind it and the commitment that continues after the audit is complete. 

As immigration technology evolves, practitioners should expect innovation, usability and value. They should also expect clear answers about the security of the systems entrusted with their clients’ information. 

Your clients trust you with their most sensitive information. Who are you trusting to keep it safe? 

Because when something goes wrong, your clients won’t care that your software provider did its best; they’ll want to know why their information wasn’t adequately protected in the first place.  

Migration Manager - Stable. Trusted. Reliable.