Purpose and claim boundary
This statement explains where Orbit can support an organisation's management-system and service-management evidence. It is not a certificate, conformity assessment, statement of RME Solutions' certification, or assurance that a client deployment conforms to any standard. Certification or conformity belongs to the organisation and its defined scope, based on its controlled system and, where applicable, an independent accredited assessment. Use aligned to, supports, or provides evidence hooks for only where the deployment evidence supports that wording.
Applicability summary
| Standard | Relevance to an Orbit service | Orbit contribution | Organisation-owned evidence/gaps |
|---|---|---|---|
| ISO/IEC 20000-1:2018, including Amendment 1:2024 | Core service-management system | Catalogue, ticket/request/change/approval records, service workflows, release traceability, operational views | SMS scope/plan, policies, service requirements, targets, roles, supplier control, service continuity, measurement, audit, and continual improvement |
| ISO/IEC 27001:2022 / 27002:2022 | Information security for the service and tenant | Secure-development gates, configuration validation, role-aware UI, provider seams, sanitisation and release evidence | ISMS scope, risk treatment, access/ACL enforcement, monitoring/retention/tamper evidence, vulnerability response, backup, physical/security operations, and the Statement of Applicability |
| ISO/IEC 27035-1:2023 | Security incident management | Ticketing and activity records can support reporting, triage, evidence, and lessons learned | Incident authority, detection, assessment, communications, forensics, regulatory reporting, exercises, and response capability |
| ISO/IEC 27036-2/-3/-4 | Suppliers, technology suppliers, and cloud services | Makes Microsoft 365, hosting, relay, and integration dependencies visible for review | Due diligence, contractual requirements, assurance, monitoring, exit, shared responsibility, and cloud-service security evidence |
| ISO 9001:2015 (Amendment 1:2024; revision status must be checked) | Quality and controlled service delivery | Versioned configuration, repeatable catalogue/forms, approvals, problem fields, release evidence | QMS scope/objectives, competence, customer feedback, nonconformity/corrective action, internal audit, management review, and process effectiveness |
| ISO 22301:2019 | Business continuity for critical services | Dependencies, release/rollback records, and operational procedures can contribute inputs | Business impact analysis, continuity strategy/plan, recovery objectives, exercises, alternate arrangements, crisis roles, and recovery evidence |
| ISO 31000:2018 | Risk-management principles and framework | Impact, urgency, risk context, change records, and risk-related evidence hooks | Risk criteria, ownership, assessment method, treatment, acceptance, monitoring, and governance |
| ISO/IEC 27701:2025 | Applicable when the service processes personally identifiable information | Access, documented workflows, privacy-sensitive operating guidance, and provider boundary can support a privacy programme | Privacy roles, lawful basis, notices, rights, records of processing, DPIAs, retention/deletion, processor/controller terms, breach response, and PII-specific controls |
| ITIL (Version 5), with the existing detailed mapping retained against ITIL 4 during transition | Practical operating model for digital product and service management | Supports service desk, incident, request, change enablement, problem, knowledge, service catalogue, asset/configuration, supplier, security, monitoring, and continual improvement practices | Practice owners, staffing, targets, prioritisation, escalation, governance, communications, measurement, experience, and continual review; ITIL certification is for people, not software |
Important product limitations
Orbit is a static SPA using Microsoft 365 services and deployment providers. Browser role guards are not the real authorisation boundary; tenant permissions and any approved authenticated server-side flow must be assessed. The portal does not automatically provide antivirus/DLP, an ISMS, QMS, SMS, CMDB, SLA breach management, customer-satisfaction measurement, complete audit retention, backup/restore, continuity, or a formal management-review record. These are configuration, supplier, process, or evidence responsibilities; use the implementation assurance checklist and the relevant operating handbooks to assign owners.
Applicability decision for ISO/IEC 27701:2025
Include ISO/IEC 27701:2025 in the client's privacy scope when Orbit or connected providers process personal data in the service—for example requester identity, contact details, ticket content, comments, approvals, attachments, audit/activity data, or lifecycle records. If the tenant excludes such processing or uses a different controlled privacy system, document the exclusion and rationale; do not imply that exclusion removes legal privacy obligations.
Review and evidence ownership
The client service manager owns this applicability decision and review cadence. The security/privacy owner owns the ISMS/PIMS scope, risk treatment, privacy records, and control evidence. The administrator owns configuration and deployment evidence. RME Solutions supplies product documentation and agreed support evidence within the support agreement. Review this statement when the standard edition, service boundary, provider, data scope, or product architecture changes.