Chinese EN

SAS SM/eIM Audits

With the advent of the Internet of Things era, more and more embedded SIM cards (eUICC) are being used in fields such as smartphones, smartwatches, new energy vehicles, and smart water and electricity meters.

eSIM uses over the air download technology to download operator profile into the card and configure it for use.

SAS-SM (Subscription Management) is part of the GSMA’s Security Accreditation Scheme (SAS) specifically for entities involved in subscription management i.e. the platforms and services that generate, deliver, and manage operator profiles for eUICC / eSIM under Remote SIM Provisioning (RSP).


It ensures that SM-DP, SM-DP+, SM-SR, and SM-DS operators adhere to rigorous security standards in their infrastructure, processes, and operations.

The SAS-SM audit covers everything from physical security, personnel policies, system access, and key/certificate management, to data protection, IT operations, and supply chain controls — essentially all aspects critical to protecting subscriber profiles and preventing misuse or data breach.

Security Service Solution is a SAS implementer and offers a range of advisory and security services to get organizations ready for a SAS-SM audit leading to certification. We plan, scope, roadmap, help implement, assess, and get you ready for certification. We are with you until you are SAS SM certified.

Contact Us

why be SAS SM Certified?

  • Operator Requirements
    Operators explicitly require SAS SM certification as a necessary qualification for eSIM platforms or service providers.
  • Advantage
    SAS SM is a big deal. Your competitors may not be certified, but you are.Give you significant advantages in difficult decision-making processes.
  • Connectivity
    With the SAS SM certificate, your RSP platform will seamlessly connect different phones or terminals.
  • Culture
    Drives and promotes a security-first culture. SAS SM enables organization-wide security collaboration that extends beyond technical teams.

  • Assurance
    Provide assurance to your key stakeholders and use the SAS certification as a testament to your commitment to Sim card production security.

What We Do

  • We Build
  • We Implement
  • We Support
  • We get you certified

Our Process


1
Planning and Scoping
Understand the mission, purpose, and objective of the project, identify key stakeholders and resources, define priorities, establish a timeline, define the scope of the project, and establish expectations.
2
Risk Assessment and Gap Analysis
Conduct a risk assessment to determine which controls are required, and a gap analysis to determine whether required controls exist. Identify the current state, define the desired state, and develop a roadmap and action plan based on the results of both assessments.
3
Implemention
Implementation of required controls in accordance with the roadmap and action plan established in step 2. This includes addressing gaps, developing policies and procedures, training employees, and activating the SAS SM related system.
4
Operation and
This ensures the implementation process proceeds as intended. Control measures are monitored, recorded, tracked, and evidenced, then documented and tested. A further round of risk and gap assessment is conducted against the target state, accompanied by simulated audit activities.
5
Certification
The audit will be conducted in English by two auditors designated by GSMA, with DSS available on-site to provide support, interpretation, and assistance.
6
Maintenance
This step primarily focuses on the continuous improvement of SAS SM. For non-conformities (NCs) identified during the audit, the C-project conducts analysis, improvement, and corrective actions.
Nothing in place, something in place, doesn't matter. We can help guide you through it all. It's what we do.
Schedule a call

SAS Compliance Services

We can help you from start to finish, or if you need a hand in specific areas of your implementation journey, we can help there as well. For example, if you're implementing the SAS on your own but need a professional data center hosting service,engineering services, software system service, policy development, or other professional cybersecurity services, we have you covered. Here are just some of the services we provide to help you achieve your SAS certification goals.
  • SAS SM general advisory and consulting services
  • Planning, Scoping, Risk assessment, Gap assessment, Internal audit
  • SAS SM Implementation, policy development, incident response plan, documentation.
  • Cyber Risk Assessments, Penetration Testing, Vulnerability Assessments
  • 3rd party vendor assessment, training and awareness programs
  • An entire suite of services to help achieve or maintain compliance

Ready for help?

We know what you're looking for and we know how to get you there. That's because, from a business perspective, we understand where you need to be. Our team has been working in the smart card industry for 20 years, and our consultants have transitioned from IT technology roles to management roles. Our strong IT and technology background, blended with years of industry experience, make our consultant team one of the best in the industry.
Contact Us