SAS UP Certification

SAS UP (Security Accreditation Scheme for UICC Production) certification is a security certification program developed by the Global System for Mobile Communications Association (GSMA) for the production of SIM cards (UICC/eUICC). The program requires SIM card manufacturers to undergo on-site audits by professional auditing firms to demonstrate that their production sites comply with the requirements of the GSMA SAS-UP standard and its supporting documents.

Thanks to the GSMA certification team's decade long high standards and demanding on-site audits, SAS UP is widely recognized as one of the strictest and most authoritative security audit standards in the smart card industry worldwide. It has the highest audit difficulty and the highest certificate value.

SAS-UP certification covers multiple aspects such as production security, physical security, network security, personnel security, data security, and logistics security, ensuring the security of SIM card throughout the entire production process and providing a solid guarantee for the information security of operators/users.

Security Service Solution is a SAS implementer and offers a range of advisory and security services to get organizations ready for a SAS UP audit leading to certification. We plan, scope, roadmap, help implement, assess, and get you ready for certification. We are with you until you are SAS UP certified.

why be SAS UP Certified?

There are many great reasons to adopt SAS UP as part of your business process, and there are greater reasons why it is a global standard used across smart card industrys.

Operator Requirements

The vast majority of global operators explicitly require SAS UP certification as one of the necessary qualifications for chip/card supply to participate in bidding.
Advantage

SAS UP is a big deal. Your competitors may not be certified, but you are.Give you significant advantages in difficult decision-making processes.
Factory Audit

With the SAS UP certificate, many customers will trust your company's security system and skip the factory audit process directly.
Culture

Drives and promotes a security-first culture. SAS UP enables organization-wide security collaboration that extends beyond technical teams.
Assurance

Provide assurance to your key stakeholders and use the SAS certification as a testament to your commitment to Sim card production security.

What We Do

We Build
We Implement
We Support
We get you certified

Our Process

Planning and Scoping

Understand the mission, purpose, and objective of the project, identify key stakeholders and resources, define priorities, establish a timeline, define the scope of the project, and establish expectations.

Risk Assessment and Gap Analysis

Conduct a risk assessment to determine which controls are required, and a gap analysis to determine whether required controls exist. Identify the current state, define the desired state, and develop a roadmap and action plan based on the results of both assessments.

Implemention

Implementation of required controls in accordance with the roadmap and action plan established in step 2. This includes addressing gaps, developing policies and procedures, training employees, and activating the SAS UP related system.

Operation and

This ensures the implementation process proceeds as intended. Control measures are monitored, recorded, tracked, and evidenced, then documented and tested. A further round of risk and gap assessment is conducted against the target state, accompanied by simulated audit activities.

Certification

The audit will be conducted in English by two auditors designated by GSMA, with DSS available on-site to provide support, interpretation, and assistance.

Maintenance

This step primarily focuses on the continuous improvement of SAS-UP. For non-conformities (NCs) identified during the audit, the C-project conducts analysis, improvement, and corrective actions.

SAS Compliance Services

We can help you from start to finish, or if you need a hand in specific areas of your implementation journey, we can help there as well. For example, if you're implementing the SAS on your own but need a professional data center hosting service,engineering services, software system service, policy development, or other professional cybersecurity services, we have you covered. Here are just some of the services we provide to help you achieve your SAS certification goals.

SAS UP general advisory and consulting services
Planning, Scoping, Risk assessment, Gap assessment, Internal audit
SAS UP Implementation, policy development, incident response plan, documentation.
Cyber Risk Assessments, Penetration Testing, Vulnerability Assessments
3rd party vendor assessment, training and awareness programs
An entire suite of services to help achieve or maintain compliance

Ready for help?

We know what you're looking for and we know how to get you there. That's because, from a business perspective, we understand where you need to be. Our team has been working in the smart card industry for 20 years, and our consultants have transitioned from IT technology roles to management roles. Our strong IT and technology background, blended with years of industry experience, make our consultant team one of the best in the industry.