What Security and Compliance Features Does Concrete CMS Offer?

Concrete CMS ships with ISO 27001 certified security out of the box, and its hosting options support SOC 2 and HIPAA compliance. That combination makes it a reasonable shortlist candidate for organizations that need documented security controls and a compliance path, not just a website builder. The specifics below come from Concrete CMS's own product pages; treat vendor claims as a starting point for your own due diligence rather than a substitute for it.

Security and compliance at a glance

Area	What Concrete CMS states	What it means for you
Baseline security	Out-of-the-box ISO 27001 certified security	A recognized information-security management standard is claimed for the product as delivered, so you are not starting from a blank slate
Hosting compliance	SOC 2 and HIPAA compliant hosting	Relevant if you handle customer data (SOC 2) or protected health information (HIPAA) and need a hosting environment that supports those obligations
High-assurance reference	Chosen by the U.S. Army for stringent security needs	A public-sector reference point for teams evaluating whether the platform can meet demanding requirements
Tailored hosting	Hosting tailored to meet specific organizational compliance	Suggests compliance needs can be scoped per organization rather than assumed to be one-size-fits-all

What "ISO 27001 certified security" actually covers

ISO 27001 is an information security management standard. When a vendor says security is "ISO 27001 certified," the useful question is what scope the certification covers — the product, the hosting environment, the vendor's internal processes, or all three. Concrete CMS presents it as an out-of-the-box property of the platform, which is a stronger claim than "we follow security best practices," but you should confirm the certification scope and current certificate status directly with the vendor before relying on it in a procurement decision.

When SOC 2 and HIPAA hosting matter

These two are hosting-level compliance signals, and they apply to different situations:

SOC 2 — relevant when you need evidence that a service organization controls its systems around security, availability, and confidentiality. Common requirement for B2B SaaS vendors and their customers.
HIPAA — relevant only if you create, receive, store, or transmit protected health information in the US. If you do, confirm that a Business Associate Agreement (BAA) is available, since compliant hosting alone is not the whole obligation.

If neither applies to your data, these features are nice-to-have rather than deciding factors.

The U.S. Army reference and what it does (and doesn't) prove

Concrete CMS cites selection by the U.S. Army for stringent security needs. This is a meaningful signal because public-sector deployments typically involve formal security review. It does not, however, transfer automatically to your environment: your threat model, data classification, and regulatory obligations are your own. Use it as evidence that the platform can pass demanding review, then run your own assessment.

Questions to ask before you commit

What is the exact scope and expiry date of the ISO 27001 certification?
Which hosting providers deliver the SOC 2 and HIPAA compliant options, and is a BAA available?
What does "tailored hosting to meet specific organizational compliance" include, and at what cost?
How are security patches delivered, and on what cadence?
Can you provide the latest penetration test summary or security whitepaper?

Bottom line

Concrete CMS positions itself as a CMS with security and compliance built in rather than bolted on: ISO 27001 certified security as delivered, SOC 2 and HIPAA compliant hosting options, a U.S. Army deployment reference, and hosting that can be tailored to organizational requirements. If your organization needs a documented compliance story, it belongs on your shortlist — but verify certification scope, hosting specifics, and BAA availability with the vendor before treating any of it as settled.