TUCSON, Ariz., August 20, 2026 – Critical Path Institute® (C-Path) today announced it has achieved certification to ISO/IEC 27001:2022, the internationally recognized standard for information security management systems (ISMS), awarded by the Johanson Group, LLP, following an independent audit.
C-Path’s pre-competitive collaboration model depends on trust. Regulators, biopharmaceutical companies, academic researchers, disease foundations and patient organizations share information with C-Path because they know it will be protected, and that protection enables the collaborative science needed to accelerate treatments for people who cannot wait.
“Trust is the foundation of everything we do at C-Path,” said President and COO Kristen Swingle, M.S. “Our partners share sensitive information with us because they know it will be protected, and this certification is an independent validation of that commitment.”
The certification confirms that C-Path has implemented a structured, risk-based ISMS supporting the confidentiality, integrity and availability of personal information, customer data, supplier information and C-Path internal data related to its collaborative, pre-competitive model and Data Collaboration Center (DCC).
Data is the foundation of everything C-Path builds. Through its DCC, C-Path curates, integrates and manages the pre-clinical and clinical data that power every clinical outcome assessment, biomarker, quantitative model and data standard it develops, the same tools behind 41 regulatory endorsements from FDA and EMA, roughly one-third of all such endorsements worldwide. Securing that data isn’t a separate function from C-Path’s scientific mission; it’s what makes fulfillment of the mission possible.
“Achieving this certification reflects the discipline C-Path has built into how it manages data, risk and partner trust,” said C-Path Chief Data and Technology Officer Chris Lunt. “It is a milestone, and it is also a baseline for continued improvement.”
ISO/IEC 27001 is the world’s best-known standard for ISMS. It defines requirements an ISMS must meet. The standard provides companies of any size and from all sectors of activity with guidance for establishing, implementing, maintaining and continually improving an information security management system. Conformity with ISO/IEC 27001 means that an organization or business has put in place a system to manage risks related to the security of data owned or handled by the company, and that this system respects all the best practices and principles enshrined in this International Standard.
The certificate lists an original registration date of June 25, 2026, and is valid through June 24, 2029, subject to ongoing annual surveillance audits.
About Critical Path Institute
Founded in 2005, as a public-private partnership in response to the FDA’s Critical Path Initiative, C-Path’s mission is to lead collaborations that advance better treatments for people worldwide. Globally recognized as a pioneer in accelerating drug development, C-Path has established numerous international consortia, programs and initiatives that currently include more than 1,600 scientists and representatives from government and regulatory agencies, academia, patient organizations, disease foundations and pharmaceutical and biotech companies. With dedicated team members located throughout the world, C-Path’s global headquarters is located in Tucson, Arizona, and C-Path’s Europe subsidiary is headquartered in Amsterdam, Netherlands. For more information, visit c-path.org.
Critical Path Institute is supported by the Food and Drug Administration (FDA) of the Department of Health and Human Services (HHS) and is 43% funded by the FDA/HHS, totaling $20,724,703, and 57% funded by non-government source(s), totaling $27,346,613. The contents are those of the author(s) and do not necessarily represent the official views of, nor an endorsement by, FDA/HHS or the U.S. Government.
Media Contacts:
Roxan Triolo Olivas
C-Path
520.954.1634
rolivas@c-path.org
Kissy Black
C-Path
615.310.1894
kblack@c-path.org