——  CONSULTING • GSMA SAS GUIDANCE

Expert guidance on
GSMA SAS standards

The GSMA security requirements for UICC and eUICC production sites, as well as eSIM profiles management platforms (Consumer, M2M and eIM SGP.32)

  • Designed by the GSMA, followed by all mobile operators in the world.

  • SAS-UP for the production, the data preparation and the personalisation of the UICC/eUICC.
  • SAS-SM for the SMDP platforms managing eSIM profiles (Consumer & M2M), as well as cryptographic keys.
  • Two-step accreditation (provisional certification and full certification), then regular renewal audits.
0%
First-time success in GSMA SAS audits for the customers we guide.

What is GSMA SAS?

The GSMA Security Accreditation Scheme (SAS) is a security certification program for organisations involved in the production, personalisation, and management of SIMs, eSIMs and related telecom identifiers. It is based on a rigorous standard covering the physical, logical, organisational and operational security of the sites and systems being assessed.

Accreditation is awarded after an on-site audit conducted by designated GSMA auditors (from two different companies), then maintained over time by renewal audits. The objective of these renewal audits is to ensure that the security level not only remains compliant with the standard, but also to verify that a continuous improvement programme is in place to improve security between audits.

Why is GSMA SAS certification so important?

Eligibility

Many MNOs require SAS accreditation from their SIM/eSIM suppliers.

Security of personalisation data

Protects the generation and distribution of keys and sensitive data.

Access to market

A pre-requisite to answer many international RFPs (Request for proposals).

Fraud prevention

Reduces the risks of theft, cloning and counterfeiting of identifiers.

How ACE Multipass advises you

Assess your level of readiness

  • Complete pre-audit

    With report writing and recommendations for each non-compliance (NC).

  • Identification of the main causes of failures

    Targeted verification of most frequent causes of failures during GSMA audits.

  • Security recommendations

    Specialised advice on the physical security, protection measures, and network security.

Build your compliance

  • Design of the security strategy

    Physical security, logical security, protection measures, etc.

  • Setup of the project team

    Setup of the compliance project team, with the definition of roles and responsibilities and training of stakeholders

  • Complete preparation on the FS.18 requirements

  • Proven document templates

    Don’t start with a blank page! Use our proven document templates. Internal audit checklist, roles and responsibilities matrices, appointment letters templates, acceptance of duties forms, procedures for cryptographic keys management, and more.

  • Security recommendations 

    Specialised advice on physical security, protective measures and secure network architectures.

Preparing the tricky points

  • Preparation of the most challenging requirements of the FS.18

    Internal audit (1.4), Risk management (1.2), Security strategy (10.4), Key ceremony and more.

  • Identification of the most common cases of failure, poor practices etc.

    Avoid common pitfalls that can compromise your audit thanks to targeted review of the most common reasons for failures in SAS audits.

  • Complete yearly internal audit review

    Focused on the FS.18 in order to answer the 1.4 requirement.

Passing the audit

  • Audit dry run

    Simulation of a real audit, with the writing of an audit report.

  • Preparing the visit of the auditors

    Requirements tracking sheet, with status overview (centralized documents and evidence, interviewee preparation, final practical advice…)

  • Support during the GSMA audit

  • Post-audit non-compliance resolution

Jeremie was our consultant to help and support us to gain our GSMA SAS SM certification. he was that kind of experts who has full confidence and powerful information to put you directly on the right way. Actually we were not to get this certification from 1st round with such great score without his support. He is very precise, accurate paying attention to every details to make sure you everything is clear understood and ready.

S.M, a customer in Africa region

Working with Jeremie over the past year has been a truly rewarding experience. His professionalism, deep expertise, and willingness to share knowledge made a real difference in achieving success. Beyond his technical skills, his discipline, reliability, and positive mindset fostered a strong sense of trust and collaboration.

Jeremie consistently brought clarity, structure, and calmness even in the most challenging moments, and his supportive approach made our daily work both productive and enjoyable. I truly appreciated not only his contributions, but also the strong team spirit and genuine friendship he brought along the way.

It was a real pleasure working together, and I sincerely hope we’ll have the opportunity to collaborate again in the future. I’m grateful to have gained not only a great colleague, but also a lifelong friend.

A.V, a customer in Middle East region

Expert guidance on
GSMA SAS