SureSIM logo white/green
See It In Action
// HR & People Risk

ISO 31030 compliance: the connectivity foundation of modern travel risk management.

ISO 31030:2021 sets out how organisations should manage the risks their people face when travelling for work. Communications, reachability and traveller awareness sit at the heart of the standard’s recommendations. A practical guide to where enterprise connectivity fits in an ISO 31030-aligned programme, and what it doesn’t cover.

// ON THIS PAGE

For HR, people risk and travel security teams, ISO 31030 has rapidly become the reference framework for demonstrating that an organisation is taking its duty of care to travelling employees seriously. Published by ISO in 2021 and widely adopted across multinational enterprises, the standard sets out how travel risk should be governed, assessed, prepared for and responded to across the full trip lifecycle. A significant portion of its recommendations concern communications and connectivity – because without a reliable way for employees to reach support, and for employers to reach employees, most of the other controls break down.

What ISO 31030 actually asks of employers

ISO 31030:2021, formally titled Travel risk management – Guidance for organizations, provides a structured framework for managing the risks workers face when travelling on behalf of an employer. Unlike ISO 27001 or ISO 9001, it is a guidance standard rather than a certifiable management system. Organisations align their travel risk programmes to it and use it as evidence of due diligence, but there is no formal certification body. In practice, “ISO 31030 compliance” refers to an organisation demonstrating that its travel risk programme is designed and operated in line with the standard’s recommendations.

The standard covers the full lifecycle of a business trip: policy and governance, risk assessment by destination, traveller and activity, pre-travel preparation, in-transit and at-destination support, incident response, and post-trip review. Across all of these, it emphasises clear communication with travellers, the ability to locate and reach them, and the infrastructure that supports both routine and emergency contact.

Important distinction
ISO 31030 cannot be formally certified against. It is a guidance document. When organisations describe themselves as “ISO 31030 compliant” they typically mean their travel risk programme has been designed, documented and operated in alignment with the standard’s recommendations – evidenced through internal audit and programme documentation rather than third-party certification.

Where connectivity fits in an ISO 31030-aligned programme

Travel risk management is a layered discipline. A mature programme typically involves a travel risk intelligence provider for destination advisories and threat monitoring, a medical and security assistance provider for clinical support and evacuation capability, a travel booking and tracking system, pre-trip briefings and training, crisis response and incident management protocols, and – underpinning all of the above – a reliable connectivity infrastructure.

Connectivity is not the travel risk programme. It is the layer that makes the other controls usable. A crisis response protocol that relies on reaching a traveller in Lagos or Manila only works if that traveller has a working data connection on a network they trust. A medical assistance line of care only works if the traveller can reach it. Country arrival briefings only reach people who are contactable at point of arrival. Itinerary verification only works if the organisation can confirm travellers are where they are supposed to be.

Traditional local-carrier roaming arrangements are poorly suited to this role. They offer limited visibility, inconsistent coverage, high and unpredictable costs that trigger data bars at the worst possible moments, and no centralised view of who is connected and where. For organisations building travel risk programmes aligned to ISO 31030, that gap is where enterprise eSIM platforms like SureSIM fit.

200+

Destinations covered under a single deployment

450+

Local carrier networks accessible via one eSIM

4 / 4

UK networks accessible unsteered on every device

How SureSIM supports ISO 31030-aligned programmes

SureSIM is not a travel risk management platform – it is the connectivity layer that supports one. The capabilities below map directly to elements of the standard.
Communications continuity
Multi-network data connectivity in 200+ destinations via 450+ local carrier partnerships. In most countries travellers have access to two or three networks on a single eSIM – if one local network has poor coverage, the device can use another. In the UK, all four networks are accessible unsteered, meaning no network preference is applied.
Traveller awareness
With appropriate end-user consent, the platform surfaces cell-tower level location awareness – identifying the approximate area a traveller is in, typically at town or city suburb level. This is not GPS tracking. It gives travel security teams a broad confirmation that travellers are in the country and region expected.
Country arrival notifications
Configurable messages triggered when a traveller arrives in a new country – delivering country-specific safety briefings, emergency contact numbers, or local support information at the moment the traveller is most likely to need it. Triggers can be set by country or by SureSIM zone.
Pre-travel preparation
Because SureSIM is a single global service, the eSIM can be activated and fully tested on the user’s device at home before departure. A live data session confirms the connection, plan and provisioning. This eliminates the common failure mode of a traveller discovering connectivity problems only after arrival.
In-country support 24/7/365
Enterprise Plan customers have round-the-clock access to the SureSIM Helpdesk for network faults, service issues, activation problems, and profile changes. This removes the dependency on local carrier support at odd hours in unfamiliar languages.
Spend
protection
Traditional roaming tariffs often trigger data bars once users pass a threshold, leaving travellers disconnected mid-trip. SureSIM’s usage-based model and near real-time alerts (typically 10-minute data refresh) allow cost to be managed without cutting off access at the wrong moment.
Audit trail for governance
Every provisioning event, connection change and profile adjustment is recorded against a known user on a known device. Usage history and country-level activity are available in the portal – supporting the review and continuous improvement elements of the standard.

What SureSIM does not cover

A credible ISO 31030-aligned programme covers a wide range of controls, many of which SureSIM does not address. HR and travel security leads should understand where connectivity ends and other providers begin.
SureSIM Scope
  • Communications continuity for travellers
  • Cell-tower level location awareness
  • Country arrival notifications
  • Pre-travel testing and validation
  • In-country connectivity support 24/7
  • Audit trail and usage visibility
Outside SureSIM scope
  • Country risk intelligence & advisories
  • Medical assistance & evacuation
  • Security escort & protective services
  • Pre-travel training content
  • Crisis response & incident investigation
  • Policy development consultancy

Country risk intelligence is the domain of providers such as Riskline, Crisis24, Control Risks and International SOS. Medical assistance and evacuation requires a dedicated provider like International SOS, Global Rescue or SOS MedAire. SureSIM is the connectivity layer. It sits alongside, not instead of, your travel risk intelligence provider, your medical assistance provider, and your crisis response protocols. Where it adds most value is in making those other layers actually work in the field.

Practical rollout for HR and travel risk teams

Implementation typically runs alongside, or shortly after, the IT rollout. The HR side of the engagement is distinct from the technical configuration work and usually covers the following.
  1. We review your mobile estate, users in scope and what success looks like – including traveller populations, high-frequency destinations, and the existing travel risk framework the programme sits within.
  2. Agree the location awareness model with Legal, Works Council and employee representatives. Location awareness requires opt-in and clear employee communication. For organisations with European operations, GDPR and Works Council considerations shape what is collected and retained.
  3. Define country arrival messaging. Which destinations get a notification, what the message says, and where it routes travellers for in-country support.
  4. Coordinate deployment with IT. The technical provisioning is handled on the IT side; HR focuses on communications, consent and programme alignment.
  5. Review and iterate. Usage data, support ticket trends and incident reports feed into the continuous improvement requirement of the standard.
The SureSIM Proof of Concept Guarantee provides a three-month no-penalty exit during initial deployment. For HR teams whose procurement process requires evidence before committing, the PoC period gives that evidence without the financial risk.

Frequently asked questions

Is ISO 31030 compliance mandatory?

No. ISO 31030 is a guidance standard and there is no legal requirement to align with it. However, increasing numbers of organisations treat alignment as the benchmark for demonstrating duty of care to travelling employees, and procurement processes at multinational clients now routinely ask suppliers whether their travel risk programmes are aligned to the standard.

Can an organisation be certified against ISO 31030?

Not formally. Unlike ISO 27001 or ISO 9001, ISO 31030 is not a certifiable management system standard. Organisations demonstrate alignment through internal audit, programme documentation, and evidence of operational practice. Some consultancies offer assessment services against the standard, but these are not equivalent to ISO certification.

Does SureSIM track employees' locations?

SureSIM can provide cell-tower level location awareness where it is enabled. This is not GPS tracking. It provides the approximate area a traveller is in – typically at town or city suburb level – and is only active with appropriate end-user consent and employer permissions. The feature can be switched off per user or per population.

Do employees need to give consent to location awareness?

Yes. Location awareness is an opt-in capability and requires clear communication to employees about what is collected, how it is used, and who can see it. GDPR and local Works Council requirements apply in most European jurisdictions, and consent models should be reviewed with Legal and HR before rollout.

Can SureSIM integrate with our travel risk management platform?

Integrations with travel risk management platforms are possible through API. 

How does SureSIM support lone workers in the UK?

For UK lone workers, SureSIM provides backup connectivity – sitting on the device as a second line that can be used when the primary carrier has no signal. All four UK networks are accessible unsteered. For the specific use case of UK field workers, engineers and community care, see our lone worker connectivity page.

What about data residency and GDPR?

SureSIM is operated by Utelize Communications Limited, a UK company. The platform is hosted on Microsoft Azure. Utelize is ISO 27001, ISO 9001, ISO 14001 and Cyber Essentials Plus accredited. Detailed data processing documentation is available as part of procurement due diligence.

What happens if a traveller exceeds their data allowance?

Data outside the inclusive allowance is charged at £0.01 per MB under the Enterprise Plan. Data used in Premium Zone destinations is charged separately at £0.50 per MB and is not included in the shared allowance – Premium Zone access can be barred or capped at a connection level to prevent unexpected charges. Cost caps and alerts can be configured across all zones to support spend control. 

// Duty of care conversation

Talk to a people risk specialist

30-minute call with someone who has supported HR and travel security teams building ISO 31030-aligned programmes. 

Book a Call
// Where SureSIM fits

Connectivity layer. SureSIM complements travel risk intelligence providers and medical assistance providers, it does not replace them.

// Related Reading
OTA eSIM deployment at enterprise scale
Eliminating mobile roaming bill shock in enterprise
Pricing overview
// Referenced products
SureSIM Global →
SureSIM IoT →