DNV AS

Norway · www.dnv.com/veracity · 31 vendors

DNV AS is a global independent assurance and risk management company. It provides classification, technical advisory, and certification services across various industries, including maritime, energy, oil & gas, and healthcare. The company also offers digital solutions for data management, industry collaboration, and digital transformation through its Veracity platform, an independent industry cloud platform.

Resilience scores

Technology vendors

Services catalogue

7 services in catalogue across 2 categories; runs on 31 sub-vendors.

Insights

Last updated 2026-07-30 · revision 5

31 direct vendors, 292 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

DNV AS exhibits very high migration readiness, largely due to its advanced and cloud-native technology architecture and strong financial health. The internal tech stack, built around Microsoft Azure, Kubernetes, Docker, REST APIs, and CI/CD, is highly conducive to agile and efficient migrations. The company's focus on 'Cloud Data Platforms,' 'API-first Architecture,' and 'SaaS Delivery' for its products further underscores its modern, modular approach, which minimizes migration complexities. Strong and consistent revenue growth provides ample financial capacity to fund significant migration initiatives. DNV also demonstrates a mature understanding of data governance and residency requirements. Their established GDPR compliance framework, including the use of EU Standard Contractual Clauses and Binding Corporate Rules, indicates a structured approach to managing international data transfers, which is critical for planning migrations across different jurisdictions. Awareness of HIPAA requirements for healthcare data and sector-specific data localization for the Veracity platform further supports a well-informed migration strategy. The reported vendor geographic diversity across 7 countries suggests a potentially flexible vendor ecosystem, although the specific 'Vendor Lock-in Risk' remains unknown. The primary challenges for migration readiness lie in navigating the complex regulatory landscape, particularly ensuring continued compliance with HIPAA, NIS2, SOC2, and ISO 27001 during and after any migration. While the heavy reliance on Microsoft Azure is a strength for cloud-native operations, it could present a form of vendor lock-in if a multi-cloud strategy beyond Azure were desired. However, the use of open standards like Kubernetes and Docker within Azure significantly mitigates this risk by enhancing portability.

Compliance

6 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

DNV operates Veracity, a major cloud-based data platform serving maritime and energy industries with 300,000+ users and 50,000+ connected vessels. This digital infrastructure platform processes sensitive operational and business data for clients, making SOC2 compliance highly relevant for demonstrating security controls. While not legally mandated, SOC2 is often contractually required by enterprise clients and essential for maintaining trust in cloud services. Medium risk due to competitive and contractual implications.

Evidence: https://www.dnv.com/veracity, https://www.veracity.com/veracity-trust-center

NIS2 (source) — Assessment Required

DNV operates in multiple sectors that may fall under NIS2 scope including energy infrastructure (offshore wind, oil & gas, electric grid services), maritime transport, and digital infrastructure through their Veracity platform. As a large enterprise with 15,420+ employees and NOK 34,966 million revenue, they exceed size thresholds. However, specific determination requires detailed assessment of which services qualify as Essential or Important Entities under NIS2 definitions. The directive's broad scope and significant penalties make this medium risk pending clarification.

Evidence: https://www.dnv.com/services/utility-grid-cybersecurity-to-protect-critical-infrastructure/, https://www.dnv.com/services/?types=2724

ISAE 3000 (source) — Assessment Required

DNV is a major assurance and certification provider offering verification services across multiple industries. ISAE 3000 provides framework for assurance engagements other than audits or reviews of financial information. Given DNV's extensive assurance business (verification, certification, classification services), ISAE 3000 may be relevant for their assurance methodology and quality framework. However, this is primarily a professional standard for assurance providers rather than a compliance requirement, making it lower risk.

Evidence: https://www.dnv.com/services/?types=2689, https://www.dnv.com/about/

Financials

Three-year financials

Financial Resilience Score: 8/10

DNV AS demonstrates exceptional financial resilience underpinned by its unique foundation ownership structure. As a company wholly owned by the DNV Foundation (Stiftelsen Det Norske Veritas), a Norwegian non-profit entity, DNV faces no external shareholder pressure for dividends or short-term returns. This allows profits to be reinvested into the business and R&D, providing long-term financial stability and strategic independence that is rare among companies of its scale. The foundation structure also insulates DNV from hostile takeovers and capital market volatility. Revenue growth has been consistently strong and accelerating, with a CAGR of approximately 12% over 2021–2024, reaching a record NOK 34,966 million in 2024. This trajectory reflects broad-based demand across DNV's diversified service lines — maritime classification, energy transition advisory, business assurance, and digital solutions — across more than 100 countries. The recurring nature of classification and certification services (annual surveys, periodic renewals) provides meaningful revenue visibility and reduces volatility. Structural tailwinds from global decarbonisation, regulatory complexity (IMO, EU taxonomy, ESG reporting), and energy transition further support sustained demand. The company's 160-year operating history, deeply embedded accreditations with flag states and international regulatory bodies, and a global workforce of ~15,420 employees across 100+ countries create significant competitive moats and high customer switching costs. The Veracity digital platform and software portfolio (Phast, Synergi, Sesam) add higher-margin, scalable revenue streams. Low financial leverage, consistent headcount growth, and a diversified geographic and sector footprint further reinforce resilience. Key risks include currency exposure (NOK reporting vs. global USD/EUR/GBP revenues), cyclicality in the Energy Systems segment tied to oil and gas capex cycles, wage inflation in a tight market for technical specialists, and competitive pressure in the Business Assurance segment from Bureau Veritas, SGS, TÜV, and Intertek. The absence of public equity listing limits large-scale capital market access for acquisitions, and geopolitical fragmentation could affect global trade flows and maritime activity.

Key strengths: Foundation ownership structure eliminates shareholder dividend pressure and enables long-term reinvestment, Consistent double-digit revenue growth: CAGR ~12% over 2021–2024, reaching record NOK 34,966M in 2024, Highly diversified revenue across maritime, energy, assurance, digital, and life sciences sectors, Operations in 100+ countries providing geographic diversification and reduced concentration risk, Recurring revenue characteristics from classification and certification services (annual surveys, periodic renewals), 160+ year operating history with deeply embedded regulatory accreditations and high customer switching costs, Structural demand tailwinds from global energy transition, decarbonisation, and ESG regulatory complexity, Growing digital/software revenue (Veracity platform, Phast, Synergi, Sesam) providing higher-margin scalable streams, Low financial leverage consistent with conservative foundation-owned balance sheet, Strong global brand and trust built over 160 years in maritime and energy sectors

Risk factors: Currency exposure: NOK reporting currency vs. global revenues in USD, EUR, GBP and other currencies, Cyclicality in Energy Systems segment tied to oil and gas upstream capex cycles, Competitive pressure in Business Assurance segment from Bureau Veritas, SGS, TÜV, and Intertek, Talent and wage inflation risk in tight labour markets for engineers and technical specialists, Digital disruption risk requiring sustained R&D investment in competitive software/platform markets, Geopolitical risk affecting global trade flows and maritime activity (e.g., Russia wind-down post-2022), Regulatory/accreditation risk: loss of accreditation in a major jurisdiction would be material, No public equity listing limits access to capital markets for large-scale acquisitions, EBIT and equity figures not publicly disclosed in web summaries, limiting external financial transparency

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report