Doesn’t have to be a state secret. Just any Information to which access is restricted or it’d be dangerous or undesired if it were just handed out to the public.
Edit: Don’t reveal any secrets here. This is a public forum. Proceed with caution when answering this question.
ISO certificates for big companies don’t mean shit. They try to comply where they can but there’s always a few niche areas that aren’t actually covered the way they should be according to their certification. They get the cert anyway.