Supply chain security
Cybersecurity risk-management measures must include "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers".
Independent security assurance
Evidence foundA current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.
- SOC 2Vendor states SOC 2 on its trust centreas of 21 Sep 2026
- SOC 2 report"Airship Group 2026 SOC 2 Type 2" on the trust centreas of 21 Sep 2026
Security testing and documentation
Evidence foundA penetration test report, a completed standard questionnaire (SIG, CAIQ, HECVAT) or security documentation shows how the supplier tests and runs its controls.
- Security policy or overview"Access Control, Logical Policy" on the trust centreas of 21 Sep 2026
- Penetration testingPenetration testing: annualas of 21 Sep 2026
- Penetration test report"2026 EU External Penetration Test.pdf" on the trust centreas of 21 Sep 2026
- Penetration test report"2026 EU Internal Penetration Test.pdf" on the trust centreas of 21 Sep 2026
- and 9 more