ISO 27001 Annex A evidence
合利宝是中国大陆地区领先的第三方支付公司，拥有中国人民银行颁发的全业务《支付业务许可证》，业务类型包含储值账户运营Ⅰ类、支付交易处理Ⅰ类，同时具有跨境人民币业务资质，覆盖全国，是国内领先的第三方支付机构。
ISO/IEC 27001:2022, Annex A controls 5.19 to 5.23
4 provisions of ISO 27001 Annex A reach the vendors you rely on. For each, the public evidence from Guangzhou Helibao Payment Technology that may support it, with its date and source.
Processes are defined and implemented to manage the information security risks associated with the use of suppliers’ products or services.
Independent security assurance
No public evidenceA current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.
Relevant information security requirements are established and agreed with each supplier, based on the type of relationship.
Data processing agreement
No public evidenceThe DPA is where processing instructions, confidentiality, security, sub-processing and audit rights are written down.
Processes are defined to manage the information security risks associated with the ICT products and services supply chain.
Published subprocessor list
No public evidenceA current list of subprocessors, with purpose and location, is how a customer knows who else touches its data.
Processes for acquiring, using, managing and exiting cloud services are established in line with the organisation’s information security requirements.
Cloud security assurance
No public evidenceISO/IEC 27017 and 27018 and the CSA STAR registry cover controls specific to cloud services.
Independent security assurance
No public evidenceA current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.
CertReports does not decide that. It shows the public evidence that may support each ISO 27001 Annex A requirement that reaches vendors: no requirement has public evidence yet, and nothing public was found for information security in supplier relationships, security within supplier agreements, the ict supply chain, information security for cloud services.
Request independent security assurance, data processing agreement, published subprocessor list, cloud security assurance, and confirm each is current.
Solomon Amos · 23 Oct 2026 · 9 min read
Solomon Amos · 1 Sep 2026 · 10 min read
This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.
Requirements reviewed 21 Sep 2026. The vendor lists the evidence on its trust centre behind a request or NDA; ask for it.