Supply chain security
Cybersecurity risk-management measures must include "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers".
Independent security assurance
Evidence foundA current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.
- SOC 2Vendor states SOC 2 on its trust centreas of 21 Sep 2026
- SOC 3 report"SOC 3 Report - 2026" on the trust centreas of 21 Sep 2026
- SOC 2 report"SOC 2 Report - 2026" on the trust centreas of 21 Sep 2026
Security testing and documentation
Evidence foundA penetration test report, a completed standard questionnaire (SIG, CAIQ, HECVAT) or security documentation shows how the supplier tests and runs its controls.
- Security policy or overview"Security Whitepaper" on the trust centreas of 21 Sep 2026
- Penetration testingPenetration testing: annualas of 21 Sep 2026
- Penetration test report"Penetration Test - 2026" on the trust centreas of 21 Sep 2026
- Penetration test report"Penetration Test - Current Remediation Status" on the trust centreas of 21 Sep 2026
- and 3 more