Supply chain security
Cybersecurity risk-management measures must include "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers".
Independent security assurance
No public evidenceA current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.
Security testing and documentation
Available on requestA penetration test report, a completed standard questionnaire (SIG, CAIQ, HECVAT) or security documentation shows how the supplier tests and runs its controls.
- Security policy or overview"Cryptographic Standard" on the trust centreas of 21 Sep 2026
- Security policy or overview"Information Security Policy" on the trust centreas of 21 Sep 2026
- Security policy or overview"Role Based Access Control Management Standard" on the trust centreas of 21 Sep 2026
- Security policy or overview"Vulnerability Management Standard" on the trust centreas of 21 Sep 2026