Supply chain security
Cybersecurity risk-management measures must include "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers".
Independent security assurance
Evidence foundA current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.
- SOC 2Vendor states SOC 2 Type 2 on its trust centreas of 21 Sep 2026
- ISO/IEC 27001Vendor states ISO/IEC 27001:2022 on its trust centreas of 21 Sep 2026
- ISO certificate"ISO/IEC 27001:2022; 27017:2015 certificate" on the trust centreas of 21 Sep 2026
- SOC 2 report"2025 SEON SOC 2 Type II Report" on the trust centreas of 21 Sep 2026
Security testing and documentation
Available on requestA penetration test report, a completed standard questionnaire (SIG, CAIQ, HECVAT) or security documentation shows how the supplier tests and runs its controls.
- Security policy or overview"Access Control Policy" on the trust centreas of 21 Sep 2026
- Security policy or overview"Cyber Security Policy" on the trust centreas of 21 Sep 2026
- Security policy or overview"Human Resources Security Policy" on the trust centreas of 21 Sep 2026
- Security policy or overview"Information Security Background Check and Screening Policy" on the trust centreas of 21 Sep 2026
- and 4 more