The organisation operates an audited framework dedicated to governing the lifecycle and risks of artificial intelligence systems

Enterprise administrators can enable or disable AI features at the organization or team level, enacting granular usage policies in line with internal governance needs.

Comprehensive audit logs track all AI-related interactions and activities, providing an immutable record for monitoring, compliance, and policy enforcement.

Certification scope encompasses production and continuous improvement of AI-enabled SaaS across EMEA, USA and other key regions, ensuring consistent controls worldwide

Accredited auditors conduct periodic surveillance to confirm the AI management system continues to meet ISO requirements over time

Customer data is excluded from training AI models, and only opted-in, non-enterprise user data may be used for AI improvement, preserving privacy and regulatory compliance.

Automated prompt redaction and customizable output moderation help protect against prompt injection, sensitive data leakage, and harmful content generation.

AI systems development and operation are externally validated according to ISO/IEC 42001, demonstrating responsible design, risk management, and ethical safeguards.

Risks to confidentiality, integrity and availability are identified and scored using ISO and NIST methodologies, guiding mitigation plans

A formal risk management process, reviewed at least annually, identifies, evaluates, and drives treatment of risks according to regulatory and customer requirements, ensuring the risk posture adapts to new threats.

Comprehensive security policies aligned to ISO 27001:2022 and SOC 2 are maintained, reviewed, approved, and distributed at least annually to all employees and relevant third parties, ensuring ongoing relevance and employee awareness.

Risk registers are revisited twice a year to capture changes in the threat landscape and business operations

Documented procedures outline roles, communication and evidence handling to ensure consistent response to security events

A documented incident response plan details structured procedures for detection, reporting, containment, communication, and post-incident analysis to minimize impact and drive continuous improvement.

Regular internal control assessments and audits validate that controls are effectively deployed, operational, and improved as necessary, providing assurance to management and clients.

Every significant incident triggers a lessons-learned review, driving continual control improvements

An active policy transfers residual financial risk from severe cyber events, protecting both the company and its customers

Key information security roles and responsibilities are formally assigned, with management oversight, board-level involvement, and documented accountability for policy enforcement and control operation.

All workforce and production accounts must use a second factor via the identity platform, significantly reducing the risk of credential compromise

Multi-factor authentication is enforced for all user and administrator accounts across production and corporate environments, reducing the risk of unauthorized access due to credential compromise.

Permissions are assigned through an RBAC matrix that maps job roles to least-privilege groups, ensuring users receive only the access they need

SAML-based SSO through the corporate identity provider streamlines account lifecycle management and enforces centralised security policies

Teleport grants time-bound production access only after approval, limiting standing administrator privileges and improving accountability

User and administrator access privileges are reviewed at least biannually to validate appropriateness and minimize the risk of privilege creep.

Access rights for all users are re-certified at least twice a year to verify continued business need and remove excess privileges

Accounts lock after multiple failed login attempts, while idle sessions automatically expire after a defined period, limiting brute-force attacks and reducing exposure from unattended sessions.

All data stores and backups are secured with cloud-native encryption keys managed by the provider, protecting information from unauthorised reading of physical media

Company-wide data classification schemes and policies establish protection requirements for each data category, enforcing handling rules and access restrictions based on sensitivity.

TLS 1.2 or higher is enforced at every network edge, ensuring data cannot be intercepted or tampered with while moving between clients and services

Sensitive data is encrypted both at rest and during transmission using industry-standard protocols and algorithms, ensuring confidentiality and integrity across all storage and transfer channels.

A documented policy assigns sensitivity levels and required protections to each data type, enabling consistent handling across the organisation

Enterprise customers can leverage encryption key management options, including bring-your-own-key capabilities, to maintain autonomy and visibility over their encrypted data.

Daily encrypted backups with four-hour snapshots are replicated to a secondary region, combining confidentiality with resilience

Data retention periods and secure disposal procedures are defined and enforced, ensuring data is not retained longer than necessary and is irretrievably destroyed when no longer required.

Data privacy and protection measures are embedded into product design, system development, and operational workflows to meet regulatory and compliance standards such as GDPR and CCPA.

Customer content is purged 30 days after contract termination, aligning with privacy commitments and minimising residual risk

A managed WAF inspects all inbound traffic and blocks malicious requests before they reach application workloads

Primary systems and backups are hosted in leading public cloud environments with physical security validation, multiple regions for redundancy, and operational control over logical and network security.

Production, development and corporate networks are isolated with default-deny security groups, limiting lateral movement

Critical environments are segmented and protected by network firewalls, security groups, and allow-by-exception rules, minimizing the risk of lateral movement and unauthorized access.

A web application firewall inspects all inbound traffic to protect web applications from exploits and denial-of-service attacks, significantly strengthening perimeter defenses.

Systems are provisioned through scripted templates that apply industry-standard hardening baselines consistently and prevent drift

Cloud firewalls start from a deny-all rule set and allow only approved ports and protocols, reducing the exposed attack surface

Automated vulnerability scanning, internal and third-party penetration testing, and patch deployment processes help identify and address security flaws before they can be exploited.

Independent testers assess the environment each year, and identified issues are tracked to remediation, validating real-world security posture

Comprehensive network and host-based intrusion detection systems continuously monitor for anomalies, triggering alerts, and enabling rapid incident response.

A documented SDLC integrates security checkpoints, code review, static and dynamic analysis, and vulnerability testing into every phase of software development and deployment.

Documented standards guide design, coding, testing and deployment activities to embed security throughout the software lifecycle

Production systems are strictly segregated from development and test environments, reducing attack surface and preventing accidental introduction of code or data leakage.

Automated SAST, secret scanning and dependency checks run in the CI pipeline to catch issues before code reaches production

All pull requests require approval from qualified reviewers, ensuring that security considerations are evaluated before merge

Automated tools scan for vulnerable dependencies, hardcoded secrets, and misconfigurations, alerting teams prior to integration and production roll-out.

Annual assessments by independent specialists identify and validate application-layer weaknesses under real-world conditions

Accredited independent security firms conduct annual penetration testing for all production-facing systems, verifying resilience against real-world attack scenarios.

Continuous crowdsourced testing rewards researchers for responsibly disclosing vulnerabilities, amplifying security coverage

A public bug bounty program incentivizes external researchers to report security vulnerabilities, complementing internal testing and driving continuous improvement.

A formal, tested disaster recovery policy defines roles, responsibilities, and step-by-step procedures for restoring systems and data with minimal downtime and data loss.

The plan sets an eight-hour recovery time and four-hour recovery point for critical systems, giving customers clear availability guarantees

Scripts create daily full backups and four-hour incremental snapshots for core datastores, preserving recent copies for rapid restoration

Critical data is backed up automatically, encrypted, and replicated to geographically separate data centers, with retention policies and quarterly restoration exercises.

Full failover exercises are conducted each year, with results documented and improvements tracked, proving the ability to meet recovery objectives

Clear RTOs and RPOs for primary and secondary sites are documented and measured to meet contractual and operational requirements.

Data is continuously replicated to secondary cloud regions so that services can be restored even if a primary location becomes unavailable

Contractual SLA commits to high availability and includes financial remedies, demonstrating confidence in operational resilience

The business continuity program encompasses planning, monitoring, regular testing, and continuous improvement to maintain service under adverse conditions.

All new hires undergo identity, employment, education and criminal screening before receiving system access, lowering insider risk

Pre-employment background screening covers employment, education, identity, and, where permitted by law, criminal history to reduce hiring risk.

All personnel complete mandatory security and privacy training at onboarding and annually, covering threats, data handling, phishing, malware, and corporate policies.

Employees complete mandatory information-security courses during onboarding and annually thereafter to reinforce best practices

Developers receive annual education aligned with OWASP guidelines to reduce the introduction of software vulnerabilities

Employees must sign and agree to acceptable use, confidentiality, and security policy acknowledgments as a condition of employment and system access.

Automated offboarding workflows ensure timely revocation of system and facility access, minimizing the risk of orphaned accounts or data leakage.

Documented sanctions for policy violations hold individuals accountable and deter risky behaviour

Staff are encouraged to pursue recognised security credentials, supporting continuous improvement of organisational expertise

Violations of security or acceptable use policies are investigated and subject to documented disciplinary actions up to and including termination or referral to authorities.

Office entry points require card swipes or fingerprint scans, ensuring only authorised personnel enter sensitive areas

Office facilities are secured with badge access, visitor badges, and registration logs, while entry to sensitive areas is reviewed quarterly and limited to authorized personnel.

Security cameras monitor entrances, exits, and sensitive areas, with footage retained for a minimum of 90 days to support investigations.

Security cameras monitor entrances and critical rooms with footage retained for at least 90 days to support investigations

Guests must pre-register, sign in, wear badges and remain escorted, creating an auditable trail of facility access

Sensitive media and devices are securely stored and destructed according to policy, and all portable storage is required to use encryption and access controls.

Data-relevant office floors include automatic sprinklers and detectors, reducing the impact of fire on operations

Critical offices are protected by fire detection, suppression systems, and controlled environments to mitigate physical threats and maintain operational uptime.

Locked shred bins and third-party destruction services ensure physical documents and retired devices are safely destroyed

An independent auditor confirms the design and operating effectiveness of security, availability and confidentiality controls over a year-long period, giving customers third-party assurance of the service’s control environment

A certified and regularly audited information security management system (ISMS) covers all relevant operations, systems, and processes organization-wide.

A formal information security management system is certified by an accredited body, demonstrating systematic risk management and continual improvement of security controls

Annual independent assurance reports attest to the design and operating effectiveness of controls against recognized trust criteria for security, availability, and confidentiality.

The artificial intelligence management system is certified to the new ISO standard, evidencing structured governance and risk controls over AI-enabled services

Security and privacy programs are designed and operated to meet regulatory obligations and client requirements in multiple jurisdictions.

A formal program evaluates, contracts, and reviews vendors for compliance with security, privacy, and regulatory requirements before and during the relationship.

Certification to the UK government-backed scheme shows foundational cyber hygiene measures have been independently assessed and found effective

Management performs scheduled assessments of key controls between external audits to ensure they remain properly designed and functioning

A published privacy policy details personal data processing, third-party sharing, and user controls, enabling customers to comply with modern privacy regulations.

Security, compliance and financial standing are reviewed before any new provider is approved, reducing supply-chain risk

Critical vendors are screened prior to engagement for security controls, regulatory adherence, financial stability, and service fit, mitigating third-party risk.

Key suppliers are re-assessed each year, including review of their SOC 2 or ISO reports, to verify continued alignment with requirements

Vendors are reviewed annually for ongoing compliance, with up-to-date documentation (e.g., SOC reports, ISO certificates) and risk reassessment.

Data processing addenda and non-disclosure agreements require vendors to meet stringent data protection and confidentiality commitments.

All vendors sign legally binding NDAs before sensitive information is shared, protecting proprietary and customer data

A maintained register records purpose, risk classification and contract status for every third-party relationship

A list of authorized third-party data processors is maintained and updated, with customer notification and opt-out procedures for new subprocessors.

Service agreements define roles, responsibilities, SLAs and data-protection clauses to enforce expected control levels

Jamf enforces configuration baselines, disk encryption and approved software on all corporate laptops and mobile devices

All company-owned and authorized endpoints are inventoried and managed, with policies enforced through mobile device management solutions.

FileVault ensures that data on employee devices remains unreadable if hardware is lost or stolen

Mandatory endpoint protection software with automatic updates, periodic scans, and prohibited removable media reduces malware risk and meets compliance standards.

Laptop and mobile device disk encryption is enforced at the hardware or OS level to prevent data exposure in case of loss or theft.

SentinelOne provides real-time behaviour analysis, automatic quarantine and regular signature updates across servers and workstations

Automated policies deploy OS and security patches within defined timelines, closing vulnerabilities promptly

Endpoints are configured for automatic screen lock, and staff are educated to clear workspaces of sensitive information when unattended.

USB access is blocked or limited to read-only, mitigating the risks of malware introduction and data exfiltration

All infrastructure modifications follow pull-request workflows with documented purpose, approvals and automated testing

All infrastructure and application changes must be formally requested, assessed for risk, tested in pre-production, and approved before implementation.

Deployment pipelines leverage infrastructure as code for consistent, auditable, and rapid system provisioning and rollback, limiting human error.

Deployment pipelines include predefined rollback steps, enabling rapid recovery if a change negatively impacts the service

Automated testing and defined rollback procedures are prerequisites for production changes, ensuring swift remediation in case of issues.

Development, staging and production are isolated to prevent untested code from affecting live customer data

Code reviews and separation of developer and approver roles prevent unauthorized or untested changes from reaching critical environments.

Hardening standards and Terraform templates are revisited throughout the year to incorporate evolving best practices

Unit, integration and regression tests are mandated for every change, decreasing the likelihood of defects reaching production

System and security logs are collected in searchable storage for at least one year, supporting investigations and compliance evidence

Critical system and security event logs are collected centrally, retained according to policy, and protected from tampering, supporting investigations and compliance.

A dedicated team reviews alerts around the clock, triages incidents and coordinates response actions to minimise impact

Automated security monitoring systems and real-time alerts enable rapid response to suspicious activity and potential breaches.

All privileged administrative actions and critical system events are logged and monitored, with alerting on anomalous activities.

Network and host-based intrusion detection systems analyse traffic and endpoints for malicious behaviour, providing layered visibility

Cloud-native tooling tracks critical file changes across all systems and raises alerts on unauthorised modifications

Event data is integrated into SIEM solutions for advanced correlation, analysis, and case management by security teams.

OpsGenie and incident.io create actionable tickets for anomalous events, ensuring timely escalation to the appropriate responders