Acceptance criteria
Current evidence for SOC 2 Type II and ISO 27001.
Why it matters
Standard assurance should be evidenced, not assumed.
How to verify
Current SOC 2 Type II report, ISO 27001 certificate and privacy terms are provided.
OWASP adoption context
Supplier assurance supports procurement and oversight across adoption tiers, with the buyer’s own scope and use determining the relevant evidence.
Framework mappings
- NIST CSF 2.0 GV.SC-06, GV.SC-07NIST AI RMF GOVERN 6.1, MANAGE 3.1ISO 42001 A.10.3SOC 2 CC9.2ISO 27001 A.5.19, A.5.22
Current vendor reports and certificates provide inputs to pre-contract due diligence, supplier governance and continuing risk assessment. The buyer must evaluate service scope, reporting period, certificate expiry, findings, exclusions and its own responsibilities; vendor assurance neither certifies the buyer nor satisfies its controls.