{"id":"PLT-014","section":"Platform, Privacy & Assurance","requirement":"Maintain security assurance","acceptance":"Current evidence for SOC 2 Type II and ISO 27001.","tier":"Tier-independent","whyItMatters":"Standard assurance should be evidenced, not assumed.","verificationMethod":"D","verificationTest":"Current SOC 2 Type II report, ISO 27001 certificate and privacy terms are provided.","formerly":"ARC-009","alsoIn":[],"sort":68,"adoptionContext":"Supplier assurance supports procurement and oversight across adoption tiers, with the buyer’s own scope and use determining the relevant evidence.","mappings":[{"frameworks":["csf","rmf","iso","soc2","iso27001"],"explanation":"Current vendor reports and certificates provide inputs to pre-contract due diligence, supplier governance and continuing risk assessment. The buyer must evaluate service scope, reporting period, certificate expiry, findings, exclusions and its own responsibilities; vendor assurance neither certifies the buyer nor satisfies its controls.","kind":"framework","references":{"csf":["GV.SC-06","GV.SC-07"],"rmf":["GOVERN 6.1","MANAGE 3.1"],"iso":["A.10.3"],"soc2":["CC9.2"],"iso27001":["A.5.19","A.5.22"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-014","frameworkRefs":{"ISO27001":["A.5.19","A.5.22"],"ISO42001":["A.10.3"],"NIST-CSF":["GV.SC-06","GV.SC-07"],"NIST-AI-RMF":["GOVERN 6.1","MANAGE 3.1"],"SOC2":["CC9.2"]}}