# PLT-014: Maintain security assurance


- Area: Platform, Privacy & Assurance

- Verification: Documentation
- OWASP adoption tier: Tier-independent
- Formerly: ARC-009
- URL: /r/PLT-014

**Acceptance criteria:** Current evidence for SOC 2 Type II and ISO 27001.

**Why it matters:** Standard assurance should be evidenced, not assumed.

**How to verify:** Current SOC 2 Type II report, ISO 27001 certificate and privacy terms are provided.

**OWASP adoption context:** Supplier assurance supports procurement and oversight across adoption tiers, with the buyer’s own scope and use determining the relevant evidence.

**Mappings:**
- NIST CSF 2.0: GV.SC-06, GV.SC-07; NIST AI RMF: GOVERN 6.1, MANAGE 3.1; ISO 42001: A.10.3; SOC 2: CC9.2; ISO 27001: A.5.19, A.5.22 — Current vendor reports and certificates provide inputs to pre-contract due diligence, supplier governance and continuing risk assessment. The buyer must evaluate service scope, reporting period, certificate expiry, findings, exclusions and its own responsibilities; vendor assurance neither certifies the buyer nor satisfies its controls.