Not a certification but an attestation. An independent auditor reports on whether your controls were designed properly, and for Type II, whether they operated over a period.
Trust services criteria for security, availability, processing integrity, confidentiality and privacy.
Technology and service providers whose enterprise customers make the report a condition of the contract, usually during procurement or vendor review.
The clause numbers and titles above are the standard's own public structure. The standard itself is copyright of its issuing body and you buy it from them. What we add is the interpretation underneath, and that lives in your workspace.
This is the running work for this standard specifically. The general shape is the same across all of them.
Each one is filed against the requirement it satisfies as the work happens, so the pack for the next visit already exists.
The quality management standard most certified organisations start with, and the one most other management system standards borrow their structure from.
The continuity standard, built around one question: when the thing you deliver stops, how quickly does it come back, and who decided that was fast enough.
The information security management standard. The management system clauses set the discipline, and Annex A supplies the control set you select from and justify.
The requirement, the control attached to it, the evidence that satisfies it, and the audit checklist it generates. Nothing prepared in advance, because there is nothing to prepare.
