²ÝÝ®ÊÓƵ

SOC 1

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ VNDLY

Service Organisation Controls (SOC) 1 reports provide information about a service organisation¡¯s control environment that may be relevant to the customer's internal controls over financial reporting.

Our SOC 1 Type II report is issued in accordance with the International Standard on Assurance Engagements (ISAE) 3402 (Assurance Reports on Controls at a Service Organisation).?The SOC 1 report covers the design and operating effectiveness of controls relevant to ²ÝÝ®ÊÓƵ enterprise cloud applications.

SOC 2

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing, ²ÝÝ®ÊÓƵ Peakon Employee Voice, ²ÝÝ®ÊÓƵ VNDLY

The SOC 2 Type II report is an independent assessment of our control environment performed by a third party.

The SOC 2 report is based on the AICPA¡¯s Trust Services Criteria and is issued annually in accordance with the AICPA¡¯s AT Section 101 (Attest Engagements).?The SOC 2 report details the design and operating effectiveness of controls relevant to any system containing customer data as part of ²ÝÝ®ÊÓƵ applications. The ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ SOC 2 report addresses all of the Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity and Privacy). Additionally, the report addresses the NIST Cybersecurity Framework and NIST 800-171 as part of the SOC 2+ Additional Subject Matter process, which includes an audited mapping of ²ÝÝ®ÊÓƵ¡¯s controls against these frameworks.

SOC 3

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Peakon Employee Voice, ²ÝÝ®ÊÓƵ Strategic Sourcing

The American Institute of Certified Public Accountants (AICPA) has developed the SOC 3 framework for safeguarding the confidentiality and privacy of information that is stored and processed in the cloud.

The SOC 3 report, an independent assessment of our control environment performed by a third party, is publicly available and provides a summary of our control environment relevant to the security, availability, confidentiality, processing integrity and privacy of customer data.

See our SOC 3 report for ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ.

See our SOC 3 report for ²ÝÝ®ÊÓƵ Adaptive Planning.?

See our SOC 3 report for ²ÝÝ®ÊÓƵ Peakon Employee Voice.

See our SOC 3 report for ²ÝÝ®ÊÓƵ Strategic Sourcing.

ISO 27001

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing, ²ÝÝ®ÊÓƵ VNDLY & ²ÝÝ®ÊÓƵ Peakon Employee Voice

Our Information Security Management System (ISMS) meets the requirements set forth by this globally recognised, standards-based approach to security.?

See our consolidated ISO 27001?certificate for ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing & ²ÝÝ®ÊÓƵ Peakon Employee Voice.

See our ISO 27001?certificate?for VNDLY.

ISO 27017

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning

This standard provides controls and implementation guidance for information security controls applicable to the provision and use of cloud services.

See our consolidated ISO 27017 certificate for ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ and ²ÝÝ®ÊÓƵ Adaptive Planning.

ISO?27018

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning

This standard contains guidelines applicable to cloud service providers that process personal data.

See our consolidated ISO 27018 certificate for ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ and ²ÝÝ®ÊÓƵ Adaptive Planning.

ISO?27701

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning

This standard provides the requirements and guidelines for the implementation and continuous improvement of an organisation¡¯s Privacy Information Management System (PIMS) as an extension to ISO/IEC 27001.

See our consolidated ISO 27701 certificate for ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ and ²ÝÝ®ÊÓƵ Adaptive Planning.

TRUSTe Enterprise Privacy and Data Governance Certification

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing

²ÝÝ®ÊÓƵ is?a participant under the TRUSTe Enterprise Privacy & Data Governance Practices Program.

This programme is designed to enable organisations such as ²ÝÝ®ÊÓƵ to demonstrate that their privacy and data governance practices for personal information comply with standards based on recognised laws and regulatory standards, including the OECD Privacy Guidelines, the APEC Privacy Framework, the EU General Data Protection Regulation (GDPR), the US Health Insurance Portability and Accountability Act (HIPAA), ISO 27001 International Standard for Information Security Management Systems and other privacy laws and regulations globally.?

See our TRUSTe .

SIG Questionnaire

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing, ²ÝÝ®ÊÓƵ Peakon Employee Voice, ²ÝÝ®ÊÓƵ VNDLY

The Standardised Information Gathering (SIG) questionnaire is an industry-standard compilation of questions used to assess information technology and data security across a broad spectrum of risk control areas.

The SIG is issued by Shared Assessments, a global organisation dedicated to third-party risk assurance. ²ÝÝ®ÊÓƵ self-assesses against the SIG annually, providing our customers with an in-depth view of our control environment against a standardised set of enquiries. Customers can access the ?on ²ÝÝ®ÊÓƵ Community.

NIST CSF and NIST 800-171

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ

The NIST Cybersecurity Framework (CSF) provides guidance for organisations on how to improve their ability to prevent, detect and respond to cybersecurity risks. The NIST Privacy Framework provides guidance on measuring and improving an organisation¡¯s Privacy programme. The NIST 800-171 standard relates to protecting Controlled Unclassified Information in non-federal Information Systems and Organisations.

²ÝÝ®ÊÓƵ has mapped our relevant SOC 2 controls to the NIST CSF, NIST PF and NIST 800-171 standards. This mapping has been audited as part of the ²ÝÝ®ÊÓƵ SOC 2+ report.

TrustArc and Privacy Shield

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing

²ÝÝ®ÊÓƵ is an active Privacy Shield participant. TRUSTe is ²ÝÝ®ÊÓƵ¡¯s third-party verification agent for the Privacy Shield.

See our Privacy Shield .

EU Cloud Code of Conduct

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning

The EU Cloud Code of Conduct (CCoC) consists of a set of requirements that enable cloud service providers (CSPs) to demonstrate their capability to comply with GDPR.?

Adherence ID: 2019LVL02SCOPE001

Verify the ²ÝÝ®ÊÓƵ?.

HIPAA

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ

²ÝÝ®ÊÓƵ has completed a Health Insurance Portability and Accountability Act (HIPAA) third-party attestation for the ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, which provides assurance that ²ÝÝ®ÊÓƵ has a HIPAA-compliance programme with adequate measures for saving, accessing and sharing individual medical and personal information.

FedRAMP Moderate

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ

The Federal Risk and Authorisation Management Program, or FedRAMP, is a US-government programme that enables federal agencies to adopt cloud-based systems into their IT environments. FedRAMP provides a standardised approach to security and risk assessment for cloud technologies and federal agencies to make sure that federal data is continuously protected at the highest level in the cloud.

²ÝÝ®ÊÓƵ is FedRAMP Authorised status at the Moderate security impact level for ²ÝÝ®ÊÓƵ Government Cloud.

G-Cloud

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Peakon Employee Voice

The G-Cloud framework is an agreement between the UK government and cloud-based service providers.

G-Cloud enables cloud-based service providers to apply and, once accepted, sell their cloud services to UK public sector organisations. The G-Cloud framework is updated annually by the governing body, Crown Commercial Services (CCS).

UK public sector organisations can currently purchase ²ÝÝ®ÊÓƵ service offerings via the CCS Digital Marketplace.

Cyber Essentials Plus

Applies to:?²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing, ²ÝÝ®ÊÓƵ Peakon Employee Voice, ²ÝÝ®ÊÓƵ VNDLY

Cyber Essentials Plus is a UK-government-backed scheme to help organisations protect against cybersecurity threats by setting out baseline technical controls.

See our Cyber Essentials Plus?.

Australian IRAP

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning

The Australian Government maintains security documentation relating to the usage of ICT services, including cloud services. This is represented through the Information Security Manual (ISM) and the Protective Security Policy Framework (PSPF). The Infosec Registered Assessors Program (IRAP), maintained by the Australian Cyber Security Centre (ACSC), endorses individual assessors to review an organisation's effectiveness against controls in the ISM and PSPF.?

²ÝÝ®ÊÓƵ engages a third-party assessor to perform an IRAP assessment of the suitability of the controls in the ISM and PSPF against ²ÝÝ®ÊÓƵ Production environments at the PROTECTED level.

CSA STAR Self-Assessment

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing, ²ÝÝ®ÊÓƵ Peakon Employee Voice, ²ÝÝ®ÊÓƵ VNDLY

The Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Consensus Assessments Initiative Questionnaire (CAIQ) Self-Assessment consolidates current information regarding security risks and controls into one industry-standard questionnaire (CSA STAR CAIQ).

²ÝÝ®ÊÓƵ self-assesses against the CSA STAR CAIQ biennially, providing our customers with an in-depth view of our control environment. This document provides ²ÝÝ®ÊÓƵ customers with an in-depth view of the ²ÝÝ®ÊÓƵ control environment.

TISAX

Applies to:?²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing

The Trusted Information Security Assessment Exchange (TISAX) is administered by the on behalf of the German Association of the Automotive Industry. This standard provides the European automotive industry with a consistent, standardised approach to information security systems.

Result available on the .

CCCS CSP ITS Assessment

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ

The Canadian Centre for Cyber Security (CCCS) established the Cloud Service Provider (CSP) Information Technology Security (ITS) Assessment Program to assist Government of Canada (GC) departments and agencies in their evaluation of CSP services. CCCS provides advice and guidance on the technical, operational and procedural ITS capabilities of CSPs. The assessment determines if security processes and controls meet the GC public cloud security requirements for information and services up to Protected B, Medium Integrity and Medium Availability (PB/M/M) as published by the Treasury Board of Canada Secretariat.

TX-RAMP

Applies to: ²ÝÝ®ÊÓƵ Enterprise ²ÝÝ®ÊÓƵ, ²ÝÝ®ÊÓƵ Adaptive Planning, ²ÝÝ®ÊÓƵ Strategic Sourcing, ²ÝÝ®ÊÓƵ Peakon Employee Voice, ²ÝÝ®ÊÓƵ VNDLY

The Texas Risk and Authorization Management Program (TX-RAMP) is a DIR programme that provides review of security measures taken by cloud products and services that transmit data to Texas state agencies. Cloud providers must comply with an established DIR framework and continuous compliance to be accepted. TX-RAMP was established from requirements put forth in Senate Bill 475.

²ÝÝ®ÊÓƵ is certified at TX-RAMP Level 2.