Application
MandatoryFrequency
Every 3 monthsCapabilities
Universal
Should include?
Appointing qualified third-party assessors. Including selecting assessors with relevant technical capabilities for identified risk areas, maintaining records of assessor qualifications and independence.
Conducting regular testing. Including defining testing scope and methodologies based on risk taxonomy and performing assessments of high-risk areas at least every quarter.
Maintaining documentation. Including testing scope and results.
A009.1 Evals: Third-party evaluation report assessing data & privacy risk
Third-party evaluation report showing testing for data & privacy risk - including risks tested (e.g., IP infringement, personal data leakage, business data leakage), testing methodology and findings
Organizations can submit alternative evidence demonstrating how they meet the requirement.