Compliance Frameworks

Last updated: January 15, 2026

Compliance Frameworks and Certification Status

Document owner: VP Governance, Risk & Compliance Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Quarterly, and upon certification changes Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

1. Executive Summary and Purpose

This Compliance Frameworks document provides a comprehensive overview of Acme Cloud, Inc.'s ("Company," "we," "us," or "our") regulatory compliance posture, certification status, and audit program. This document is designed to support enterprise procurement, vendor risk management, and audit teams in evaluating our compliance capabilities against their organizational requirements.

Document Objectives:

Objective	Description	Target Audience
Certification Transparency	Provide current status of all security and privacy certifications	Security reviewers, procurement
Framework Mapping	Document control mappings to major regulatory frameworks	Compliance officers, auditors
Evidence Availability	Clarify what evidence is available and access procedures	Third-party risk teams
Audit Support	Describe our audit support capabilities and processes	Customer audit teams
Regulatory Monitoring	Demonstrate proactive compliance with emerging regulations	Legal, compliance teams

Acme Cloud maintains a robust Governance, Risk, and Compliance (GRC) program that continuously monitors regulatory developments, implements appropriate controls, and provides transparency to our customers. Our compliance program is designed to exceed the minimum requirements of applicable frameworks, providing defense-in-depth assurance to customers operating in regulated industries.

2. Definitions

For purposes of this document, the following terms shall have the meanings set forth below:

Term	Definition
SOC 2	Service Organization Control 2, an audit framework developed by AICPA for evaluating service organizations' controls relevant to security, availability, processing integrity, confidentiality, and privacy.
Type I Audit	Point-in-time assessment of control design and implementation as of a specific date.
Type II Audit	Assessment of control operating effectiveness over a specified period (typically 12 months).
Trust Services Criteria (TSC)	The control objectives and criteria used in SOC 2 audits, organized into Security (Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy.
ISO 27001	International standard for information security management systems (ISMS), specifying requirements for establishing, implementing, maintaining, and continually improving an ISMS.
ISMS	Information Security Management System, a systematic approach to managing sensitive information to remain secure.
Statement of Applicability (SoA)	ISO 27001 document declaring which Annex A controls are applicable to the organization and the justification for inclusion or exclusion.
GDPR	General Data Protection Regulation, EU regulation governing the processing of personal data of individuals in the European Union.
CCPA/CPRA	California Consumer Privacy Act and California Privacy Rights Act, comprehensive privacy laws applicable to California residents.
HIPAA	Health Insurance Portability and Accountability Act, US federal law protecting the privacy and security of protected health information (PHI).
BAA	Business Associate Agreement, a contract required under HIPAA between a covered entity and a business associate.
PCI DSS	Payment Card Industry Data Security Standard, security standard for organizations handling credit card information.
SAQ	Self-Assessment Questionnaire, a PCI DSS validation tool for merchants and service providers.
CUECs	Complementary User Entity Controls, controls that customers must implement to achieve the objectives of service provider controls.
Bridge Letter	A letter from management or auditors covering the period between the end of an audit period and the present date.
TIA	Transfer Impact Assessment, evaluation of risks associated with international data transfers under GDPR.
DPA	Data Processing Agreement/Addendum, contractual terms governing data processing activities.
SCCs	Standard Contractual Clauses, EU-approved contract terms for international data transfers.
DPIA	Data Protection Impact Assessment, evaluation of processing activities' impact on data subject rights.
GRC	Governance, Risk, and Compliance, the integrated approach to managing governance, risk management, and regulatory compliance.

3. Certification and Compliance Status Summary

3.1 Current Certification Status

Framework	Status	Scope	Auditor/Authority	Report Period	Next Milestone
SOC 2 Type II	✅ Certified	Security, Availability, Confidentiality — Acme Cloud SaaS Platform	Deloitte & Touche LLP	Oct 1, 2024 – Sep 30, 2025	Type II renewal Q4 2026
ISO 27001:2022	🔄 In Progress	ISMS covering production SaaS and corporate systems	TÜV SÜD (target)	Gap assessment completed Q4 2025	Stage 1 audit Q3 2026
SOC 1 Type II	➖ Not Applicable	Financial reporting controls	N/A	N/A	Not planned
ISO 27017	📋 Planned	Cloud security controls	TÜV SÜD (target)	N/A	Following ISO 27001 certification
ISO 27018	📋 Planned	PII protection in public cloud	TÜV SÜD (target)	N/A	Following ISO 27001 certification
ISO 27701	📋 Evaluating	Privacy information management	N/A	N/A	Evaluation ongoing
CSA STAR	📋 Planned	Cloud security	CSA	N/A	Self-assessment Q2 2026
FedRAMP	➖ Not Current	US Federal agencies	N/A	N/A	Market demand evaluation

Status Legend:

✅ Active/Certified — Current certification maintained
🔄 In Progress — Certification process underway
📋 Planned — On roadmap, not yet initiated
➖ Not Applicable/Current — Not in scope or not planned

3.2 Regulatory Compliance Status

Regulation	Status	Applicability	Implementation Summary	Evidence
GDPR	✅ Compliant	EEA/UK personal data processing	DPA with SCCs, Article 28 compliance, Data Subject Rights procedures	DPA, Privacy Policy, Processing Records
CCPA/CPRA	✅ Compliant	California residents	Consumer rights implementation, privacy notices, opt-out mechanisms	Privacy Policy, Service Provider Agreement
HIPAA	✅ Compliant	PHI processing for BAA customers	Administrative, physical, technical safeguards; BAA available	BAA template, HIPAA Statement
UK GDPR	✅ Compliant	UK personal data processing	UK-specific addendum, UK Representative	Privacy Policy, UK Addendum
LGPD	✅ Compliant	Brazilian data subjects	Privacy notice, data subject rights	Privacy Policy (Portuguese)
PDPA (Singapore)	✅ Compliant	Singapore personal data	Consent management, transfer protections	Regional terms
PIPEDA	✅ Compliant	Canadian personal data	Privacy principles compliance	Privacy Policy
DORA	📋 Monitoring	EU financial entities	Gap assessment planned	N/A
NIS2 Directive	📋 Monitoring	Essential/important entities	Security measures mapping in progress	N/A
EU AI Act	🔄 Preparing	AI features	Risk classification, transparency measures	AI Usage Policy

4. SOC 2 Type II Certification Details

4.1 Audit Scope and Coverage

Acme Cloud's SOC 2 Type II audit encompasses the following:

Scope Element	Description	Included
Production SaaS Platform	All customer-facing application services	✅ Yes
API Services	Public and private API endpoints	✅ Yes
Infrastructure	AWS cloud infrastructure supporting production	✅ Yes
Supporting Systems	Identity management, monitoring, logging	✅ Yes
Corporate Systems	Systems accessing production data	✅ Yes
Personnel	Employees and contractors with production access	✅ Yes
Subprocessors	Critical subprocessors (AWS, etc.)	✅ Per reliance letters
Mobile Applications	iOS and Android applications	✅ Yes
Development Environment	Non-production systems	❌ Excluded
Marketing Systems	CRM, marketing automation	❌ Excluded

4.2 Trust Services Criteria Coverage

Trust Services Category	Included	Control Points	Notes
Security (Common Criteria)	✅ Yes	CC1–CC9	Full common criteria coverage
Availability (A)	✅ Yes	A1	99.9% SLA; excludes customer-caused outages
Confidentiality (C)	✅ Yes	C1	Customer data classification and handling
Processing Integrity (PI)	❌ No	—	Not in current scope; planned for FY2027
Privacy (P)	❌ No	—	Covered separately via privacy program

4.3 SOC 2 Report Availability

Document	Availability	Access Requirements	Turnaround
SOC 2 Type II Report (Full)	Enterprise customers, qualified prospects	NDA + evaluation agreement	2 business days
SOC 2 Executive Summary	All customers	Customer verification	1 business day
Bridge Letter	Enterprise customers	NDA	3 business days
Management Assertion	Enterprise customers	NDA	2 business days
Description of System	Included in report	Per report access	—
CUECs Summary	All customers	Customer verification	1 business day

4.4 Complementary User Entity Controls (CUECs)

Customers must implement the following controls to achieve the objectives of Acme Cloud's SOC 2 controls:

CUEC Area	Customer Responsibility	Verification Recommendation
Access Management	Promptly provision and deprovision user accounts; implement appropriate access reviews	Quarterly access reviews
Password/Authentication	Enforce appropriate password policies; implement MFA where available	Annual policy review
Endpoint Security	Maintain secure endpoints accessing the service	Endpoint management controls
Network Security	Secure networks from which service is accessed	Network security assessment
Security Awareness	Train personnel on secure service use	Annual security training
Data Classification	Classify data appropriately before uploading	Data governance program
Incident Reporting	Report suspected security incidents promptly	Incident response procedures
Configuration Management	Configure service security settings appropriately	Configuration review
Integration Security	Secure integrations and API credentials	Integration security review

5. ISO 27001 Certification Roadmap

5.1 Certification Timeline

Phase	Milestone	Target Date	Status	Deliverables
Phase 1	Gap assessment	Q4 2025	✅ Complete	Gap analysis report, risk treatment plan
Phase 2	ISMS documentation	Q1 2026	🔄 In Progress	Policy updates, procedures, records
Phase 3	Control implementation	Q1–Q2 2026	🔄 In Progress	Control evidence, operational procedures
Phase 4	Internal audit	Q2 2026	📋 Planned	Internal audit report, corrective actions
Phase 5	Management review	Q2 2026	📋 Planned	Management review meeting, minutes
Phase 6	Stage 1 audit	Q3 2026	📋 Planned	Documentation review, readiness assessment
Phase 7	Stage 2 audit	Q3 2026	📋 Planned	Certification audit, certificate
Phase 8	Surveillance audits	Ongoing (annual)	📋 Future	Continued compliance verification

5.2 ISMS Scope

The Information Security Management System scope includes:

In Scope	Description	Rationale
Production SaaS platform	All customer-facing services and infrastructure	Core business service
Development operations	CI/CD, code repositories, development practices	Service delivery pipeline
Corporate IT	Systems accessing production or sensitive data	Attack surface reduction
Personnel	All employees and contractors	Human element controls
Facilities	San Francisco and Dublin offices	Physical security
Subprocessors	AWS, critical SaaS vendors	Extended security boundary

5.3 Statement of Applicability Summary

Annex A Control Area	Controls	Applicable	Excluded	Exclusion Justification
A.5 Organizational controls	37	35	2	A.5.5 (contact with authorities - no specific requirements); A.5.6 (contact with special interest groups - addressed via incident response)
A.6 People controls	8	8	0	All applicable
A.7 Physical controls	14	12	2	A.7.3 (securing offices) - coworking facilities managed by provider; A.7.8 (equipment siting) - cloud-only infrastructure
A.8 Technological controls	34	33	1	A.8.1 (user endpoint devices) - BYOD with MDM required
Total	93	88	5	—

Full Statement of Applicability available to Enterprise customers under NDA.

6. Privacy Compliance Program

6.1 GDPR Compliance Implementation

GDPR Requirement	Article	Implementation	Evidence
Lawful basis	Art. 6	Documented bases: contract performance, legitimate interest, consent	Processing records, Privacy Policy
Transparency	Art. 12–14	Privacy Policy, collection notices, layered disclosures	Privacy Policy, in-app notices
Data subject rights	Art. 15–22	DSR portal, 30-day fulfillment process	DSR procedures, response templates
Data minimization	Art. 5(1)(c)	Collection limited to stated purposes	Data inventory, retention schedules
Storage limitation	Art. 5(1)(e)	Defined retention periods, automated deletion	Data Retention Policy
Security	Art. 32	Technical and organizational measures	Security Overview, SOC 2
Breach notification	Art. 33–34	72-hour notification process	Incident Response Plan
DPO	Art. 37–39	DPO appointed (not required but implemented)	DPO contact published
Processor obligations	Art. 28	DPA with SCCs, subprocessor management	DPA template
International transfers	Art. 44–49	SCCs, TIAs, supplementary measures	Transfer documentation
Records of processing	Art. 30	Comprehensive processing records	Internal records
DPIA	Art. 35	DPIA process, templates for high-risk processing	DPIA templates (on request)
Privacy by design	Art. 25	Privacy review in product development	Product development procedures

6.2 International Data Transfer Mechanisms

Transfer Route	Mechanism	Legal Basis	Supplementary Measures
EEA → US	Standard Contractual Clauses (SCCs)	EU Commission Decision 2021/914	Encryption, access controls, TIA
EEA → UK	UK Addendum to SCCs	UK GDPR	Aligned with EEA measures
EEA → Other third countries	SCCs or adequacy decision	Per country assessment	TIA where required
UK → US	International Data Transfer Agreement (IDTA)	UK GDPR	Encryption, access controls

6.3 Transfer Impact Assessment Summary

Factor	Assessment	Mitigation
US government access risks	Low — limited intelligence value; B2B SaaS	Encryption at rest, access controls, legal safeguards
Legal framework	US lacks comprehensive federal privacy law	Contractual commitments, SOC 2 controls
Practical experience	No government data requests to date	Transparency report (annual)
Technical measures	Strong encryption, access controls	SOC 2 verified

Full TIA documentation available to Enterprise customers upon request.

7. HIPAA Compliance Program

7.1 HIPAA Safeguards Implementation

Safeguard Category	Requirement	Implementation	Verification
Administrative	Security management process	Risk assessments, policies, procedures	Annual risk assessment
Administrative	Assigned security responsibility	CISO designated	Organizational chart
Administrative	Workforce security	Background checks, access management	HR procedures
Administrative	Information access management	Role-based access, minimum necessary	Access reviews
Administrative	Security awareness training	Annual HIPAA training	Training records
Administrative	Security incident procedures	Incident response plan	Tabletop exercises
Administrative	Contingency plan	Business continuity, disaster recovery	DR testing
Administrative	Evaluation	Annual program evaluation	Assessment reports
Administrative	BAA management	BAA execution, subcontractor agreements	Contract management
Physical	Facility access controls	AWS data center controls	SOC 2 reliance
Physical	Workstation security	Clean desk, screen lock	Policy enforcement
Physical	Device and media controls	Encryption, disposal procedures	Asset management
Technical	Access control	Unique user IDs, MFA, auto-logoff	Technical controls
Technical	Audit controls	Comprehensive logging	Audit log review
Technical	Integrity controls	Checksums, change detection	Integrity monitoring
Technical	Transmission security	TLS 1.2+, VPN	Encryption standards

7.2 PHI Handling Controls

Control	Description	Enforcement
PHI Workspace Designation	Customers designate workspaces containing PHI	Admin console setting
AI Feature Restrictions	AI features disabled for PHI workspaces by default	Technical enforcement
Enhanced Audit Logging	Extended retention, additional log fields for PHI workspaces	Automatic configuration
Access Restrictions	Additional access controls for PHI workspaces	Feature enforcement
Subprocessor Limitations	Restricted subprocessor usage for PHI	Contractual and technical

7.3 BAA Availability

Customer Type	BAA Availability	Process
Enterprise customers	Standard BAA included	Contract execution
Professional customers	BAA available on request	legal@acmecloud.com
Self-service customers	Not available	Upgrade required

8. Security Assessment Program

8.1 Assessment Calendar

Assessment Type	Frequency	Last Completed	Next Scheduled	Responsible Party
External Penetration Test	Annual	September 2025	September 2026	Third-party firm (NCC Group)
Application Security Assessment	Annual	September 2025	September 2026	Combined with pen test
Internal Vulnerability Scan	Weekly	Continuous	Continuous	Security Engineering
External Vulnerability Scan	Weekly	Continuous	Continuous	Security Engineering
Red Team Exercise	Annual	June 2025	June 2026	Third-party firm
Tabletop Incident Exercise	Semi-annual	November 2025	May 2026	Security + Executive team
Disaster Recovery Test	Semi-annual	December 2025	June 2026	SRE team
Business Continuity Test	Annual	November 2025	November 2026	Operations
SOC 2 External Audit	Annual	September 2025	September 2026	Deloitte
ISO 27001 Audit	Annual (post-certification)	N/A	Q3 2026 (initial)	TÜV SÜD
HIPAA Risk Assessment	Annual	January 2026	January 2027	Compliance
Vendor Security Assessment	Per risk tier	Continuous	Continuous	Vendor Risk team

8.2 Penetration Test Program Details

Element	Specification
Scope	Production web applications, APIs, mobile apps, infrastructure
Methodology	OWASP Testing Guide, PTES
Finding Classification	Critical, High, Medium, Low, Informational
Remediation SLAs	Critical: 72 hours; High: 14 days; Medium: 60 days; Low: 90 days
Retesting	Critical/High findings retested before closure
Report Availability	Executive summary available under NDA

8.3 FY2025 Security Assessment Results Summary

Assessment	Findings Summary	Status
External Penetration Test (Sep 2025)	0 Critical, 1 High (remediated), 4 Medium (remediated), 8 Low	All remediated
Red Team Exercise (Jun 2025)	2 scenarios tested; initial access achieved in 1 scenario via phishing simulation; escalation prevented	Findings addressed
Vulnerability Scanning (Annual)	847 unique findings identified; 99.2% remediated within SLA	Ongoing
Tabletop Exercise (Nov 2025)	Ransomware scenario; identified communication gaps	Process improvements implemented

9. Questionnaire and Evidence Support

9.1 Standard Questionnaire Response Times

Questionnaire Type	Typical Turnaround	Pre-Completed Available	Notes
SIG Lite	3 business days	✅ Yes	Updated quarterly
SIG Core	5 business days	✅ Yes	Updated quarterly
CAIQ v4	3 business days	✅ Yes	Updated quarterly
HECVAT Full	7 business days	✅ Yes	Healthcare customers
HECVAT Lite	3 business days	✅ Yes	Healthcare customers
VSA Questionnaire	5 business days	🔄 Partial	Updated quarterly
Custom RFP Security Section	10 business days	➖ N/A	Case-by-case
Vendor Risk Platform	Varies	➖ N/A	Supported: SecurityScorecard, BitSight, RiskRecon, OneTrust

9.2 Evidence Package Contents

Standard evidence packages provided to qualified customers include:

Document	Description	Update Frequency	Access
SOC 2 Type II Report	Full auditor's report	Annual	NDA required
SOC 2 Bridge Letter	Management assertion for current period	Quarterly	NDA required
Penetration Test Executive Summary	High-level findings summary	Annual	NDA required
Completed SIG Lite	Pre-filled questionnaire	Quarterly	Customer verification
Completed CAIQ	Pre-filled questionnaire	Quarterly	Customer verification
Subprocessor List	Current subprocessor inventory	Per change	Public
Architecture Overview	High-level system architecture	Semi-annual	NDA required
Encryption Standards	Cryptographic standards documentation	Annual	Public
Data Flow Diagram	Data processing flows	Semi-annual	NDA required
Business Continuity Summary	BC/DR program overview	Annual	NDA required
Insurance Certificates	Cyber liability, E&O coverage	Annual	NDA required

9.3 Evidence Request Process

Step	Action	Timeline	Responsibility
1	Submit request to trust@acmecloud.com	—	Customer
2	Verify customer identity and relationship	1 business day	Trust team
3	Execute NDA (if required)	2–3 business days	Legal
4	Prepare evidence package	2 business days	GRC team
5	Deliver via secure channel	1 business day	Trust team
6	Follow-up questions	Per complexity	Trust team

10. Customer Audit Support

10.1 Audit Support Options

Support Type	Description	Availability	Cost
Self-Service Evidence	Trust Center documents, pre-completed questionnaires	All customers	Included
Standard Evidence Package	SOC 2, pen test summary, policy documents	All customers	Included
Control Walkthrough (Remote)	90-minute call reviewing specific controls	Enterprise customers	Included
Extended Q&A Session	Deep-dive on technical controls	Enterprise customers	Included
Custom Control Mapping	Mapping to customer's framework (NIST, HITRUST, etc.)	Enterprise customers	Professional services
On-Site Audit Support	In-person audit support	By arrangement	Professional services

10.2 On-Site Audit Requirements

Requirement	Specification
Advance Notice	30 business days minimum
Scope Agreement	Written scope document required
Confidentiality	NDA execution required
Duration	Maximum 2 days per audit
Access Limitations	No access to other customer data; logical separation maintained
Findings Handling	Draft findings reviewed before finalization
Cost	Professional services rates apply for extensive engagements

10.3 Framework Mapping Support

Framework	Mapping Available	Format	Access
SOC 2 TSC	✅ Complete	Spreadsheet	Standard evidence package
ISO 27001 Annex A	✅ Complete	Spreadsheet	Enterprise customers (NDA)
NIST CSF	✅ Complete	Spreadsheet	Enterprise customers (NDA)
NIST 800-53	🔄 Partial	Spreadsheet	Enterprise customers (NDA)
HITRUST CSF	✅ Complete	Spreadsheet	Enterprise customers (NDA)
CIS Controls v8	✅ Complete	Spreadsheet	Enterprise customers (NDA)
GDPR Articles	✅ Complete	Document	DPA appendix
PCI DSS	✅ SAQ A only	Spreadsheet	On request

11. Regulatory Monitoring and Horizon Scanning

11.1 Current Regulatory Monitoring

Regulation/Standard	Status	Applicability	Acme Cloud Action
EU AI Act	Enacted; phased effective 2025–2027	AI features	Risk classification, transparency documentation; see AI Usage Policy
US State Privacy Laws	Expanding (19 states enacted as of 2025)	US customers	Unified privacy program; state-specific notices
SEC Cyber Disclosure Rules	Effective 2024	Public company readiness	Incident disclosure procedures prepared
DORA	Effective January 2025	EU financial customers	Gap assessment planned Q2 2026
NIS2 Directive	Transposition ongoing	Essential/important entities	Security measures mapping
UK PSTI Act	Effective 2024	IoT security	N/A — no IoT products
Digital Services Act	Effective 2024	Online platforms	Limited applicability assessment
Colorado AI Act	Effective 2026	AI in Colorado	Impact assessment
CPRA Regulations	Ongoing refinement	California residents	Privacy program updates
Brazil AI Bill	Pending	AI in Brazil	Monitoring

11.2 Regulatory Response Process

Regulation Status	Acme Cloud Response	Timeline
Proposed/Draft	Legal monitoring, industry engagement	Ongoing
Enacted, pre-effective	Gap assessment, remediation planning	6–12 months before effective
Effective	Full compliance, documentation, customer communication	By effective date
Enforcement action (industry)	Lessons learned review	30 days
Material change	Impact assessment, policy updates	90 days or as required

12. SOC 2 and ISO 27001 Control Mapping

12.1 SOC 2 Control Categories

Control Category	SOC 2 Reference	Key Controls	Documentation
Control Environment	CC1	Governance, integrity, accountability	Corporate Governance, Code of Conduct
Communication and Information	CC2	Internal/external communication	Security awareness, incident notification
Risk Assessment	CC3	Risk identification and management	Risk assessment program
Monitoring Activities	CC4	Ongoing evaluation, deficiency remediation	Continuous monitoring, audit program
Control Activities	CC5	Policies and procedures	Security policies, control documentation
Logical and Physical Access	CC6	Access management, authentication	Access Control Policy
System Operations	CC7	Incident detection and response	Incident Response Plan
Change Management	CC8	Change control processes	Change management procedures
Risk Mitigation	CC9	Vendor management, business continuity	Third-Party Risk, Business Continuity
Availability	A1	System availability and recovery	Business Continuity, SLA
Confidentiality	C1	Data classification and protection	Data classification, encryption

12.2 ISO 27001:2022 Annex A Overview

Control Theme	Control Count	Key Focus Areas
A.5 Organizational	37	Policies, roles, asset management, supplier relationships
A.6 People	8	Screening, awareness, disciplinary, termination
A.7 Physical	14	Perimeters, entry controls, equipment protection
A.8 Technological	34	Access control, cryptography, security in development

12.3 Cross-Framework Control Mapping Example

Control Area	SOC 2 TSC	ISO 27001	NIST CSF	CIS Controls
Access Control	CC6.1–CC6.3	A.5.15–A.5.18, A.8.2–A.8.5	PR.AC	5, 6
Encryption	CC6.1, CC6.7	A.8.24	PR.DS	3.11
Incident Response	CC7.1–CC7.5	A.5.24–A.5.28, A.6.8	RS.RP, RS.CO	17
Vulnerability Management	CC7.1	A.8.8	ID.RA, PR.IP	7
Change Management	CC8.1	A.8.32	PR.IP	4.1
Business Continuity	A1.1–A1.3	A.5.29–A.5.30	PR.IP	11
Vendor Management	CC9.2	A.5.19–A.5.23	ID.SC	15

13. Shared Responsibility Model

13.1 Responsibility Matrix

Responsibility Area	Acme Cloud	Customer	Shared
Physical Infrastructure	✓
Hypervisor and Network	✓
Platform Security Controls	✓
Application Security	✓
Data Encryption (infrastructure)	✓
Data Encryption (application)	✓
Patch Management (platform)	✓
Incident Detection (platform)	✓
User Access Management		✓
Data Classification		✓
Content and Data		✓
Endpoint Security (customer)		✓
User Security Awareness		✓
Integration Security			✓
API Credential Management			✓
Compliance (platform)	✓
Compliance (use of service)		✓
Incident Response (platform)	✓
Incident Response (data)			✓

13.2 Customer Security Configuration Checklist

Configuration	Recommendation	Location
Enable MFA	Required for all users	Admin Console → Security
Configure SSO	Recommended for Enterprise	Admin Console → Authentication
Review access permissions	Quarterly review recommended	Admin Console → Users
Enable audit log export	Recommended for compliance	Admin Console → Compliance
Configure session timeout	Per organizational policy	Admin Console → Security
Review API permissions	Quarterly review recommended	Admin Console → Integrations
Configure IP allowlist	Recommended for sensitive data	Admin Console → Security
Enable data export encryption	Recommended	Admin Console → Data

14. Trust Center Document Index

14.1 Complete Document Catalog

Document	Primary Framework Mapping	Audience	Update Frequency
Security Overview	SOC 2, ISO 27001	All	Quarterly
Privacy Policy	GDPR, CCPA	All	Annual + material changes
Data Processing Agreement	GDPR Art. 28	All	Annual
Subprocessor List	GDPR, SOC 2	All	Per change
Access Control Policy	SOC 2 CC6, ISO A.8	Security reviewers	Semi-annual
Encryption Standards	SOC 2, ISO A.8.24	Security reviewers	Annual
Incident Response Plan	SOC 2 CC7, GDPR Art. 33	Security reviewers	Annual
Business Continuity Plan	SOC 2 A1, ISO A.5.29	Security reviewers	Annual
HIPAA Statement	HIPAA	Healthcare customers	Annual
Penetration Testing Program	SOC 2, ISO	Security reviewers	Annual
Third-Party Risk Management	SOC 2 CC9, ISO A.5.19	Vendor risk teams	Semi-annual
Vulnerability Disclosure	SOC 2 CC7	Security researchers	Annual
AI Usage Policy	EU AI Act, SOC 2	All	Quarterly
Code of Conduct	SOC 2 CC1	All	Annual
Compliance Frameworks (this page)	All	Procurement, audit	Quarterly

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices

15. GRC Program Governance

15.1 GRC Organizational Structure

Role	Responsibilities	Reports To
VP GRC	Program ownership, Board reporting, regulatory strategy	General Counsel
Compliance Manager	Audit coordination, evidence management, questionnaires	VP GRC
Privacy Lead	Privacy program, DSRs, DPIAs	VP GRC
Risk Analyst	Risk assessments, vendor risk, control testing	Compliance Manager
Audit Coordinator	External audit liaison, evidence collection	Compliance Manager

15.2 GRC Metrics and Reporting

Metric	Target	FY2025 Actual	Trend
SOC 2 control effectiveness	>95%	98%	▲
Audit findings (material)	0	0	—
Questionnaire response time	<5 days	3.2 days	▼
Control testing completion	100%	100%	—
Regulatory monitoring coverage	100% applicable	100%	—
Customer audit support satisfaction	>4.5/5	4.7/5	▲

15.3 Annual Compliance Calendar

Month	Activity	Framework
January	HIPAA risk assessment	HIPAA
February	Internal control self-assessment	SOC 2
March	ISO 27001 internal audit	ISO 27001
April	Privacy program review	GDPR, CCPA
May	Penetration test	SOC 2, ISO 27001
June	DR test, BC test	SOC 2 A1
July	Mid-year control testing	SOC 2
August	Vendor risk assessment cycle	SOC 2 CC9
September	External pen test, SOC 2 audit end	SOC 2
October	SOC 2 report issuance	SOC 2
November	Tabletop exercise	SOC 2 CC7
December	Annual policy review	All

This document is updated quarterly. Last updated: January 15, 2026. For the most current information, contact trust@acmecloud.com.