SOC 2 Type 1 readiness report assessing the design of DHUBiC's controls against the Trust Services Criteria.

CPA-attested SOC 2 Type 2 report on the design and operating effectiveness of DHUBiC's controls over time.

Official ISO 27001:2022 certificate demonstrating DHUBiC's certified ISMS.

Technical overview of DHUBiC security architecture, encryption standards, access controls, audit logging, and compliance posture.

Standard Data Processing Agreement template covering data processing terms, security obligations, and breach notification procedures.

Defines acceptable use of DHUBiC information systems, assets, and resources by employees, contractors, and third parties.

Governs logical and physical access to DHUBiC systems and data. Covers RBAC, provisioning, deprovisioning, and periodic access reviews aligned with ISO 27001:2022.

Defines identification, classification, ownership, and lifecycle management of information assets across DHUBiC's infrastructure and operations.

Establishes requirements for security monitoring, log management, audit trail integrity, and review of system activity across all environments.

Defines standards for secure configuration, hardening baselines, and change control of systems, infrastructure, and software components.

Establishes a data classification framework (Public, Internal, Confidential, Restricted) and handling requirements for each tier.

Defines controls to detect and prevent unauthorised transmission, storage, or exposure of sensitive and classified data.

Specifies requirements for masking, anonymisation, and pseudonymisation of sensitive data in non-production environments and outputs.

Overarching policy governing the processing, storage, and protection of personal and sensitive data in compliance with applicable privacy regulations.

Defines retention schedules for all data categories and procedures for secure disposal of data and physical media at end-of-life.

Establishes requirements for continuity of ICT services, including recovery objectives, failover procedures, and resilience of critical systems.

Defines incident classification, response procedures, escalation paths, notification obligations, and post-incident review requirements.

Overarching security governance framework aligned with ISO/IEC 27001:2022. Defines security objectives, roles, responsibilities, and policy management.

Governs network segmentation, perimeter controls, secure remote access, wireless security, and network monitoring requirements.

Defines password complexity, length, rotation, storage, and MFA requirements for all user and service accounts.

Establishes controls for physical access to offices, data centres, and equipment. Covers visitor management, clean desk, and secure media disposal.

Defines the risk assessment and treatment methodology, risk appetite, risk register maintenance, and risk reporting cadence.

Mandates secure coding standards, threat modelling, SAST/DAST in CI/CD, dependency scanning, and security review requirements for all software releases.

Governs security assessment, onboarding, monitoring, and offboarding of third-party vendors and subprocessors with access to DHUBiC systems or data.

Defines mandatory security awareness training requirements, frequency, completion tracking, and phishing simulation programmes for all staff.

Establishes requirements for vulnerability scanning, penetration testing, severity-based remediation SLAs, and patch management across all systems.

Defines backup scope, frequency, encryption, retention, and recovery testing to ensure data and systems can be restored after disruption.

Sets security requirements for laptops, workstations, and mobile devices, including hardening, encryption, and endpoint protection controls.

Governs firewall rule lifecycle, change approval, periodic rule review, and logging for network perimeter and internal segmentation controls.

Defines procedures for evidence collection, preservation, chain of custody, and analysis during security incident investigations.

Establishes requirements for detecting, preventing, and responding to malware across endpoints, servers, email, and network services.

Controls how users and devices are authenticated, authorised, and segmented when connecting to DHUBiC networks and systems.

Covers documented operating procedures, change control, capacity management, and separation of environments for secure day-to-day operations.

Defines how security patches are identified, tested, prioritised, and deployed across systems within defined timelines.

Specifies redundancy and high-availability requirements for critical systems, infrastructure, and services to meet availability objectives.

Establishes secure design and architecture principles applied when building, integrating, and modifying information systems.

Sets security requirements for third parties with access to DHUBiC information, including due diligence, contracts, and ongoing monitoring.

Defines how threat information is collected, analysed, and used to strengthen detection, prevention, and response capabilities.