Policies
Policies and standards
The policies and practice standards that govern how we hold information, what our credentials mean, and what you can expect from us. Published in one place so that nobody has to hunt through a footer for them.
For your vendor review
Everything in one place
- Published policies13
- Most recent updateSeptember 27, 2026
- FormatWeb page and PDF
The policies
Grouped by what you need to know
Each opens as a page and downloads as a PDF for your file.
01
How we work
Neutrality, the integrity of an engagement, and what happens to the file.
02
Your data
What we collect, how we protect it, and what you control.
03
Programs and membership
What a certificate confirms, and the terms of a membership.
04
This website
The terms of using the site, and how it is built to be usable by everyone.
For procurement
Documents your procurement office may ask for
The set above is what we publish. The following are provided on request, either before an engagement letter is signed or as part of your vendor review.
- Certificate of insurance
- W-9 and vendor registration paperwork
- Sector-specific service agreement
- Subprocessor list
- Security questionnaire responses
- Business Associate Agreement
Questions
Ask before you sign.
If a policy does not answer your question, or your review needs something we have not listed, write to us and we will respond directly.