ISO 27001 at Citation
An information security management system for managing risk and improving security practices.
Scope at a glance.
- Framework
- ISO 27001
- Status
- Certified
- Applies to
- The information security management system and organization named on the certificate.
Read this alongside the security controls and provider list for the features you plan to use.
A structured approach to security
Citation’s ISO 27001 certification concerns its information security management system. The standard provides a framework for identifying risks, selecting controls and maintaining a process for review and improvement.
The certificate defines the certified organization and scope. When assessing Citation, review that scope together with the product controls, applicable service agreements and the way you plan to use the workspace.
From management to everyday controls
Security management connects policies and responsibilities with the systems people use. In Citation, access permissions, protected credentials, request validation and clear reporting routes are parts of the wider security picture.
A customer’s own responsibilities still include managing members, choosing appropriate document sharing and reviewing the permissions granted to integrations. The trust center brings those controls together so your review can follow the relevant part of the service.
Certificate and scope
Request the certificate for its issuing body, covered scope and validity period. If your procurement process requires additional documentation, describe the requirements in your request so they can be addressed together.
Documents for a useful review.
Ask for the information that establishes the relevant scope, period and responsibilities.
- Certificate issuer, certificate number and validity period
- Certified entity, locations and service scope
- Statement of applicability or relevant control information
- Surveillance and renewal information relevant to the review
Include your organization, intended workflow and procurement requirements when requesting access. Some documents may require confidentiality arrangements.
Your part in the workflow.
- Check the certificate scope rather than relying only on the certification name.
- Map organizational security requirements to the product features and agreements you will use.
- Keep your own access, sharing and integration settings aligned with your policies.
For personal information requests, use Data requests. For a suspected incident, follow the security reporting process.