Bucket A
Trust & Security
14 criteria · weight 32%
- SOC 2 Type II attestation status & audit date
- GDPR, CCPA, and HIPAA data handling posture
- Incident history (last 36 months) & disclosure quality
- Encryption at rest and in transit, key management
- Authentication: SSO/SAML, SCIM provisioning, MFA
- Vulnerability disclosure program & patching SLA
- Penetration test cadence and remediation closure rate
- Sub-processor list transparency
- Data residency and regional availability
- Backup durability, RPO, and RTO commitments
- Admin audit log completeness
- Breach notification mechanism (timed)
- Third-party security ratings (BitSight, SecurityScorecard)
- Vendor risk questionnaire responsiveness