{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-1270","name":"Trust & Compliance Assurance","level":1,"parent_id":null,"l1_id":"BC-1270","industry":"software","macro_id":null,"path":["Trust & Compliance Assurance"],"description":"Earn and keep customers' trust in the product itself — hold the certifications and attestations buyers require, answer their security questionnaires with evidence, secure the product and its supply chain, and publish how the product handles their data. This is outward-facing assurance about the product, not the company's internal security operation.","aliases":["Security Assurance","Customer Trust Program","Product Security","Compliance Attestation"],"in_scope":["Audits, certifications and attestations for the product and the services behind it","Customer security reviews, questionnaires and the trust center that answers them","Product security practice — secure development, vulnerability handling and disclosure","Privacy engineering and the data-handling commitments made to customers"],"out_of_scope":["Enterprise security operations, identity and threat detection for the company (see BC-760)","Regulatory compliance programs for the company as a legal entity (see BC-140)","Negotiating security and privacy terms in contracts (see BC-150)"],"csdm_note":"Attestations attach to the product Application Services and the Service Offerings they cover; controls map to the services and data they protect, which is where an auditor will ask to see the evidence.","status":"active","successor_id":null,"child_ids":["BC-1270.10","BC-1270.20","BC-1270.30","BC-1270.40","BC-1270.50"]},"crosswalk":{"realized_by":[],"used_in":[{"vs_id":"VS-100","vs":"Commit-to-Production","stage_id":"VS-100.20","stage":"Test & Secure","order":2,"via":"BC-1270.30"}],"patterns":[],"stacks":[],"books":[{"id":"BK-threat-modeling","title":"Threat Modeling","topic":"Security","via":"BC-1270.30"}]},"ancestors":[],"children":[{"id":"BC-1270.10","name":"Certification & Attestation","level":2,"child_count":4},{"id":"BC-1270.20","name":"Customer Security Review","level":2,"child_count":3},{"id":"BC-1270.30","name":"Product Security Engineering","level":2,"child_count":4},{"id":"BC-1270.40","name":"Vulnerability & Disclosure Handling","level":2,"child_count":4},{"id":"BC-1270.50","name":"Privacy Engineering","level":2,"child_count":4}]}