02 — Capability · BC-1270.10
Certification & Attestation
Obtain and maintain the third-party audits and certifications customers ask for, with a control set that is operated continuously rather than assembled the month before the audit.
- Audit Readiness
- Control Framework
- Compliance Automation
In scope
- Control framework mapped to each certification pursued
- Continuous evidence collection
- Audit coordination and findings remediation
Out of scope
- Financial and internal audits of the company (see BC-160)
Decomposes into · 4
- BC-1270.10.10Control Framework ManagementMaintain one control set that satisfies every certification the product holds, so a control is operated once and evidenced many times.
- BC-1270.10.20Continuous Evidence CollectionGather proof that controls operate, automatically where the systems allow, so audit is a review rather than a scramble.
- BC-1270.10.30Audit CoordinationRun external audits, respond to findings and track remediation to closure on the dates committed.
- BC-1270.10.40Certification Scope PlanningDecide which attestations, regions and product surfaces to certify next, based on what buyers actually require.