SIG (Shared Assessments) C: Maintain an information security program, policy and organisation

SIG risk domain C, Information Assurance. The third party maintains an information security program aligned to a control framework, with a security policy covering confidentiality, integrity and availability, reviewed at planned intervals for suitability, adequacy and effectiveness, and a defined security organisation with roles and reporting lines. Since 2023 this domain merges the former Security Policy and Organizational Security domains.