ARUKUS / SECURITY & TRUST
Trust needs a clear control story.
Understand the information being handled, the people who can act on it and the evidence available for review. A useful security discussion connects company governance with the actual deployment.
ISO/IEC 27001:2022 company certification. Deployment-specific review.
Discuss your requirementsInformation lifecycle
Protect the information across its lifecycle.
Select a checkpoint to explore the work, information and responsibility involved.
Classify the records, permitted use, retention and handling responsibilities.
A practical security review.
Bring security questions into discovery while there is still time to shape the implementation.
AT THIS STAGE
Understand the information
Identify business records, personal information, documents, exports and connected providers. Agree the intended use and owners.
Evidence to carry forwardInformation inventory and handling requirements.
People to involveBusiness data owner, privacy/security reviewer and product owner.
The review areas behind the trust statement.
Use this framework to request implementation-specific evidence rather than relying on an unqualified assurance.
Access control
Can users act only within the responsibilities agreed for their role?
Responsible reviewer
Customer identity owner and application administrator.
Read the result in context
Additional authentication or identity-provider requirements must be confirmed for the selected product.
From the diagram to daily decisions.
Arukus’s supplied company profile identifies the company as ISO/IEC 27001:2022 certified. Procurement and security teams can request the current certificate and scope for their review. Certification concerns the organisational information security management system; the controls for a customer deployment depend on the product, architecture and agreed responsibilities.
Make information ownership explicit
The customer’s information needs an identified business owner and a defined purpose. Discovery should cover what is captured, which users see it, where it is exchanged and how long it is retained. Include attachments, reports and exported copies in that discussion rather than examining only the primary database.
Review privileged actions as well as ordinary roles
Permissions should be examined around the work: who submits, reviews, approves, changes rules, manages users or exports records. Account creation, role changes and removal need an operating owner. Authentication and identity-provider requirements are confirmed against the chosen product and environment.
Ask for architecture-specific evidence
Protection in transit and at rest, key ownership, backup access and environment separation need to be understood in their implementation context. Security review should establish which controls exist, which are configured during delivery and which require additional work. Detailed materials can be shared through an agreed review process.
Keep secure development connected to release
Discuss source review, dependency handling, testing and the treatment of security findings as part of the delivery scope. Agree who accepts the release, how unresolved findings are prioritised and how later changes are reviewed. Avoid treating a single security test as evidence that an application no longer needs maintenance.
Prepare for a concern before it occurs
Identify the customer and supplier contacts for incident assessment, technical investigation and recovery decisions. Agree how sensitive evidence will be exchanged. Backup and recovery responsibilities, objectives and testing belong in the service arrangement and should reflect the business process being supported.
Request the right material safely
Use the contact route to request the current certificate, relevant policies and a product-specific security discussion. Do not send passwords, production extracts or vulnerability details through the ordinary enquiry form. The team can agree an appropriate channel for sensitive review material.
Questions before you begin
Can we review the current certificate?
Yes. Request the certificate and its scope for procurement review. Confirm its applicability to the proposed engagement with our team.
Is every listed control already enabled in every product?
No. This page sets out the review areas. Product capability, configuration, hosting and engagement scope determine the implemented controls.
Can our IT or security team join the discovery session?
Yes. Bringing the responsible reviewers in early helps resolve access, data, integration and acceptance requirements before release.
Does certification guarantee regulatory compliance?
The organisation’s policies, implementation and operating practices remain part of its compliance responsibilities. Software supports defined controls and evidence.