What are the ISO 27001 compliance requirements?

Alessandro Micagni

On May 25th, 2023

This article delves into ISO 27001, a global benchmark for ISMS, crucial for the protection of an organization's vital data assets. It explores the compliance requisites, including risk-based controls and the necessity for a systematic method to manage information risks.

What are the ISO 27001 compliance requirements?

Understanding ISO 27001 Compliance and Its Importance

ISO/IEC 27001 is the world-leading standard for establishing, operating, and continually improving an information security management system (ISMS). The framework sets out a systematic suite of policies, processes, and controls that protect information assets throughout their life-cycle. Achieving ISO 27001 compliance signals that an organisation approaches data security, privacy, and risk management with professional rigour, an expectation that is especially acute in regulated regions such as the European Union and the United Kingdom.

For compliance officers, ISO 27001 offers a clear, auditable roadmap for identifying and treating information-security risks while dovetailing with statutory obligations like the EU General Data Protection Regulation (GDPR). Its risk-based methodology and comprehensive Annex A controls have made the standard the de-facto yardstick for demonstrating regulatory due diligence in both data-protection and cyber-security programmes.

Regulatory bodies endorse this practical value. ENISA has mapped GDPR-recommended safeguards directly to ISO 27001 controls, showing how the framework delivers the “appropriate technical and organisational measures” demanded by the GDPR. In the UK, the National Cyber Security Centre (NCSC) routinely encourages suppliers to align with ISO 27001, reinforcing the standard’s role as a baseline for robust cyber governance.

Originally published in 2005 (building on BS 7799) and updated in 2013 and 2022, ISO/IEC 27001 has been adopted by thousands of organisations—from SMEs to global enterprises, across Europe and beyond. This long track record underpins the framework’s authority and the trust it commands among regulators, customers, and partners. By embracing ISO 27001, organisations demonstrate a mature, continuously improving approach to information security that inspires confidence across their entire stakeholder ecosystem.

ISO 27001:2013 vs. ISO 27001:2022: What Changed for ISO 27001 Compliance?

The October 2022 update of ISO 27001 is the first major revision since 2013. Although the standard still follows the familiar Plan-Do-Check-Act cycle, several refinements tighten its alignment with today’s regulatory and threat landscape, knowledge every organisation seeking ISO 27001 compliance must master.

Clause-level refinements

Context of the organisation (Clause 4.2): You must now document which specific stakeholder needs the ISMS will address, not just list the parties themselves.
Planning of changes (new Clause 6.3): Any alteration to the ISMS must follow a formal, pre-planned change-management process.
Operation (Clause 8.1): Instead of keeping detailed, static implementation plans, organisations must define clear performance criteria for each ISMS process and monitor them over time.

These wording tweaks harmonise ISO 27001 with other management-system standards such as ISO 9001 and push teams toward proactive, evidence-based governance.

Annex A restructuring

The control set shrinks from 114 to 93 by merging overlaps and renaming out-of-date items.
Controls are regrouped from 14 domains into four broader themes—Organisational, People, Physical, and Technological—making the catalogue easier to navigate and map to modern frameworks.

Eleven new controls to implement

A.5.7 Threat intelligence – build a programme for gathering and analysing threat data.
A.5.23 Cloud security – govern information security when consuming cloud services.
A.5.30 ICT readiness for business continuity – ensure critical ICT can withstand disruption.
A.7.4 Physical security monitoring – detect unauthorised physical access or tampering.
A.8.9 Configuration management – prevent unauthorised or untracked system changes.
A.8.10 Information deletion – apply auditable, secure data-disposal practices.
A.8.11 Data masking – obfuscate sensitive data in test or shared environments.
A.8.12 Data leakage prevention – detect and stop unauthorised exfiltration.
A.8.16 Monitoring activities – perform continuous, centralised security monitoring (e.g., via SIEM).
A.8.23 Web filtering – restrict access to malicious or non-business websites.
A.8.28 Secure coding – integrate security controls into every phase of software development.

These additions spotlight emerging priorities, especially threat intelligence and cloud governance, that barely existed a decade ago but are now essential for credible ISO 27001 compliance.

Control attributes for flexible mapping

Every 2022 control carries optional attributes (e.g., preventive versus detective, confidentiality-integrity-availability focus, cyber-security concept). While using them is voluntary, they help compliance teams present the control set through different lenses, such as mapping to GDPR articles, the NIST Cybersecurity Framework, or contractual security clauses, without rewriting core documentation.

Transition deadline

Current ISO 27001:2013 certificates remain valid until 31 October 2025. Certification bodies started auditing against the 2022 edition in late 2023, so conduct a gap analysis, update policies, and schedule your surveillance or recertification audit well in advance. Letting the certificate expire could jeopardise customer contracts or regulatory standing that require uninterrupted ISO 27001 compliance.

Table 1: Comparison of ISO/IEC 27001:2013 vs ISO/IEC 27001:2022 (Key Structural Differences)

Aspect	ISO/IEC 27001:2013	ISO/IEC 27001:2022
Main Clauses (4–10)	7 clauses (Context, Leadership, … Improvement) – unchanged structure	7 clauses (same titles) – minor wording updates for clarity
Annex A Controls	114 controls in 14 domains (A.5–A.18)	93 controls in 4 themes (Organizational, People, Physical, Technological); 11 new controls added
Control Grouping	14 specific control categories (e.g. Asset Management, Cryptography, Supplier Security, etc.)	4 high-level control categories (broader groupings to streamline topics)
Control Attributes	Not present (controls listed without meta-categorization attributes)	Each control includes 5 attributes (e.g. control type, security property, cyber concept, operational capability, security domain)
Transition Deadline	N/A (2013 version now superseded)	Existing certs must upgrade by Oct 31, 2025 (after which 2013 certs expire)

ISO 27001 Clause Structure: How Clauses 4-10 Drive ISO 27001 Compliance

ISO/IEC 27001 follows the common ISO “High-Level Structure,” but only Clauses 4 through 10 contain the mandatory requirements your information-security management system (ISMS) must satisfy. Together they form a Plan-Do-Check-Act (PDCA) loop that regulators and auditors use to gauge the maturity of your security governance. Below is an SEO-optimised, table-free walkthrough of each clause, updated for the ISO 27001:2022 edition and mapped to the expectations of EU GDPR, UK NCSC guidance and other oversight bodies.

Clause 4 – Context of the Organisation

Identify internal and external issues, list interested parties, and set the ISMS scope. The 2022 update demands you analyse which stakeholder needs the ISMS will actually meet, forcing an explicit link between legal or contractual obligations (for instance, GDPR Articles 5 & 32 or client security addenda) and day-to-day security planning.

Clause 5 – Leadership

Top management must champion the ISMS, publish an information-security policy, and assign roles such as the CISO or ISMS manager. Regulators look for evidence of board-level buy-in, minutes from executive meetings, signed policies and clear lines of responsibility, because accountability is a cornerstone of ISO 27001 compliance and GDPR’s “accountability principle.”

Clause 6 – Planning

Plan how to tackle risks and opportunities.

Risk assessment & treatment (6.1): Identify, analyse, evaluate and decide whether to avoid, mitigate, transfer or accept each risk; document choices in the Statement of Applicability (SoA).
Security objectives (6.2): Set measurable, monitored goals aligned with the policy (e.g., reduce phishing click-rate to <3 %).
Planning of changes (new 6.3): Any expansion of scope or response to new regulation must follow a formal change-management process, mirroring good practice in ISO 9001 and ITIL.

Clause 7 – Support

Provide resources, ensure staff competence, raise security awareness, control communications and maintain documented information. Compliance officers must show:

Verified competency records (secure-coding training for developers, phishing awareness for staff).
A communications plan for incidents and escalations.
Version-controlled policies, risk registers and procedure documents—critical under GDPR’s documentation duties.

Clause 8 – Operation

Execute the risk-treatment plan and run the selected controls. 2022 wording now requires setting criteria for each operational process and managing activities against those criteria. Auditors will sample evidence such as backup-restore logs, access-review checklists or service-provider monitoring records to confirm controls are both implemented and effective.

Clause 9 – Performance Evaluation

Measure, analyse and evaluate the ISMS via:

Internal audits (9.2): Scheduled reviews (at least annually) to confirm conformity and effectiveness.
Management review (9.3): Senior leadership must assess audit results, incident trends, KPI outcomes and changing risk landscapes, deciding on improvements.

This “Check” stage demonstrates a self-correcting governance loop essential for sustained ISO 27001 compliance.

Clause 10 – Improvement

When nonconformities arise, through incidents, audit findings or management-review actions—you must investigate root causes, apply corrective actions and update the ISMS to prevent recurrence. The 2022 edition renumbers sub-clauses but keeps the focus on continual improvement, a concept regulators value highly (e.g., GDPR’s expectation of evolving “appropriate technical and organisational measures”).

Risk Assessment Methodology in ISO 27001 Compliance

At the core of ISO 27001 compliance lies a living, risk-based approach rather than a rigid checklist. Clause 6.1 of the standard obliges each organisation to identify, analyse, evaluate, and treat information-security risks in a way that fits its business, legal, and contractual realities. Done well, this methodology becomes the control hub that links GDPR Article 32, UK NCSC guidance, the upcoming EU NIS2 Directive, and any client security clauses into one coherent ISMS.

1. Establish Risk Criteria

Define how you will measure risk, typically by setting a risk appetite and qualitative or semi-quantitative scales for likelihood and impact (for example, 1 to 5). These thresholds determine which risks are tolerable and which demand treatment, giving executives a clear yardstick for decision-making.

2. Identify Assets, Threats, and Vulnerabilities

List every in-scope information asset, databases, SaaS platforms, paper records, business processes—and map realistic threat scenarios (malware, insider misuse, fire, supply-chain failure) and exploitable weaknesses. Whether you choose an asset-centric, scenario-based, or hybrid approach, the goal is a catalogue of risk events that could compromise confidentiality, integrity, or availability.

3. Analyse Risk

For each scenario, estimate likelihood and business impact to produce an inherent risk level (Low / Medium / High or similar). Keep records: auditors expect to see the reasoning behind each rating, not just the final score.

4. Evaluate Risk

Compare inherent risks with your risk-acceptance criteria. Any risk above the defined tolerance, often all “High” and many “Medium” items—must be treated. Lower-tier risks can be accepted but still need documented justification.

5. Treat Risk

Select controls that will reduce unacceptable risks to an acceptable residual level. ISO 27001 Annex A (93 controls in the 2022 edition) is your primary menu, but other technical or contractual measures are allowed. Legal requirements override any risk calculus, e.g., if GDPR or a customer master-service agreement requires encryption, that control is mandatory regardless of score.

6. Obtain Approvals

Senior management must sign off on both the risk assessment and the Risk Treatment Plan, formally accepting any residual risk. This step aligns with GDPR’s accountability principle and demonstrates top-level ownership to regulators and certification auditors.

The Statement of Applicability (SoA): Your Auditor’s First Stop

The SoA is a mandatory, master list that states whether each Annex A control is applied, partially applied, or not applicable, with a concise justification. It bridges risk assessment and control selection:

Controls applied map directly to specific risks, laws, or contractual demands.
Controls not applied must be justified by the absence of relevant risk or requirement.

Under ISO 27001:2013 the SoA covered 114 controls; under ISO 27001:2022 it must reference the streamlined 93. Transitioning organisations should update the SoA to reflect merged, renamed, and, crucially, 11 new controls such as Threat Intelligence and Secure Coding. Conversion guides help, but a manual review ensures no new obligation is missed.

Keeping the Risk Assessment Fresh

ISO 27001 expects the risk assessment to remain current. Best practice is to re-evaluate risks annually or whenever material changes occur—new cloud platforms, mergers, regulatory shifts like the NIS2 Directive, or emerging threats. Clause 6.1 also encourages seeking “opportunities,” meaning improvements that go beyond risk mitigation, such as automating security monitoring or adopting zero-trust architecture.

Using ISO/IEC 27005 and Other Frameworks

While ISO 27001 is flexible on methodology, ISO/IEC 27005 offers detailed guidance that dovetails with the standard. Many organisations blend its techniques with NIST’s Risk Management Framework or OCTAVE, provided the chosen method satisfies Clause 6.1 criteria and feeds seamlessly into the SoA.

Annex A Security Controls: How They Power ISO 27001 Compliance

Annex A is the beating heart of ISO 27001 compliance. It offers a consolidated catalogue of security controls that organisations can select, apply, adapt, or justifiably exclude, to mitigate the risks uncovered in their ISMS. Mastering this control set is essential for compliance officers who must prove that every legal, contractual, and business requirement is met.

From 14 Domains to 4 Themes

In ISO 27001:2013, Annex A listed 114 controls across 14 domains, covering everything from security policy (A.5) and access control (A.9) to incident management (A.16) and compliance with privacy laws (A.18). The 2022 revision streamlines these into 93 controls grouped under four themes, organisational, People, Physical, and Technological. Controls were merged rather than discarded; for example, separate mobile-device and teleworking controls now live inside a single, clearer requirement. Far from shrinking the scope, the 2022 edition expands coverage through 11 brand-new controls for topics such as Threat Intelligence and Secure Coding, areas barely on the radar in 2013.

What Each Theme Covers

Organisational controls: governance, policies, supplier security, incident response, business-continuity readiness (now reinforced by control A.5.30, “ICT readiness for business continuity,” which dovetails with ISO 22301 and NIS2 resilience expectations).
People controls: background screening, awareness training, disciplinary measures, and user-centric access responsibilities, key for GDPR accountability.
Physical controls: site access, equipment protection, environmental safeguards, still crucial even for cloud-first firms with hybrid workforces.
Technological controls: encryption, network security, logging, secure development life-cycle, data-leakage prevention, web filtering, and more, the bulk of day-to-day cyber hygiene.

Regulatory Alignment Built In

Annex A lets you map technical measures directly to legal obligations. Need encryption and pseudonymisation for GDPR Article 32? Apply the Encryption control (Technological) and the new Data Masking control (A.8.11). Supplier contracts demanding security clauses? Organisational controls on supplier management guide due-diligence checks and contractual wording. Regulators in the EU and UK favour this structured approach because it demonstrates that controls stem from a documented risk assessment, rather than ad-hoc decisions.

The Statement of Applicability (SoA): Your Compliance Blueprint

For every Annex A control, the SoA states whether it is:

Applied: mapped to specific risks, laws, or client requirements.
Not applicable: excluded with a solid, risk-based rationale (e.g., a fully remote firm may document why certain on-site physical controls are unnecessary).

Transitioning from 2013 to ISO 27001:2022 means updating the SoA—merging old control IDs, adding items for the 11 new controls, and ensuring nothing slips through the cracks. Auditors ask for the SoA first because it distils your entire control logic onto a single, accountable document.

Implementation Tips for Compliance Officers

Validate coverage — cross-check every GDPR, NIS2, or sector-specific requirement against an Annex A control or equivalent measure.
Assign ownership — each control needs a named responsible party plus documented procedures or run-books.
Collect evidence — retain logs, reports, and testing artefacts that show controls are operating effectively.
Review and iterate — update controls when regulations change, new threats emerge, or internal audits expose gaps.
Consult ISO 27002:2022 — use the companion guideline for practical “how-to” advice and up-to-date cryptographic recommendations.

Certification Journey — Achieving and Sustaining ISO 27001 Compliance

Earning an ISO 27001 certification is the most credible way to prove your organisation’s information-security management system (ISMS) meets the International Standard. While not compulsory, certification is increasingly expected by customers, partners and, in some EU/UK sectors, regulators. Below is a streamlined, SEO-optimised walkthrough of the end-to-end process, including the vigilance required to maintain continuous ISO 27001 compliance.

1. Preparation and Gap Analysis

Begin with an internal gap analysis, or “pre-audit.” Compare every clause (4-10) and Annex A control against current practice, highlight shortfalls in documentation or implementation, and fix them before the formal audit. Many organisations use an ISO 27001 checklist or engage a consultant at this stage to avoid costly surprises later.

2. Stage 1 Audit: Documentation Review

An accredited certification body reviews the ISMS on paper: scope, policies, risk assessment, Statement of Applicability (SoA), incident-handling flow, internal-audit plan and recent management-review minutes. The outcome is a Stage 1 report listing any documentation gaps; you must close these before progressing.

3. Stage 2 Audit: Certification Assessment

Auditors now test the ISMS in action, interviewing staff, checking logs, inspecting configurations, observing training records and verifying that every declared control operates as described. Minor non-conformities must be corrected promptly; major ones jeopardise certification. When the audit team is satisfied, the certification body’s review panel issues an ISO/IEC 27001 certificate (typically valid for three years).

4. Surveillance Audits: Ongoing Oversight

Years two and three bring shorter, annual surveillance audits. Each visit samples different clauses and controls to confirm the ISMS remains effective and continually improving. Failure to address surveillance findings risks suspension or withdrawal of the certificate.

5. Recertification Every Three Years

At the end of each cycle, a comprehensive recertification audit re-examines the entire ISMS, including any evolution of the standard (e.g., moving from ISO 27001:2013 to ISO 27001:2022). Passing renews the certificate for another three-year term and restarts the surveillance cycle.

Continuous Internal Governance

Internal audits: Clause 9 requires regular in-house audits, usually annual, sometimes rolling, to catch issues early.
Management reviews: Senior leadership must assess audit results, incident metrics and risk trends, ensuring resources and direction stay aligned with business and regulatory change.
Non-conformity handling & corrective action: Any detected weakness, internal or external, must trigger root-cause analysis and documented fixes. Persistent improvement is a core ISO 27001 principle and aligns with EU/UK regulators’ expectations that security controls reflect “state of the art” practice.

Accreditation Matters

Choose a certification body accredited by UKAS (UK) or a member of the European co-operation for Accreditation. Certificates issued by non-accredited bodies lack credibility in tenders, regulator reviews and international supply-chain due-diligence checks.

ISO 27001 Compliance in the EU & UK Regulatory Landscape

ISO 27001’s real-world value emerges when it underpins legal and industry obligations, especially the EU GDPR, UK GDPR, and the incoming NIS2 Directive. By running a certified ISMS, organisations gain a ready-made, audit-trail-rich framework that aligns with the “appropriate technical and organisational measures” demanded by regulators.

Article 32 alignment: ISO 27001’s risk-based methodology mirrors GDPR’s risk-proportionate security rule. Controls for encryption, access control, backup, resilience, and regular testing are baked into Annex A, giving clear evidence that your security posture meets the standard of “appropriate measures.”
Accountability principle: Certification produces documented policies, risk decisions, audits, and improvement logs, exactly the artefacts Supervisory Authorities request after a breach.
Complementary standards: ISO / IEC 27701 extends ISO 27001 into a full Privacy Information Management System, but even without it, an ISO 27001-certified ISMS covers the bulk of GDPR’s security expectations.

Mapping ISO 27001 to NIS2 and UK NIS Regulations

Risk management parity: NIS2 obliges essential and important entities to perform risk analysis, incident response, business-continuity planning, and supply-chain security, core components of an ISO 27001 ISMS.
Control one-to-one: Supply-chain security requirements in NIS2 map to ISO 27001 supplier controls; incident-handling expectations align with Annex A.16; business-continuity readiness resonates with the new A.5.30 control.
Proactive leverage: Organisations already certified to ISO 27001 can demonstrate NIS2 compliance faster, cutting down on parallel audit work and satisfying national competent authorities. In the UK, the current NIS Regulations, and any future updates inspired by NIS2, fit the same mould.

Broader Regulatory & Commercial Benefits

Financial-sector resilience (e.g., DORA, FCA rules): ISO 27001 structures cyber-risk controls that banks and fintechs must prove to regulators and clients.
Breach-notification readiness: Annex A controls for incident detection and response help meet tight reporting timelines under GDPR and NIS2.
Supply-chain trust: ISO 27001 certification often satisfies customer security questionnaires and can be a contractual prerequisite for processors or critical ICT suppliers.
Public-sector procurement: UK government tenders frequently list ISO 27001 certification, or equivalent, as a differentiator above the basic Cyber Essentials scheme.

Practical Steps for Compliance Officers

Create a cross-reference matrix linking ISO 27001 controls to GDPR Articles, NIS2 obligations, DORA chapters, and any sectoral codes.
Identify and close gaps where legal requirements fall outside ISO 27001’s scope (e.g., data-subject rights) or where new ISO 27001:2022 controls need embedding.
Maintain evidence: logs, minutes, SoA updates, that shows continuous operation and improvement of controls.
Monitor regulatory updates from ENISA, the UK NCSC, and national data-protection authorities, feeding new guidance into the ISMS via Clause 10’s continual-improvement loop.

Best-Practice Roadmap for ISO 27001 Compliance

Implementing ISO 27001 compliance is more than a project plan; it is a cultural shift that must satisfy strict European and UK legal expectations while standing up to independent certification scrutiny. Use the checklist below to build an audit-ready, regulator-friendly ISMS and to embed lasting security discipline.

1 Secure Executive Commitment and Build Security Culture

Make the business case early: ISO 27001 is a revenue enabler that protects brand value, satisfies GDPR, NIS2 and customer clauses, and wins tenders. Obtain budget, appoint clear owners (CISO, ISMS manager) and cascade accountability through GDPR-focused awareness sessions (Clause 7.3). When staff understand that safeguarding personal data is both a legal and an ISO mandate, compliance becomes habit, not paperwork.

2 Define the ISMS Scope With Integrity

Draft a transparent scope statement (Clause 4.3) covering every location, process and asset that touches personal data or critical services. Exclude only where justified—regulators and auditors dismiss “scope-creep” that hides high-risk operations. Document rationale for any exclusions so that supervisory authorities can see you are not gaming the perimeter.

3 Perform a Robust Risk Assessment and Asset Inventory

Run cross-functional workshops to catalogue systems, data flows and legal exposures. Include privacy-specific scenarios (unauthorised disclosure, data-subject rights failures) alongside cyber threats. A thorough, documented risk assessment underpins Article 32 of the GDPR and sets the agenda for Annex A controls.

4 Leverage Authoritative Guidance

Implement controls using ISO 27002:2022, ENISA good practice, NCSC guidance and sector codes (e.g., FCA cyber-resilience notes). Mapping ISO 27001 controls to frameworks like NIST CSF or CIS Controls can give extra assurance to multinational clients and regulators.

5 Integrate Legal & Regulatory Requirements

Maintain a compliance matrix linking each law, GDPR, UK DPA 2018, NIS/NIS2, DORA, PCI DSS, etc.—to specific ISMS controls. Example entry:
“GDPR Art 32 encryption → Annex A Cryptography Policy, laptop full-disk encryption, database TDE.”
This makes audits faster and proves that legal obligations drive technical safeguards.

6 Document, Version-Control, Communicate

Tailor and approve policies, SoA, risk registers, incident procedures, BCP/DR plans and GDPR policies. Host them on a version-controlled platform, obtain management signatures and notify stakeholders. Auditors quickly spot copy-paste templates; bespoke wording that references your systems and EU/UK law demonstrates expertise.

7 Implement Controls With Evidence in Mind

For every control, pre-think the artefacts that prove effectiveness: SIEM dashboards, phishing-test statistics, visitor logs, encryption key vault reports. Evidence readiness turns auditor interviews from stressful to straightforward.

8 Run an Internal (Mock) Audit First

Clause 9.2 demands internal audits; schedule one before the certification audit. Use in-house or external auditors to uncover non-conformities, execute corrective actions, and document root-cause analysis. This proactive step slashes Stage 2 audit findings.

9 Hold a Formal Management Review

Before external auditors arrive, convene top management (Clause 9.3). Review risk status, incident history, resource needs and improvement plans. Log decisions and actions, visible leadership is a strong trust signal for certification bodies and regulators alike.

10 Plan Continuous Improvement and Regulatory Watch

Set a rolling roadmap, automate access reviews, extend zero-trust, prepare for quantum-safe crypto. Track regulatory change: NIS2 implementing acts, ENISA threat landscapes, ISO amendments. Feed new requirements into Clause 10 improvement actions to show a living ISMS.

11 Prepare Staff for Auditor Interviews

Brief employees on relevant policies and day-to-day responsibilities. Reception should explain visitor sign-in; developers should outline secure-coding steps; HR must describe onboarding/off-boarding security. Authentic, confident answers signal a mature security culture.

12 Use ISMS Management Tools Wisely

Platforms that manage risk registers, policy attestations and automated evidence collection can reduce manual effort. Validate outputs and ensure alerts trigger real action; tools augment, not replace, human oversight.

13 Engage the Certification Body Early

Select a UKAS- or EA-accredited body. Discuss scope, language and remote-site logistics in advance. Consider a voluntary pre-assessment to iron out residual gaps.

Bottom Line

A disciplined, evidence-driven approach, anchored in ISO 27001’s clauses, Annex A controls and EU/UK regulatory specifics, turns certification from a hurdle into a strategic asset. By embedding these best practices, compliance officers ensure their ISMS not only passes audits but also delivers continuous, legally aligned protection that customers, partners and regulators trust.