Security certificates and assurance reports can support NGO ERP selection, but only when they cover the service being purchased. A logo on a sales slide does not explain which legal entity, application, hosting location or support process was examined. Procurement needs the underlying evidence and someone qualified to interpret it.
Treat vendor assurance as a review of scope, period, findings and responsibilities. Then combine it with tests of the NGO's own configuration. The two answer different questions: how the supplier manages its service, and whether the proposed setup enforces the controls the NGO needs.
Certificates, reports and tests answer different questions
ISO/IEC 27001 specifies requirements for an information security management system. AICPA's SOC resources describe a separate family of assurance services. A SOC report should not be labelled an ISO certificate or treated as interchangeable evidence.
Request the actual report type and what the auditor examined. Establish whether the evidence covers one date or a period of operation. Ask the reviewer what that boundary means for the purchase. Preserve the review conclusion without circulating confidential reports more widely than their terms allow.
What evidence should you request?
| Evidence | What To Establish | What It Does Not Automatically Establish |
|---|---|---|
| ISO/IEC 27001 certificate | Certified management-system scope, issuer and validity | Every application feature or customer configuration is secure |
| SOC report | Report type, system boundary, period, criteria and findings | Unqualified assurance over every service the vendor sells |
| Penetration-test report or summary | Tested scope, date, limitations and remediation status | All weaknesses are absent or permanently resolved |
| Recovery exercise | Service tested, result, elapsed recovery and remaining issues | Every customer workload will meet the same objective |
| Subprocessor list | Named service providers, processing roles and locations | The supplier's headquarters describes every processing location |
| Data-processing agreement (DPA) | Agreed privacy roles, instructions and assistance duties | Written terms prove that each operating control works |
| Incident policy and service terms | Response roles, escalation and agreed notification commitments | A policy alone demonstrates successful incident handling |
Does the evidence cover the offered service?
Start with the contracting entity and application operator. Add the infrastructure and backup providers, support team and subprocessors to the same boundary map. Add the data categories and locations involved. Compare every document against that map.
A cloud provider's evidence may cover the infrastructure. The ERP supplier still needs evidence for application access, releases, incidents and support. Likewise, a certificate covering one office may not cover a separate delivery entity. Ask for the connection in writing where the relationship is unclear.
Check the period and current status. A report covering a past period needs a review of subsequent changes. An expired certificate or a document for a retired product may explain history but should not silently satisfy a current requirement.
Read customer responsibilities
Some controls depend on the NGO: assigning roles, approving privileged users, protecting endpoints, reviewing logs or configuring retention. Put those responsibilities into the implementation and operating plan with named owners.
Connect them to security acceptance tests. If the organisation must disable departed users, test the complete route through identity services, active sessions, integrations and exports. A vendor assurance document does not perform that work on the customer's behalf.
What should happen to unresolved findings?
Ask how significant findings were assessed, what remediation is complete and what remains open. Seek evidence appropriate to the issue, such as a retest result or a changed process. Record whether the residual risk is acceptable and who made that decision.
For recovery, request a recent exercise relevant to the offered service. Compare the recovered data point and restoration time with the NGO's objectives. Ask how the team verified data integrity and reconciled transactions after restoration. Restoring a server is not necessarily the same as restoring a usable operational process.
Review incident escalation contacts and coverage outside normal office hours. Agree how the NGO receives information, preserves evidence and coordinates its own decisions. Keep contractual notification terms aligned with the organisation's applicable obligations and response plan.
Include vulnerability, payment and continuity evidence
Ask how vulnerabilities are identified, prioritised, remediated and retested. A penetration-test summary should connect unresolved findings to that process. Confirm who maintains the application, infrastructure and integrations so a component is not left outside every supplier's responsibility.
Where card payments are in scope, review the applicable PCI DSS responsibilities and provider evidence. The PCI Security Standards Council explains that outsourcing processing does not remove the merchant's responsibility for protecting account data. Keep that review specific to the payment arrangement.
The recovery time objective, or RTO, is the target time to restore the required service. The recovery point objective, or RPO, is the acceptable data-loss window. Agree how each will be measured. Business continuity also needs people, communications and temporary working procedures while systems are unavailable, not only technical restoration.
Turn the review into a procurement decision
Give each requirement a result and a reason. Use satisfied, conditional, unresolved or unacceptable. A conditional result needs an owner, deadline and acceptance evidence. Important unresolved matters should remain visible in the NGO ERP vendor scoring methodology rather than being replaced by a high generic security score.
Make evidence requests proportionate to the data and service risk. A provider handling highly sensitive beneficiary records merits deeper review than a tool holding public event listings. Confidentiality restrictions can be addressed through an appropriate review arrangement; they should not automatically mean either rejection or acceptance without evidence.
Record the final service boundary and commitments in the RFP and contract schedules. Set a review trigger for major changes, including new subprocessors, locations, ownership or critical integrations.
Assurance changes with the operating boundary
| Arrangement | Supplier Evidence | NGO Or Contracted-Operator Evidence |
|---|---|---|
| Causeway Cloud | Exact contracted application and hosting-service scope | Identity administration, endpoint controls and business recovery acceptance |
| Private Cloud | Application scope plus dedicated-environment responsibilities | Evidence for any customer-managed infrastructure and agreed shared duties |
| Self-Hosted | Application release and support responsibilities | Infrastructure, database, patching, backup and recovery operation |
For a scope-verification example, a certificate naming Hosting Entity A does not automatically cover Application Operator B or the NGO's local administrator. Record each party and the evidence that covers its work. If the document excludes a proposed region or service, the requirement remains unresolved until appropriate evidence is supplied.
Identify incompatible duties and compensating reviews with the Segregation-of-Duties Matrix.
Conclusion
Trust evidence is useful when its scope matches the actual service and its findings are understood. Review the documents, assign customer responsibilities and test the proposed configuration. This produces a defensible selection decision without assuming that any certificate or report eliminates operational risk.
Request Causeway assurance evidence
Evaluate Causeway against the security and assurance requirements for your selected cloud, private-cloud or self-hosted arrangement. Request current evidence for the exact service, entities and operating responsibilities. An ERP consulting review can connect those requirements to configuration tests, recovery evidence and contract conditions. Assign an owner to each unresolved item before acceptance.
Frequently asked questions
Does ISO/iec 27001 prove every ERP feature is secure?
No. The certificate concerns the management system within its defined scope. Review that scope and supplement it with evidence and tests relevant to the application, hosting arrangement and customer configuration you plan to use.
Can a vendor share only a report summary?
A summary can support initial screening, but it may omit boundaries, findings or customer responsibilities needed for the decision. Agree an appropriate confidential review process for material evidence and record any limitations that remain unresolved.
Should security evidence be reviewed only once?
No. Set a review cadence proportionate to risk and revisit material service changes. Updated reports, incidents, new subprocessors or changed data use may affect the original decision and the controls the NGO must operate.
