Security Frameworks: Sage has built its information security management system using the international standard ISO 27001. We use standards and frameworks such as ISO 27002, NIST, and AICPA when selecting and designing security controls and processes required for achieving our cyber security risk objectives.

Policies: Sage ensures compliance with security standards and regulations through rigorous corporate governance. This means policies covering information security, secure development, acceptable use of our internal systems, personal data protection, and data handling are routinely reviewed, updated, and embedded in the organisation.

Legal: Sage supports legal compliance by regularly reviewing the regulatory and legal landscape for new or potential updates, conducting audits of legal compliance and maintaining a record of processing activities (ROPA) as required under Article 30 of the GDPR.

GDPR and CCPA: Sage is compliant with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and all other relevant data privacy regulations in the jurisdictions where we process data.

ISO 27001: the only auditable international standard that defines the requirements of an information security management system (ISMS) which is a set of policies, procedures, processes and systems that manage information security risks, such as cyber attacks. We’re certified to ISO 27001 for the secure development and operations of our cloud-based accounting, financial management, HR & people and business management software as a service (SaaS) within the Sage Business Cloud.

SOC 2: an internal controls report that captures how a company safeguards customer data and how well those internal controls are operating. At Sage, we are continually expanding the scope of these reports to include more products and services.

The Payment Card Industry Data Security Standard (PCI DSS): a set of policies and procedures designed to optimise the security of credit, debit, and cash card transactions. Sage is compliant with PCI DSS at Level 1, ensuring the protection of cardholders against misuse of their personal data.

The Health Insurance Portability and Accountability Act (HIPAA): it sets the standard for sensitive patient data protection. Sage Intacct is certified to meet the requirements of the HIPAA.

Control assurance: we maintain a comprehensive security control assurance programme that seeks to ensure our products meet our product security standards and are regularly reviewed against this standard so that we understand the effectiveness of our security controls.

Change management: all updates, patches, or new software releases are governed by change or release management processes and strict standards.

Access controls: the principle of 'least privilege' is central to our access control processes, from provisioning access, managing privileged access to data and systems, and the requirements and contractual agreements with our suppliers.

Cryptography: we formalise our cryptography requirements in mandatory policies and standards. We define the cryptographic algorithms and schemes approved for use in Sage products and solutions.

Incident response, business continuity, and disaster recovery: we regularly test and exercise our incident response and business continuity policies and procedures and data backup and recovery plans against various scenarios to ensure we can respond effectively in the face of any incident.