For the bigger picture, start with AdviceAid security and compliance: start here.

Our position on certifications

AdviceAid does not hold Cyber Essentials, Cyber Essentials Plus or ISO 27001 certification. This is a deliberate choice. We focus our effort on the security controls themselves and on independent testing, rather than on holding a certificate.

The reason is the risk profile. AdviceAid holds no citizen personal data, only your staff members' names and email addresses for sign-in. With so little personal data involved, the technical controls described across these articles, together with independent penetration testing by a CREST-accredited provider, give councils a clear and verifiable picture of how AdviceAid is secured.

PCI DSS does not apply, because AdviceAid takes no payments.

If your procurement process treats a specific certification as mandatory, contact us early so we can talk it through.

Penetration testing

AdviceAid is penetration tested by Evalian, an independent UK security consultancy that is CREST- and CHECK-accredited. Testing covers the OWASP Top 10 and other common web application vulnerabilities, and findings are remediated.

We can confirm our testing schedule and the date of the most recent test on request, and discuss sharing a summary of the results.

Vulnerability management and patching

  • External vulnerability scanning is carried out monthly.

  • Remediation is prioritised by severity: critical issues within 7 days, high issues within 14 days.

  • Routine patching: We monitor high-risk security updates and aim to apply them within 14 days of release.

  • Changes go through change control with the ability to roll back.

Secure development

  • All software is managed in source control.

  • The cloud environment is defined and managed as infrastructure as code, so its configuration is known, consistent and repeatable.

  • We keep our frameworks and dependencies up to date to take in the latest security fixes.

  • Changes are released through change control, with separation of duties between the people who make and approve changes.

Governance and policies

We maintain documented policies covering cyber security, data protection and data breach handling, and we keep a security risk register. Incident handling is covered in Resilience and incident management.

People and training

Administrative access to AdviceAid is limited to a small number of named Neatlines staff. All staff sign a confidentiality agreement and complete regular security awareness training. We can confirm our staff screening arrangements on request.

What is out of scope here

PCI DSS does not apply, as AdviceAid processes no payment or card data. See the out-of-scope list in AdviceAid security and compliance: start here.

Who to contact

For questions about testing, vulnerability management or certifications, contact Peter McGuire at peter.mcguire@adviceaid.uk