--- title: For compliance teams · Codekeeper description: What DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, and SOC 2 ask for, what Codekeeper puts on file per application, and how to run due diligence on us. canonical_url: https://codekeeper.co/compliance-teams --- Solutions [All solutions](https://codekeeper.co/solutions) [DORA](https://codekeeper.co/solutions/dora) [PRA SS2/21](https://codekeeper.co/solutions/pra-ss221) [NIS2](https://codekeeper.co/solutions/nis2) [CRA](https://codekeeper.co/solutions/cra) [ISO 27001](https://codekeeper.co/solutions/iso-27001) [SOC 2](https://codekeeper.co/solutions/soc-2) [ISO 22301](https://codekeeper.co/solutions/iso-22301) [FFIEC](https://codekeeper.co/solutions/ffiec) [CPS 230](https://codekeeper.co/solutions/cps230) [ESMA](https://codekeeper.co/solutions/esma) [EU AI Act](https://codekeeper.co/solutions/eu-ai-act) [Cbw](https://codekeeper.co/solutions/cbw) [OpEx](https://codekeeper.co/solutions/opex) By role · Compliance teams # What your framework asks for. _What goes in your file._ For compliance officers and internal audit. DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, and SOC 2 each ask whether the software you rely on could be brought back without its supplier, and whether the exit has been tested. Codekeeper produces dated evidence for each application, and gives you the documents to review Codekeeper itself. [Book a demo](https://codekeeper.co/book-a-demo) Get the sample evidence pack * Trusted by 3 500+ teams * ISO/IEC 27001:2022 certified, audited by BSI * Evidence for DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, and SOC 2 files ![A compliance officer walks an auditor through the supplier controls on file](https://codekeeper.co/hubfs/codekeeper-site/images/scenes/iso-27001-1200.webp) **Evidence on file**Example Insurance Group · 3 applicationsEvidence current **Policy Admin**Resilience Pro · Recoverability Certificate · Run #8Passed **Claims Portal**Exit Exercise Report · DORA annexPass **Broker Portal**Escrow · Vault Certificate · Vault ReportCurrent Example account. Names are fictional. Trusted by 3 500+ teams, from regulated enterprises to fast-growing software vendors ![Airbus](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/airbus.svg) ![Bayer](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/bayer.svg) ![European Parliament](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/eu-parliament-dark.svg) ![General Motors](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/general-motors.svg) ![Intuit](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/intuit.svg) ![Nestlé](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/nestle.svg) ![PepsiCo](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/pepsico.svg) ![Pfizer](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/pfizer.svg) What your frameworks ask ## Different rules. The same questions underneath. Whether you answer to DORA, PRA SS2/21, NIS2, CPS 230, ISO 27001, or SOC 2, the auditor's question is close to the same: if a supplier failed, could you bring the software back and keep working, and how do you know? The question has moved from "do you have a contract?" to "could you leave, and keep running?" Each page below lines the evidence up with the wording of one framework. [EU DORA Regulation (EU) 2022/2554 · financial entities Exit plans for ICT services that support critical or important functions: comprehensive, documented, sufficiently tested, and reviewed periodically (Article 28(8)). DORA evidence](https://codekeeper.co/solutions/dora) [UK PRA SS2/21 PRA supervisory statement · outsourcing and third parties Exit plans for material outsourcing that cover stressed exits, appropriately documented and tested as far as possible (paragraphs 10.10 and 10.24). PRA SS2/21 evidence](https://codekeeper.co/solutions/pra-ss221) [EU NIS2 Directive (EU) 2022/2555 · essential and important entities Business continuity, such as backup management and disaster recovery, and supply chain security, taking each direct supplier into account (Article 21(2)(c) and (d)). NIS2 evidence](https://codekeeper.co/solutions/nis2) [AU CPS 230 Australia · APRA operational risk management For each material arrangement, being able to execute the BCP and to conduct an orderly exit if needed (paragraph 55). Core technology services are material by default (paragraph 49). CPS 230 evidence](https://codekeeper.co/solutions/cps230) [ISO ISO 27001 ISO/IEC 27001:2022 · information security management Annex A controls for supplier relationships (5.19 to 5.22), information security during disruption and ICT readiness for business continuity (5.29 and 5.30), and information backup (8.13). ISO 27001 evidence](https://codekeeper.co/solutions/iso-27001) [US SOC 2 United States · service organization audits Vendor and business partner risk (CC9.2) and business disruption (CC9.1), and, if Availability is in scope, backup and recovery infrastructure (A1.2) and recovery plan testing (A1.3). SOC 2 evidence](https://codekeeper.co/solutions/soc-2) Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. Not sure which frameworks apply to you? Take the [compliance scan](https://codekeeper.co/impact-analysis) , or see [all solutions](https://codekeeper.co/solutions) . Evidence at every level ## Having the code is the start. Having it back is the goal. Each rung of evidence shows more of the way there. The base levels hold, check, and certify the deposit. The Pro levels add proof that it builds. The Exit Exercise tests the exit in practice. Every protection ### Vault and plan certificates The deposit is held, and an automated check confirms what's in it every month, with a Vault Report and a Vault Certificate. Your plan comes with its own certificate too: an Escrow, Resilience, or Continuity Certificate. **Proves:** it's there. Escrow Pro · Resilience Pro · Continuity Pro ### Recoverability Certificate AI agents rebuild a complete deposit on their own in the Codekeeper AI Verification Lab, in hours. Each successful run also gives you the Rebuild Report, an SBOM, and an Exit workbook. **Proves:** it builds. [Agentic Verification](https://codekeeper.co/agentic-verification) Add-on to any plan ### Exit Exercise Report Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate. An annex maps the result to your framework. **Proves:** you could exit and keep working. [Exit Exercise](https://codekeeper.co/exit-exercise) The Recoverability Certificate documents the rebuild and its result. It doesn't grant release rights; those come from the agreement. [Explore verification](https://codekeeper.co/verification) What goes on file ## Dated evidence, for every application. Each protection produces documents tied to one application, so your file shows what was held, what was rebuilt, what was tested, and when. | What your file needs to show | Codekeeper evidence | | --- | --- | | The deposit is held, checked, and current | Plan certificateVault ReportVault CertificateEvery protection. An automated check confirms what's deposited every month, and deposits sync daily through integrations. | | The application can be rebuilt without the vendor | Recoverability CertificateRebuild ReportEscrow Pro, Resilience Pro, and Continuity Pro. AI agents rebuild a complete deposit on their own in the Codekeeper AI Verification Lab. | | You know what's inside it and how to recover it | SBOMBuild stepsExit workbookEscrow Pro, Resilience Pro, and Continuity Pro, with every successful rebuild. | | Testing is repeated over time | Recoverability Certificates from dated runsUp to four rebuilds a year included, on supported technology stacks, run when you choose: before an audit, after a release, or when the deposit changes. | | The exit has been tested in practice | Exit Exercise ReportFramework annexExit Exercise, an add-on to any plan. Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate, with an annex mapped to your framework, such as DORA. | | A plan for the live service during an exit | Live environment mapContinuity. We map where the application runs at setup, keep the map current, and if the vendor stops we keep the live environment paid and switched on for an agreed period while it's recovered. | Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. See examples of the documents in the sample evidence pack. Due diligence on Codekeeper ## Review us properly, without the chase. Send your questionnaire, and our compliance team completes it. Confidential documents follow under NDA, through secure channels. General documents are shared without one. * ISO/IEC 27001:2022 certified, audited every year by BSI * AES-256 encryption at rest, TLS in transit, and every access to deposits logged * Agentic Verification runs on Codekeeper's own models, so code never leaves our environment * ISO 27001 Certificate, ISMS Summary, Information Security Policy, and Security Assurance Report on request * A data processing agreement on request, and personal data handled in line with GDPR * Questionnaires completed by our compliance team: tell us the format or portal you need [Open the Trust Center](https://codekeeper.co/trust-center) **Due diligence request**Example Logistics plc · vendor reviewIn progress **Questionnaire**Completed by our compliance teamCompleted **NDA**For confidential documents Signed **ISO/IEC 27001:2022 certificate**Through the Trust CenterShared **Security policies and audit summaries**Under NDA, through a secure channelShared **Follow-up questions**2 open with your Codekeeper contactAnswering Example request. Names are fictional. Your steps, and ours ## From questionnaire to a file you can show. Your review can start as soon as the proposal is shared, alongside the rest of the setup. Due diligence doesn't hold up procurement or account setup. Your part What Codekeeper does 1 · Send your request Send your questionnaire or document request to your Codekeeper contact, with clear requirements and any portal access or format you need. Completes the questionnaire, and brings in our technical team for specialist questions. 2 · Sign an NDA Sign the NDA for confidential documents, and confirm the scope of documentation you need. Shares security policies, ISMS summaries, and audit summaries through secure channels. 3 · Review Review the documents internally, and flag anything missing or unclear. Answers follow-up questions and provides additional documentation. 4 · Build your file Once the protection is live, add each application's certificates and reports to your file. Issues a dated certificate or report every time a check, a rebuild, or an Exit Exercise runs. ### Approving Codekeeper? Read the compliance briefing. One page for compliance officers: the evidence you'll hold for each application, how it fits your framework, and the documents you'll need to review Codekeeper itself, with the people who'll answer your questions. [Read the briefing](https://codekeeper.co/compliance-team-briefing) Sample evidence pack ## See what your auditor would receive. An illustrative set of evidence for one application, with example values, so you can judge it before you talk to us. * Recoverability Certificate * Rebuild Report * SBOM and Exit workbook excerpts Get the sample evidence pack Frequently asked questions ## Before you sign off. Will Codekeeper's evidence satisfy our regulator? Codekeeper gives you evidence for your file: certificates, Rebuild Reports, SBOMs, Exit workbooks and, as an add-on, an Exit Exercise Report. It supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. Which documents go in a DORA or PRA SS2/21 file? The Vault Certificate shows the deposit is held and checked, and your plan certificate shows the arrangement is in place. With the Pro levels, the Recoverability Certificate, Rebuild Report, SBOM, and Exit workbook show it builds and how you would exit. An Exit Exercise Report adds functional testing, with an annex mapped to your framework. See [DORA](https://codekeeper.co/solutions/dora) and [PRA SS2/21](https://codekeeper.co/solutions/pra-ss221) . Which certifications does Codekeeper hold? Codekeeper is certified to ISO/IEC 27001:2022, audited by BSI. The data centers our hosting partners run hold ISO 27001 certification and SOC 2 reports. Policies and audit summaries are available through the [Trust Center](https://codekeeper.co/trust-center) . Do we need an NDA to see your documents? Only for confidential security documents. Some documents are public in the Trust Center. For the rest, we ask for a signed NDA first, then share them through secure channels. Can our review start before sign-up? Yes. Due diligence can run alongside the other phases, so it doesn't hold up procurement or account setup. ## Evidence your assessor can read. _Put it on file._ See the certificates and reports on a demo, or get the sample evidence pack and judge the evidence first. [Book a demo](https://codekeeper.co/book-a-demo) Get the sample evidence pack