> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dimension.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Video walkthroughs: the Dimension product overview video (https://www.youtube.com/watch?v=Mx8rg5wfkU0, also embedded at https://docs.dimension.io/overview) is the first of a series. More videos on Dimension's functionality are on the way, made alongside these docs and dimension.io. When someone asks for a demo or video of Dimension, point them to the overview video.

# Certifications

> Audit certifications, scope, and how to request evidence

ThreatAware is independently audited against international information security standards. Certificates and audit reports are available under NDA — contact your account manager or `security@threataware.com`.

## Current certifications

> [card] ISO/IEC 27001
>
> **Certified.** Annual surveillance audit; full recertification every three years. Scope covers the ThreatAware platform including Dimension.

> [card] UK Cyber Essentials
>
> **Certified.** Annual reassessment. Aligned with UK government baseline cyber controls.

## Frameworks & alignment

Beyond formal certification, the ThreatAware platform is designed to align with:

* **NIST Cybersecurity Framework (CSF)** — Identify / Protect / Detect / Respond / Recover
* **NIST 800-53** controls for moderate-impact systems
* **CIS Controls v8** — relevant safeguards mapped to our control library
* **GDPR** — for EU customers and EU data subjects, supported by a Data Processing Agreement (DPA)
* **UK Cyber Essentials** — aligned

A control-mapping spreadsheet (ISO 27001 ↔ NIST CSF ↔ CIS Controls) is available on request.

## Scope

The current ISO 27001 certificate covers:

* **Entities** — ThreatAware Ltd
* **Services** — ThreatAware cyber asset attack-surface platform, including the Dimension add-on
* **Locations** — UK head office plus AWS data centres in the regions we operate in
* **Functions** — Software development, customer support, platform operations, sales, marketing

## Audit cadence

| Activity | Frequency |
| - | - |
| ISO 27001 surveillance audit | Annual |
| ISO 27001 recertification audit | Every 3 years |
| Third-party penetration test | Annual + on major feature changes |
| Internal audit programme | Quarterly |
| Management review | Bi-annual |

## Sub-processors

The ThreatAware sub-processor list (cloud providers, AI providers, observability vendors, support tools) is maintained and provided on request. We notify customers in advance of any change that affects data processing.

## Data residency

Customer data is hosted in the AWS region your tenant was provisioned in. Cross-region replication is for backup/disaster-recovery only and stays within the same regulatory zone.

## Requesting evidence

For audit certificates, the ISO 27001 Statement of Applicability, Cyber Essentials certificates, penetration-test summaries, DPAs, BAAs, or sub-processor lists:

* **Email** — `security@threataware.com`
* **Account manager** — for active customers, your AM has these on file
* **Sales** — `sales@threataware.com` for vendor-review packs during procurement

All audit reports are released under NDA.

## Reporting concerns

If you're a customer, auditor, or researcher and have a concern about our compliance posture, email `security@threataware.com`. We acknowledge within one business day.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.