The standard is also applicable to organisations that manage high volumes of data or information on behalf of other organisations such kak?m veri centres and IT outsourcing companies. Certification is valid for three years and is maintained through a programme of annual surveillance audits an