> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/legal-and-compliance/compliance.md).

# Compliance

ThreatDefence is committed to maintaining the highest standards of security, privacy, and compliance. Our compliance scope covers people, processes and technology — including our ThreatDefence platform, supporting infrastructure, and 24x7 SOC operations.

***

## Global Standards and Certifications

ThreatDefence is certified and compliant with the following internationally recognised standards:

* **ISO/IEC 27001** – Information Security Management System (ISMS) certification.
* **SOC 2** – Assurance of secure systems, availability, confidentiality, and integrity.
* **PCI DSS** – Compliance for environments processing or transmitting payment data.
* **GDPR (General Data Protection Regulation)** – Alignment with EU and UK privacy regulations for processing and safeguarding personal data.
* **HIPAA (Health Insurance Portability and Accountability Act)** – Support for customers in the healthcare sector requiring healthcare data privacy and security controls.

***

## Australian Standards and Frameworks

For our Australian customers and deployments, ThreatDefence maintains strict alignment with local frameworks and regulations. Our compliance scope extends across people, processes, and technology — including the ThreatDefence 24/7 SOC and platform located in Australia:

* **ASD ISM (Information Security Manual)** – Alignment with controls mandated by the Australian Cyber Security Centre (ACSC).
* **Essential Eight** – Baseline mitigation strategies for cyber security, continuously measured and reported.
* **PSPF (Protective Security Policy Framework)** – Support for compliance with Australian Government security obligations.

***

## Audit and Assurance Support

ThreatDefence actively supports customers during internal and external audits by:

* Providing evidence and artefacts for ISO, IRAP, DISP, PCI DSS, SOC 2, HIPAA, and GDPR assessments.
* Coordinating with security officers to validate compliance requirements.

**Copies of certifications and supporting evidence can be provided to customers upon request, subject to NDA or contractual obligations.**

***

## Customer Responsibilities

While ThreatDefence provides compliance-ready services, customers are responsible for:

* Keeping escalation contact lists up to date.
* Ensuring log sources and telemetry are enabled and accessible.
* Maintaining customer-side controls such as patching, access management, and backups.
* Participating in governance and compliance reviews to validate ongoing readiness.

***

## References

* [ISO/IEC 27001 Standard](https://www.iso.org/isoiec-27001-information-security.html)
* [SOC 2 Trust Principles](https://www.aicpa.org/soc4so)
* [PCI DSS Standard](https://www.pcisecuritystandards.org/)
* [GDPR Overview](https://gdpr-info.eu/)
* [HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html)
* [ASD Essential Eight](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight)
* [Protective Security Policy Framework](https://www.protectivesecurity.gov.au/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/legal-and-compliance/compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.