Table of Contents

• Why Certifications Matter When Your Binders Hold Sensitive Information
• Understanding SOC 2 Type II and ISO 27001 Certifications
  • Validating a SOC 2 Type II Report Before You Rely On It
  • Interpreting SOC 2 Exceptions and Complementary Controls
  • Checking ISO 27001 Certificate Scope and Validity
• Board Portal Security Checklist for Vendor Review
• Running a Board Portal Vendor Security Assessment
  • A Weighted Evaluation Scorecard
  • Board-Specific Threat Scenarios to Test
• Assessing Board Portal Access Controls for Directors and Administrators
• Securing Shared Binders for External Directors
• Booking a Walkthrough of Athena Board’s Security Documentation
• Frequently Asked Questions

How to Evaluate Board Portal Security Certifications

Last Updated: November 1, 2026

Why Certifications Matter When Your Binders Hold Sensitive Information

Board binders hold some of the most sensitive material an organisation produces, including financial results, strategy papers, executive remuneration and details of legal matters. For a broader overview of the security features a board portal should offer alongside its certifications, see Enterprise Board Portal Security Features.

Certifications answer a narrow question: has an auditor examined this vendor’s controls against a defined standard? They do not tell you whether the controls suit your organisation, whether your directors will use them correctly, or whether the scope covers the products you plan to buy.

Watch out: a vendor that says it is “certified” without naming the framework, the audit type and the scope has told you very little. Ask for the specifics before you assume anything.

Understanding SOC 2 Type II and ISO 27001 Certifications

SOC 2 and ISO 27001 are the two certifications you will see most often in board portal security material. They work differently, so it helps to know what each one covers, how to validate the claim, and where the limits sit.

• SOC 2 Type II is an independent auditor’s report on how a vendor’s controls operated over a period of time, usually several months. It is a report, not a certificate. The report names the auditor, the audit period, the system description and the trust services categories in scope (security is mandatory; availability, confidentiality, processing integrity and privacy are optional).
• ISO 27001 is an international standard for an information security management system. An accredited certification body audits the vendor and, if it passes, issues a certificate that is valid for a defined period, subject to surveillance audits. The certificate names the certification body, the scope statement, the issue and expiry dates, and the standard version.

Because one is a report and the other is a certificate, you should review them differently.

Validating a SOC 2 Type II Report Before You Rely On It

A SOC 2 Type II report is more useful than a logo on a website, but only if you read the parts that matter. Work through it in this order:

1. Auditor’s opinion. Confirm it is unqualified. A qualified opinion means the auditor could not conclude the controls were effective.
2. Audit period. Check the start and end dates. A report covering a six-month window that ended eighteen months ago tells you little about current operations.
3. System description. Confirm the products, hosting environments and locations named match what you would actually buy. A report scoped to a corporate email system does not cover the binder platform.
4. Trust services categories. Security is always in scope; confirm whether confidentiality and availability are also covered, since those matter most for binders.
5. Exceptions. Read the tests of controls and note every exception, then read the vendor’s management response.
6. Complementary user entity controls (CUECs). These are controls the vendor expects you to run yourself, such as managing your own user accounts and enforcing multi-factor authentication. If you skip them, the vendor’s report does not cover your part of the risk.
7. Subservice organisations. If the vendor uses a hosting provider, check whether that provider is carved out or inclusive. A carve-out means the hosting controls are not covered by the report and you must assess the subservice organisation separately.

Interpreting SOC 2 Exceptions and Complementary Controls

An exception means the auditor found that a control did not operate as described during the audit period. A single minor exception is not always a deal-breaker, but the pattern matters more than the count. Ask three questions of every exception:

• Which control failed? An exception in a low-risk area such as a quarterly policy review is different from one in access provisioning or incident response.
• How long did it operate? A one-off lapse is different from a control that failed for most of the audit period.
• What did the vendor change? Look for a remediation note with a date. An exception with no remediation plan is an open risk you are accepting.

CUECs deserve the same scrutiny. Vendors’ CUEC lists often place several controls on the customer’s side of the shared responsibility line. Map each CUEC to an owner in your organisation before you sign. If no one owns it, it will not happen.

Checking ISO 27001 Certificate Scope and Validity

An ISO 27001 certificate is only meaningful for the scope it names. A vendor might be certified for its corporate office systems but not for the hosted platform you would actually use.

Also check the validity dates and the certification body. Maintaining these standards requires proactive internal assessments, which often begin with a thorough ISO gap analysis to identify potential vulnerabilities before the formal audit process commences.

Board Portal Security Checklist for Vendor Review

Use this checklist when you compare board portal vendors. For current best practices for protecting binders, see Board Document Security best practices. It is designed to sit alongside your normal procurement process.

• SOC 2 Type II report is recent and covers a full audit period
• Report scope includes the exact product you plan to buy
• Exceptions are listed and the vendor explains each one
• ISO 27001 certificate names the hosted platform in its scope

Running a Board Portal Vendor Security Assessment

A useful vendor security assessment follows a fixed order and produces a comparable record, so you can defend the decision to your board and revisit it at renewal.

Get started with your free trial today →

1. Request the evidence first. Ask for the current SOC 2 Type II report, the ISO 27001 certificate, a completed security questionnaire and the sub-processor list.
2. Check the scope. Confirm the audited systems and certificate scope match the product you would actually use, including hosting locations.
3. Test the answers. Ask how a control works in practice. For example, ask how a departing director’s access is removed the same day, and ask for the runbook or ticket that evidences it.
4. Review the contract. Look for breach notification timeframes, sub-processor change notice, data return or deletion terms, and audit rights.
5. Score and record. Apply a weighted scorecard (below) and keep the record for your board’s minutes.

A Weighted Evaluation Scorecard

A simple rubric keeps procurement, IT and governance teams aligned. Assign each criterion a weight that reflects your organisation’s risk appetite, score each vendor from 1 (weak) to 5 (strong) against the evidence, and multiply.

Criterion	What to score	Suggested weight
Certification scope	SOC 2 and ISO 27001 scope covers the binder platform and hosting	20%
Audit evidence quality	Recent unqualified report, exceptions explained, remediation dated	15%
Access controls	Role-based permissions, MFA for all users, same-day revocation	15%
Encryption and key management	Data in transit and at rest, key custody explained	10%
Data residency and hosting	Locations stated, options aligned to your obligations	10%
Incident response	Notification timeframes, tabletop evidence, breach history	10%
Binder-specific controls	Per-binder permissions, download and sharing controls, audit logs	10%
Contract and exit	Deletion, return, sub-processor notice, audit rights	10%

Record the raw score, the evidence you relied on and any open questions. A vendor that scores well on certification but poorly on binder-specific controls is a different risk from the reverse, and the weighted total makes that visible.

Board-Specific Threat Scenarios to Test

Generic questionnaires miss the risks that matter most for binders. Put these scenarios to every vendor and ask for the control that addresses each one:

• Compromised director account. How is anomalous sign-in detected, and what is the step-up authentication and lockout process?
• Leaked meeting pack. Can a downloaded binder be revoked or expired, and does the audit log show who downloaded it and when?
• Insider access by administrators. Are administrator actions logged and reviewable, and is there separation between platform administration and content access?
• Lost or stolen device. Can a director’s session and downloaded binders be wiped remotely, and is offline access time-limited?

Assessing Board Portal Access Controls for Directors and Administrators

Access controls are where most board portal risk actually sits.

Look for role-based permissions that separate directors, company secretariat staff and external contributors. Confirm that administrators must use multi-factor authentication and that their actions appear in the audit log.

Secure messaging can also matter here. Check how any messaging feature is covered by the vendor’s certification scope before you rely on it.

For administrator accounts, the setup steps matter.

Securing Shared Binders for External Directors

External directors, advisers and auditors often need to see parts of a binder without full platform access. Granting full access creates unnecessary risk, so limit what they can reach.

External contributor access via protected links lets external people add input to a binder without receiving full access to your board materials.

Booking a Walkthrough of Athena Board’s Security Documentation

Reading a report is one thing. Seeing how the controls work in the product is another. Bring your checklist and your list of questions, and work through them against the live platform.

Frequently Asked Questions

What security certifications should a board portal have?

At a minimum, look for an independent SOC 2 Type II report covering security, availability and confidentiality, and an ISO 27001 certificate issued by an accredited certification body. A SOC 2 Type II report shows that controls operated effectively over a period, while ISO 27001 shows that an information security management system is in place. Ask the vendor for the current report or certificate, confirm the scope includes the exact product and hosting environment you will use, and check the validity dates before you sign. Certification alone does not guarantee security, so pair it with your own vendor assessment.

How can you verify a board portal’s security certification?

Request the full SOC 2 Type II report or the ISO 27001 certificate rather than a logo or summary. For ISO 27001, check the issuing certification body and confirm the certificate’s scope names the product and data centres you will use. For SOC 2, read the auditor’s opinion, the period covered, and any exceptions noted. Verify that the report is recent enough for your risk tolerance, and ask whether bridge letters are available for any gap between the audit period and today.

What is the difference between a security certification and an independent audit?

A certification such as ISO 27001 is a formal attestation that a management system meets a published standard, usually granted after an accredited body audits it and then re-audits on a cycle. An independent audit, such as a SOC 2 Type II examination, is a point-in-time or period-based assessment of specific controls by an external auditor. Both are useful, but they answer different questions, so an evaluation should consider each one separately rather than treating either as a complete substitute for the other.

How often should a board portal’s security controls be reviewed?

Reviews should occur at least annually, and whenever the vendor changes hosting, adds major features, or reports a security incident. Ask for the date of the most recent penetration test and whether the vendor performs continuous monitoring between formal audits. Build the review into your governance calendar so it is tied to your annual vendor renewal, and record the outcome in your board’s risk register.