Snapshot 231093
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Centre Start your security review View & download sensitive information Ask for information GBG Trust Centre Welcome to GBGs Trust Centre This page provides an overview of the security controls in use for GBG Group. Please note you must be an existing customer or have a non-disclosure agreement in place to access locked information. In the unlikely event the information in the Trust Centre does not answer your security related questions please do reach out to the Information Security Team via email: secureandtrusted@gbgplc.com Compliance Cyber Essentials Plus FedRAMP Moderate ISO/IEC 20243:2024 ISO/IEC 27001 SoA ISO/IEC 27001:2022 SOC 2 Type 2 PCI DSS v4.0.1 GBG is reviewed and trusted by John Lewis Barclays AmBank Vodafone UK Oxfam the LEGO Group PayPal Lyft American Express ASOS plc IBM HSBC Betway BNP Paribas Coinbase St. James's Place Volvo Documents Featured Documents DOCUMENTSCustomer Guide to GBGs Trust Centre If you think you may have discovered a vulnerability, please send us a note. Report issue Security Grades UpGuard GBG Plc 909 GB Group Policies Coordinated Vulnerability Disclosure Policy Acceptable Use Policy Access Control Policy View more Operational Resilience and Redundancy Operational Resilience and Redundancy Policy Overarching Operational Resilience and Redundancy Plan FedRAMP - Incident Reporting FedRAMP - Report an Incident Self-Assessments SIG Core 2026 - IDScan Enterprise SIG Core 2026 - AssureID SIG Core 2026 - GBG GO View more Service Management Capacity Management Change Enablement Policy Continual Improvement Policy View more Data Flow Diagrams ProID Product Data Flow Verify Data Flow Verify DQS Data Flow Diagram View more Access Control Data Access Logging Password Security Application Security Code Analysis Credential Management Secure Development Training View more Corporate Security Email Protection HR Security Incident Response View more Supplier Management Supplier Minimum Security Standards Data Security Authentication Data Retention & Disposal Encryption-at-rest View more Endpoint Security Disk Encryption DNS Filtering Endpoint Detection & Response View more Infrastructure Status Monitoring Disaster Recovery & Backups Minimalist Configurations View more Network Security Data Loss Prevention Firewall IDS/IPS View more GBGs Approach to DORA and APRA CPS230 DORA - FAQs APRA CPS230 - FAQs AI@GBG GBG's AI Principles AI Risk Statement Approach to AI View more ESG Environment Social and Governance Gender Pay Report Modern Slavery View more Legal Privacy Policy Technical and Organisational Measures Vendor Management Insurances EOC Public Liability - £5m PI and Cyber Insurance Trust Centre Updates GBG Response to Node.js/Brotli Vulnerability (CVE-2026-111497) Vulnerabilities GBG is aware of the recently disclosed remote code execution vulnerability affecting Node.js and the Brotli compression library (CVE-2026-111497). Our Threat and Vulnerability Management team assessed our environments as soon as the vulnerability was published and has identified the components that use affected versions. Remediation is underway and is being prioritised according to risk. We continue to monitor our environments and threat intelligence sources for this vulnerability, in line with our vulnerability management and incident response processes. An update will be provide once remediation is complete. If you have any specific questions, please contact your GBG account manage GBG Response to the PHP2Shell Vulnerabilities Vulnerabilities GBG has assessed its environment against the indicators of compromise currently available for PHP2Shell. Based on our investigation and monitoring to date, we have identified no evidence that GBG systems have been compromised or that these vulnerabilities have been exploited within our environment. We continue to scan and monitor our environment for suspicious activity and newly published indicators and will reassess our exposure as further threat intelligence becomes available. GBG is aware of the recently disclosed PHP vulnerabilities, commonly referred to as “PHP2Shell”, which could allow an unauthenticated attacker to execute commands on an affected system. We received advance notification from our threat intelligence partners and promptly activated our incident response processes. All GBG systems identified as potentially exposed have been updated. We have also implemented additional precautionary measures, including enhanced monitoring, threat hunting for indicators of compromise associated with PHP2Shell, and ongoing vulnerability scanning across our systems. To date, we have identified no evidence that GBG systems have been compromised or that these vulnerabilities have been exploited within our environment. We appreciate that customers may have specific questions, which we will be happy to address. Given the volume of enquiries relating to this matter, we may not always be able to respond within requested timeframes. We appreciate your understanding as we work to respond to individual requests as promptly as possible. We continue to monitor developments closely and will take further action should any additional risks be identified. ExpectID Successfully Maintains SOC 2 Type II Compliance We are proud to announce, ExpectID has successfully maintained SOC2 Type II audit report. The report is now available on the certifications page of the GBG Trust Centre GBG Response to React Vulnerabilities Vulnerabilities We have completed a thorough review of our systems and confirmed that no externally facing systems are impacted by the recently reported React vulnerabilities. We will continue to monitor guidance from our security partners and take any necessary actions to ensure ongoing protection. GBG successfully expands ISO27001:2022 certification. Compliance We are pleased to share the exciting news that GBG has strengthened our ISO27001:2022 certification by further certifying our ISMS globally. Additional entities have been included to further demonstrate our compliance and previous certifications for GBG Atlanta, GBG Manchester, NH and GBG Canberra are now retired and covered by this new certification. This work enables our customers and partners to confidently and efficiently know our ISO27001:2022 status. Our new Certificate and Statement of Applicability are now uploaded to the Trust Centre.