Snapshot 81067
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to content Security & Compliance Certified, audited, and operationally accountable. Critical Cloud holds ISO 27001 and Cyber Essentials Plus. Our operations, incident management, change control, observability, and access governance, are designed to help customers meet their own regulatory obligations, including DORA and NIS2. EU and UK data residency is available. Request documentation Partner credentials ISO 27001 Certified, ISO/IEC 27001:2022 CE Plus Cyber Essentials Plus certified EU + UK Data residency options DORA & NIS2 Operational support for regulated customers Our posture at a glance ISO 27001:2022 certified, independent audit of our information security management system Cyber Essentials Plus certified, UK government-backed scheme, technically tested NHS DSPT registered, Data Security and Protection Toolkit for health and care data Least-privilege access, IAM controls, just-in-time access, no standing admin sessions Structured incident management, SEV-based severity model, documented postmortems Change control, CAB process, customer approval for material changes Sub-processor transparency, documented, available on request 01 Certifications Independently audited and certified Both certifications are maintained and renewed, not a one-off assessment. Documentation is available on request for procurement and due diligence processes. Information security management ISO/IEC 27001:2022 ISO 27001 is the international standard for information security management systems (ISMS). Certification means our policies, controls, and processes for managing information security risk have been independently audited and verified against the standard's requirements. Risk assessment and treatment across our operations Access control, cryptography, and physical security controls Incident management, business continuity, and supplier relations Annual surveillance audits and three-year recertification cycle Certificate and scope statement available on request. UK government-backed cyber security Cyber Essentials Plus Cyber Essentials Plus is the UK government-backed certification scheme covering five core cyber security controls. The "Plus" level involves independent technical testing, not self-assessment, verifying that the controls are actually in place and functioning. Firewalls and network boundary controls Secure configuration of devices and services User access control and privilege management Malware protection and software patching, technically verified Certificate available on request for supplier onboarding and due diligence. 02 Regulatory readiness Supporting customers subject to DORA and NIS2 We don't provide legal advice, and regulations place obligations on you, not on us. What we do is run the operational infrastructure, observability, incident management, change control, postmortems, in a way that is designed to help you evidence and meet those obligations. DORA, Digital Operational Resilience Act DORA requires EU financial services firms to demonstrate operational resilience: ICT risk management, incident classification and reporting, digital operational resilience testing, and oversight of third-party ICT providers. How our operations support this: ICT incident management: SEV-based incident classification, documented response timelines, and blameless postmortems, the audit trail DORA reporting requires ICT risk management: ISO 27001 ISMS provides the risk assessment and treatment framework; Datadog observability provides continuous visibility into the operational risk posture Third-party ICT oversight: we operate as a regulated third-party ICT provider; sub-processor documentation, SLA evidence, and audit rights are available on request Resilience testing support: our alliance with Tarian Labs can provide penetration testing and resilience assessments alongside your DORA testing programme, see Continuous Runtime Security Validation NIS2, Network and Information Security Directive NIS2 extends security and incident-reporting obligations to a broader set of sectors, including digital infrastructure, managed service providers, and cloud services, across EU member states. It requires risk management measures, supply chain security, and timely incident notification. How our operations support this: Risk management measures: ISO 27001 ISMS, change control, access governance, and the improvement engineering programme address the technical and organisational measures NIS2 requires Incident reporting: our SEV-1 incident management process documents timeline, impact, and root cause, the raw material for NIS2 72-hour notification obligations Supply chain security: sub-processor list and contractual security requirements available; we apply security obligations to our own suppliers MSP scope: as a managed service provider, we operate within NIS2's scope and maintain the security measures the directive requires of providers in our category DORA and NIS2 are not the only gates. A DPIA and a security information risk assessment (Security ISR) often sit between supplier selection and go-live, especially in health and the public sector. We provide what those assessments need: the DPA embedded in our standard MSA, our sub-processor list, data residency and retention positions, current certificates, security questionnaire responses, and evidence packs. The assessment is yours to run. The inputs are ours to provide. This is not legal advice. DORA and NIS2 impose obligations on your organisation as the regulated entity. How our operations map to your specific obligations depends on your sector, jurisdiction, and circumstances. We can provide operational documentation to support your compliance programme, talk to us or your legal advisers for guidance specific to your situation. 03 Data residency EU, UK, and data sovereignty options Where your observability and operational data is stored matters, for GDPR, for Swiss nDSG, and for customers in regulated sectors. Datadog offers EU, UK and US hosting options; we configure your environment to match your residency requirement. Region / requirement Datadog site Relevance EU data residency Datadog EU1 site (eu1.datadoghq.com), data stored in Frankfurt, Germany Meets GDPR cross-border transfer requirements for EU customers; supports DORA data-localisation preferences UK data residency Datadog's UK availability zone (AWS Europe London region, live since July 2026) for UK-only mandates; Datadog EU1 with UK adequacy decision as an alternative; Azure UK regions for cloud workloads UK GDPR-compatible; UK adequacy decision maintains equivalence for EU→UK transfers post-Brexit Switzerland (nDSG) Datadog EU1 (data stored in Germany / EU); Switzerland-EU SCCs where relevant Swiss nDSG aligns closely with GDPR; EU1 site and appropriate transfer mechanisms support Swiss data-residency expectations Ireland Datadog EU1 GDPR-native; EU site ensures all observability data remains within the EEA EMEA (other markets) EU1 or US1, configured per customer requirement We advise on the right Datadog site for each customer's jurisdiction and sector obligations Datadog's own sub-processors and data processing addendum are published by Datadog at datadoghq.com/legal/sub-processors. Critical Cloud's sub-processor list is available on request. Operating model How security is built into how we operate Security controls are operational, not documentary. They show up in how we manage access, run changes, and handle incidents, every day, for every customer. ISO 27001 IMS Our Information Management System defines how we assess and treat risk, manage policies, train staff, audit controls, and handle non-conformances. Annual surveillance audit; three-year recertification cycle. Structured incident management SEV-1 to SEV-4 severity classification, documented response timelines, and blameless postmortems for all SEV-1 events. Incident records include timeline, impact, root cause, and remediation actions. Change control & CAB All material changes to customer infrastructure go through our Change Advisory Board process. Customers approve changes that affect their environment. Emergency changes are documented post-event with full rationale. Least-privilege access Access to customer environments follows least-privilege principles. IAM controls and access governance reviews are part of the standard operating model. Customers retain admin and IAM control at all times. Observability and audit trail Datadog provides a continuous, tamper-evident audit trail of operational activity. Customers have full, real-time access to their own Datadog environment, visibility is not restricted to Critical Cloud engineers. Sub-processor handling We maintain a documented sub-processor list covering the tools and services used in delivering managed services. Available on request for procurement, DPA, and compliance purposes. 04 Runtime Evidence Get the boxes ticked without a project An auditor, an NHS body, an enterprise customer and a tender all ask versions of the same questions. Where does the data live? Who are the sub-processors? What is retained, and against which policy? Which certificates are current? The answers exist by name: DPA, sub-processor list, data residency and retention positions, certificates, and security questionnaire responses. Ask, and they arrive. Behind the documents sits Runtime Evidence, not compliance theatre. Good operations produce evidence as a by-product: incident records, access governance, change context, recovery evidence, SLO reporting and assurance packs. We operate and evidence the runtime controls that support your compliance obligations. Learn more about Runtime Evidence as part of Managed Runtime Assurance. 05 Disclosure Found something? Tell us directly If you have found a security issue in this website or in a service we operate, email security@criticalcloud.ai. Tell us what you found and where, how to reproduce it, and what an attacker could do with it. Please report privately first and give us a reasonable window to respond before disclosing publicly. You will get an acknowledgement within one working day, an initial assessment within five working days including whether we have reproduced it, and progress updates until it is resolved or we explain why we are not treating it as a vulnerability. We do not run a paid bug bounty, and we are glad to credit reporters who ask to be named once an issue is closed. In scope: criticalcloud.ai and its subdomains, and the services we operate for customers. Out of scope: third-party platforms we use rather than control, volumetric denial of service, social engineering, and automated scanner output with no demonstrated impact. Please do not access, modify or remove customer data. If a proof of concept would require it, stop and describe what you would have been able to reach. Need security documentation for procurement or compliance? ISO 27001 certificate, Cyber Essentials Plus certificate, NHS DSPT registration, and sub-processor list, available on request. The DPA is embedded in our standard MSA, so it is in place from signature rather than requested and negotiated separately. Request documentation About Critical Cloud