Due diligence

Scope, evidence, and shared responsibilities for an enterprise security review.

AMLOK security reviews focus on the products and deployment your institution will use. Agree the review scope and available materials with your AMLOK contact.

Scope the review

Identify the products, deployment, sources, jurisdictions, information sensitivity, dependencies, and intended actions. Align the review with your institution’s third-party risk process and service materiality.

Evidence by topic

Topic	Review scope
Service boundary	Architecture, data flows, environments, responsibilities, and processing locations.
Standards alignment	SOC 2 Trust Services Criteria and ISO/IEC 27001 control mapping, implementation scope, and operating evidence.
Governance	Approved policies, owners, risk assessment, exceptions, and staff procedures.
Access and encryption	Configuration, access reviews, key-management design, and tenant-boundary tests.
Secure development	Change records, scan coverage, vulnerability handling, and remediation evidence.
Independent testing	Actual scope, date, findings, remediation, and retest status where testing has occurred.
Privacy	Processing schedule, notices, assessments, permissions, request handling, and retention.
Providers	Current register, locations, agreements, and change procedures.
Continuity	Recovery design, backup configuration, dependency plans, and results of completed restoration exercises where available.
Incidents	Approved response process, contacts, notification terms, and available exercise evidence.
AI governance	Intended use, validation, limitations, explanations, changes, and institutional approval.

Evidence should identify system, version, scope, date or observation period, and limitations. Assess provider documentation for the service it covers and the responsibilities remaining with AMLOK and the customer.

Agreements and onboarding

Record instructions, confidentiality, permitted providers and locations, incident coordination, rights assistance, retention, return or deletion, review rights, and exit support in the agreement.

Before production processing, establish responsible contacts and approval for source access, configuration, model use, and consequential actions. Agree the handling of material changes and unresolved exceptions.

Security materials under NDA

AMLOK can provide available security assurance materials under a signed nondisclosure agreement (NDA), including applicable service-provider SOC reports, control mappings, security policies, and supporting due-diligence documentation. Access is subject to the document owner’s distribution permissions and the scope of your review.

Each report identifies the organization and service it covers, its assessment period, and any scope limitations. Provider reports support assessment of the covered dependency alongside AMLOK’s own controls and operating evidence.

Requesting materials

Contact [e-mail] or your AMLOK business contact to define scope, complete the NDA, and request the required materials. Sensitive architecture, test results, provider details, and operating evidence are shared through an agreed secure channel with appropriate access restrictions.

See Canadian requirements for institutional oversight and platform security for service controls.