The standard is also applicable to organisations that manage high volumes of data or information on behalf of other organisations such kak?m data centres and IT outsourcing companies. Certification is valid for three years and is maintained through a programme of annual surveillance audits an