Assess controls against the Trust Services Criteria across security, availability, processing integrity, confidentiality, and privacy.

Is a board-approved information security policy maintained and reviewed at least annually?

The policy should cover security objectives, ownership, acceptable use, access control, incident response, and evidence responsibilities.