The standard is also applicable to organisations that manage high volumes of data or information on behalf of other organisations such kakım data centres and IT outsourcing companies.Certification is valid for three years and is maintained through a programme of annual surveillance audits and a three yearly recertification audit. See more details