Is this your company? Buyers are checking Cundall here. Claim cundall.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Cundall
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Cundall is SOC 2 compliant. Cundall also holds ISO 27001.
About
Cundall is a global, independent, multi-disciplinary consultancy delivering sustainable engineering and design solutions across the built environment. We operate across 29 locations with over 1200 engineers and designers who are empowered to act with flexibility and agility in response to the local market conditions and practices. We are 100% owned by Partners working in the practice.
Compliance & infrastructure
Hosting
AWSGCP
Documents
13Documents
- Asset Management PolicyRequest
- Business Continuity and Disaster Recovery PlanRequest
- Cryptography PolicyRequest
- Data Management PolicyRequest
- Incident Response PlanRequest
- Information Security Policy (AUP)Request
- ISO 14001:2015 Environmental Management SystemRequest
- ISO 45001:2018 Occupational Health and Safety Management SystemRequest
- ISO 9001:2015 Quality Management SystemRequest
- Data Protection PolicyRequest
- Operations Security PolicyRequest
- Cyber EssentialsRequest
- Cyber Essentials PlusRequest
Subprocessors
8- MMicrosoft · Cloud hosting, marketing, and support servicesEU, MENA, APAC
- GGoogle · Cloud support servicesEU, MENA, APAC
- AAmazon Web Services · Cloud hosting and infrastructure servicesEU, MENA, APAC
- NNasuni · Cloud storage and data managementEU, MENA, APAC
- NNewforma · Project information managementEU, MENA, APAC
- MMimecast · Email security and threat protectionEU, MENA, APAC
- FFreshservice · IT service management and supportEU, MENA, APAC
- VVanta · Compliance monitoring and automationEU, MENA, APAC
Compliance leadership
The person who leads Cundall's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Cundall's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Cundall SOC 2 compliant?
Cundall is SOC 2 compliant. On SOC2C this listing is Listed.
Is Cundall ISO 27001 certified?
According to Cundall's public trust center, Cundall is ISO 27001 certified. On SOC2C this listing is Listed.
Can I use Cundall's SOC 2 for a vendor risk assessment?
Yes. Cundall's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Cundall penetration tested?
Cundall hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Cundall secure?
Security isn't a single yes/no, but Cundall is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Cundall have a bug bounty or vulnerability disclosure program?
Cundall hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@cundall.com or via a /security page (Cundall lists a security contact).
Who are Cundall's subprocessors?
Cundall lists 8 subprocessors on its trust center, including Microsoft, Google, Amazon Web Services, Nasuni, Newforma. Buyers use this for fourth-party risk review.
Where does Cundall host or store data?
Cundall hosts on AWS, GCP. Data residency details are on its trust center.
Where is Cundall's trust center or security page?
Cundall's trust center is at https://trust.cundall.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
What is Cundall’s approach to Information Security?
Cundall operates a risk-based Information Security Management System (ISMS) certified to ISO 27001, ensuring confidentiality, integrity, and availability across all systems and data.
How do you protect client and project data?
Client and project data is managed in accordance with ISO 27001 and GDPR. Controls include secure handling, least-privilege access, and safe storage, with technical safeguards aligned to Cyber Essentials Plus.
Do you encrypt data at rest?
Yes. Encryption at rest and in transit follows ISO 27001 requirements and meets CE+ technical standards.
How do you manage user access and authentication?
Identity and access management is aligned to ISO 27001 Annex A.9, including MFA, role-based access, and routine access reviews.
What measures protect your network and endpoints?
Network and endpoint security controls align to ISO 27001 and are validated through Cyber Essentials Plus testing, including secure configuration, patching, threat detection, and malware protection.
Do you conduct penetration testing?
Yes. Independent penetration testing and vulnerability assessments are performed routinely to support ISO 27001 continual improvement and Cyber Essentials Plus assurance.
What is your incident response capability?
Incident response follows ISO 27001 Annex A.16, with defined escalation, containment, resolution, and learning processes. All data incidents are handled in line with GDPR requirements.
What physical security measures do you use?
Physical security controls follow ISO 27001 Annex A.11, including restricted building access, asset protection, visitor management, and environmental safeguards.
How do you ensure business continuity?
Business continuity and disaster recovery planning is embedded in our ISO 27001 framework and supported by strong process governance under ISO 9001. Plans are reviewed and tested periodically.
What is Cundall’s approach to Health & Safety?
Cundall operates a certified ISO 45001 Health & Safety Management System, prioritising risk control, safe working practices, and continual improvement across all operating environments.
How are staff trained on security and H&S responsibilities?
All personnel undertake mandatory training aligned to ISO 27001, GDPR, and ISO 45001. Additional, role-specific training is provided where higher-risk duties or specialist responsibilities exist.
Business & Industrial peers that completed SOC 2
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public