{
  "schemaVersion": 1,
  "entity": "Kotav International - Business and Assets, Lda",
  "reviewDate": "2026-09-19",
  "scope": "Argus, the Kotav portal, supporting infrastructure and the software-delivery lifecycle",
  "claimBoundary": "These are internal implementation and methodology statuses. They are not third-party certifications, attestations, regulator decisions or customer legal opinions.",
  "programmes": [
    {
      "name": "SOC 2 Type II",
      "status": "CONTROL_BASELINE_IMPLEMENTED",
      "implemented": ["scoped system boundary", "control design and ownership", "evidence collection", "exception tracking", "management readiness review"],
      "remainingExternalGate": "Independent licensed service-auditor examination over the agreed operating period and issuance of the Type II report"
    },
    {
      "name": "EU Cyber Resilience Act",
      "status": "PRODUCT_SECURITY_CONTROLS_IMPLEMENTED",
      "implemented": ["secure development", "vulnerability handling and disclosure", "dependency and SBOM process", "release evidence", "support and post-market handling"],
      "remainingExternalGate": "Formal product classification and the applicable legal conformity route, including a notified body if required"
    },
    {
      "name": "DORA",
      "status": "ICT_SUPPLIER_CONTROL_PACK_IMPLEMENTED",
      "implemented": ["security evidence", "incident cooperation", "resilience testing cooperation", "continuity", "subcontractor records", "audit cooperation", "exit support"],
      "remainingExternalGate": "Customer-specific contractual and legal validation; DORA does not issue a supplier certificate"
    },
    {
      "name": "NIST SP 800-115 / PTES",
      "status": "ASSESSMENT_METHOD_IMPLEMENTED",
      "implemented": ["written authorization", "scope and rules of engagement", "discovery and controlled validation", "evidence handling", "report quality assurance", "remediation guidance", "retesting"],
      "remainingExternalGate": "None; NIST and PTES do not issue an adoption certificate"
    },
    {
      "name": "ISO 22301",
      "status": "INTERNAL_BCMS_IMPLEMENTATION_COMPLETE",
      "implemented": ["BCMS scope and policy", "business-impact analysis", "continuity strategies", "recovery exercises", "supplier dependencies", "management review", "corrective actions"],
      "remainingExternalGate": "Independent accredited ISO 22301 certification audit"
    }
  ]
}