NORS Assurance Report Properties

The NORS Certification Program has specific certification requirements. Organizations seeking NORS Certification should contact [e-mail] for any questions.

Assurance Report Requirements

• The assurance report must cover all control objectives set out in NORS.

• The assurance report cannot contain any qualifications.

• The assurance report must be a reasonable assurance report, adhering to assurance standards deemed appropriate NORS Inc.*

• The assurance report must be presented in a manner and with a level of detail and quality deemed sufficient by NORS Inc.*

• The audit must be conducted by an audit team led by a NORS Qualified Assessor.*

Certification Requirements

• Organizations applying for their initial NORS certification can submit a point-in-time report. This report should consider whether the controls implemented by the organization have been suitably designed to achieve the control objectives set out in NORS as of a specific date.

• For subsequent applications for NORS Recertification of the same system, only a 12-month period-of-time report will be accepted. This report should consider the effectiveness of the organization's controls to achieve the control objectives set out in NORS throughout a period.

• For the purpose of application for NORS recertification, there should be no gap in the period coverage of the 12-month recurring assurance reports, except in cases pre-approved by NORS Inc. (which may be withheld at NORS Inc.’s sole discretion).

• A NORS Certification granted with a point-in-time report is valid for 12 months from the date of the assurance report.

• A NORS Certification granted with a period-of-time report is valid for 12 months from the end date of the assurance report's reporting period.

• Organizations that achieve NORS Certification agree to be listed on the NORS website and documentation under the section titled 'NORS Certified Entities'. This listing will remain for the entire duration of their certification and for an additional year after their certification status has expired. The listing will include the organization's name, contact information, the scope of the certification, and the current status of the certification.

NORS Inc. reserves the right to modify these requirements at any time.

NORS Qualified Assessors should be engaged to understand further specifics regarding the points marked with *.