CCM security requirements: what to ask a vendor before you sign

Running the final security review on a customer communications platform? CCM security requirements go further than most SaaS reviews, because a CCM platform touches customer data in more places than the vendor’s own cloud. Names, addresses, account numbers and health details flow into templates, test files, archives, print partners and now AI features.

This checklist covers what to ask for, what each certificate actually proves, and where your data goes. It ends with a copyable vendor security questionnaire you can paste into an RFP or a renewal. Still shortlisting? Start with the customer communications management software guide.

Start with the evidence, then follow the data

Do it in this order. Collect the attestations first, because they’re quick to check and they knock out weak vendors early.

Then map every place your customer data will sit and ask about each one. That second step is where CCM reviews usually fall short.

• Pick evidence over claims. A logo on a trust page isn’t a report. Ask for the report itself under NDA, check its dates, and check what’s in scope.
• Public sector? Check the FedRAMP Marketplace or GovRAMP status yourself before you take a vendor’s word for it.
• Regulated data? Get the processor terms, business associate agreement or third-party clauses signed before production data moves.
• Leaving a platform? Agree data return and deletion now, while you still have bargaining power. Our SmartCOMM contract renewal guide covers the timing.

What each certification proves, and what it doesn’t

Each attestation answers a different question, so ask for the right one. The standards bodies define them; vendors only describe them.

Evidence	What it tells you	What to ask for	Where to check it
SOC 2 Type 2	An independent CPA tested controls for security, availability, processing integrity, confidentiality or privacy, including whether they operated	The full report, the period it covers, the trust areas in scope, and any exceptions	Request from the vendor under NDA
SOC 2 Type 1	Control design and implementation only, with no tests of whether controls operated	A Type 2 instead, or a date when one will exist	Request from the vendor
SOC 3	Same trust areas as SOC 2, less detail, freely shareable	Use it as a teaser, then ask for the SOC 2	Often public
ISO/IEC 27001:2022	An information security management system meets the standard’s requirements; certification is optional, and one from an accredited body adds confidence, so ask	The certificate, its scope statement, the certification body and its accreditation	Certification body named on the certificate
CSA STAR	Level 1 is a self-assessment; Level 2 is a third-party attestation or certification	Which level, and the date	CSA STAR Registry
FedRAMP	A cloud offering’s security package was assessed for US federal use at a stated impact level	The impact level and which products the listing covers	FedRAMP Marketplace
GovRAMP (formerly StateRAMP)	A state and local government cloud security program	Status and the product it covers	GovRAMP
PCI DSS v4.0.1	Card data handling meets the PCI SSC standard	Compliance evidence, if card numbers reach the platform	Request from the vendor

Two traps catch most reviewers. First, scope: a certificate can cover one hosting region or product while you’re buying another module. Second, carve-outs: the AICPA’s own evaluation tool notes that when a SOC report uses the carve-out method, the subservice organizations’ names may not be provided. Your print partner can sit outside the report entirely.

Registries help. The CSA STAR Registry, for example, lists Quadient Cloud with a Level 1 CAIQ self-assessment renewed in June 2026. That’s useful, but a self-assessment isn’t an audit, so you’d still ask for the audited reports. For anything not in a public registry, request the report rather than relying on a vendor page.

Public sector: FedRAMP, GovRAMP and FedRAMP 20x

Federal agencies need a FedRAMP authorization for cloud services in scope. FedRAMP says an authorization “is not an endorsement,” and agencies presume its assessment adequate at or below the stated impact level, so match the level to your data.

The program is changing. FedRAMP says 20x, its new assessment approach, is “here to stay,” and it plans to stop accepting new Rev5 certifications on June 11, 2027. Ask any vendor mid-process which path it’s on and its target date.

Check what a listing covers. The FedRAMP Marketplace lists Adobe Experience Manager Managed Services at Moderate since June 2019, but confirm the forms and document generation parts you need sit inside it. State, local, tribal and education buyers should ask about GovRAMP, which StateRAMP rebranded to in February 2025. More on public sector fit in CCM software for government, and on vendor fit in our Adobe AEM Forms review.

Where customer data goes in a CCM program

A generic SaaS questionnaire stops at the vendor’s cloud. CCM data goes further, and the copies outside the composition engine are the ones that leak.

Often missed by a generic SaaS security questionnaire

1. 1 Data feeds and APIs

   Data held

   Policy, billing, claims or account extracts, often full records

   Who holds it

   Your systems and the CCM platform

   Ask: Do you receive only the fields each template needs, and how are feeds encrypted in transit?

2. 2 Templates and content Often missed

   Data held

   Hard-coded names, sample addresses, signatures, account numbers left in drafts

   Who holds it

   CCM platform, authors, implementation partner

   Ask: Can you scan templates and content blocks for personal data before publishing?

3. 3 Test and preview data Often missed

   Data held

   Production extracts copied into dev, test and preview environments

   Who holds it

   Vendor, systems integrator, your developers

   Ask: Are non-production environments protected like production, and can you mask or synthesize test data?

4. 4 Composition and hosting

   Data held

   Every merged document during processing

   Who holds it

   CCM vendor and its cloud provider

   Ask: Which regions, which cloud provider, and who at the vendor can access production?

5. 5 AI features Often missed

   Data held

   Template text, prompts and sometimes customer data sent to a model

   Who holds it

   CCM vendor and any model provider

   Ask: Which model, where it runs, whether our data trains it, and can we switch it off?

6. 6 Print, mail and digital delivery Often missed

   Data held

   Print streams with names, addresses and account details; email and SMS payloads

   Who holds it

   Print and mail partner, email and SMS providers

   Ask: Is each delivery partner a named subprocessor, with its own audit evidence?

7. 7 Archive and retrieval

   Data held

   An exact copy of every document sent, kept for years

   Who holds it

   CCM vendor or a separate archive provider

   Ask: Where is the archive stored, how long, and who can search it?

8. 8 Exit Often missed

   Data held

   Templates, content, archive, logs, backups

   Who holds it

   Everyone above

   Ask: How do we get it all back in open formats, and how do you prove deletion, backups included?

Based on the CCM data flow from feed to archive. Questions map to the questionnaire lines below.

The next four sections go deeper on the stops that catch reviewers out.

PII in templates, test data and archives

Personal data ends up in places nobody planned. Authors paste a real customer’s letter into a template to test layout. Developers copy last month’s production batch into a test environment. Archives keep every statement for years.

• Templates: ask for tooling that finds personal data in content, and lock down who can publish. Approval workflow and audit trail lines are in the questionnaire.
• Test data: treat non-production as production unless the data is masked or synthetic. Ask who at the vendor and your integrator can see it.
• Archives: agree retention by document type and region. An archive copy is still personal data under GDPR and still PHI under HIPAA.
• Card numbers: the PCI SSC says to mask the card number whenever it’s displayed and render it unreadable anywhere it’s stored. If statements or notices carry card numbers, ask how the platform handles both, and ask for the attestation that matches PCI DSS v4.0.1.

If you’re consolidating platforms or migrating, run a template clean-up first. Our template rationalization guide shows how.

Subprocessors: print and mail partners count

Your CCM vendor may hand print streams to a print and mail partner, send email through one provider and SMS through another. Each is a subprocessor holding your customers’ data.

The rules are clear on this. The UK ICO says a processor can’t engage another processor without the controller’s “prior specific or general written authorisation,” and must tell you about changes so you can object. HHS requires business associates to make subcontractors that handle PHI agree to the same restrictions. US bank regulators’ third-party guidance says subcontracting can pose “additional or heightened risk” and notes that contract audit rights often cover the third party and its relevant subcontractors.

Ask for the full subprocessor list, with each one’s role, location and evidence. Then ask how you’ll hear about changes and how long you get to object.

AI features and how your data is used

Most CCM vendors now ship AI writing, translation or readability features. They’re useful, but they can send your content, and sometimes customer data, to a model you didn’t review.

IDC research director Amy Machado, quoted in a Messagepoint press release in September 2026, said buyers should weigh how AI “capabilities address governance, authorization, auditability, and data protection.” Turn that into four questions: which model, where it runs, whether your data trains it, and whether you can switch it off by role or environment. NIST’s AI Risk Management Framework, released in January 2023 for voluntary use, gives your risk team a shared vocabulary for the rest. For one vendor’s AI roadmap in detail, see Smart Communications AI.

Data residency, processor terms and HIPAA

Where data sits matters as much as how it’s protected. Ask for the regions used for production, backups, disaster recovery, support access and archives, not just the primary region.

• GDPR: the processor contract must cover subprocessors, security under Article 32, audits, breach support and deletion or return of data. The ICO’s checklist lists every required term.
• HIPAA: HHS says a cloud provider is still a business associate even when it stores only encrypted PHI without the key. Storing ePHI overseas is allowed with a BAA, but HHS says it may increase risk, so factor location into your risk analysis.
• US banking: the interagency guidance says contracts typically prohibit a third party’s use and disclosure of customer information.

Need a hosting model your security team controls? Compare SaaS, private cloud and self-hosted options in our cloud CCM guide. Healthcare buyers should also read CCM software for healthcare payers.

Data return and deletion when you leave

Exit is where CCM contracts are weakest. You need templates and content back in a usable form, plus years of archive, and proof that the vendor deleted the rest.

The regulators agree on the principle. The EDPB says that on termination the processor must, at the controller’s choice, delete or return the data. HHS sample business associate terms require return or destruction of PHI at termination where feasible. US bank guidance calls for “timely return or destruction” of the bank’s data. In the EU, DORA’s recital 74 says financial entities’ ICT contracts should provide exit strategies with mandatory transition periods.

• Format: templates, content blocks, rules and archive with metadata, in documented formats.
• Timing: a transition period long enough to run both platforms in parallel.
• Deletion: a written method and certificate. Name a method from NIST SP 800-88 Rev. 2 (September 2025), the federal guide to media sanitization.
• Backups: how long they persist after deletion, and when they expire.

Planning the move itself? The CCM migration guide and migrating off SmartCOMM cover parallel runs and cutover.

Vendor security questionnaire you can copy

These lines turn the checks above into a questionnaire. Untick what doesn’t apply, set each line to Mandatory or Desirable, then copy the lines or download a CSV. The section weights let you score answers alongside the CCM RFP template and the CCM vendor scorecard.

43 requirements across 9 sections. Suggested section weights total 100%.

AT · Attestations and certifications Section weight %

1. AT-01 Provide your most recent SOC 2 Type 2 report, its period, the trust services categories in scope and any exceptions noted. Mandatory Desirable
2. AT-02 Provide your ISO/IEC 27001 certificate, scope statement and the name of the accredited certification body. Mandatory Desirable
3. AT-03 Confirm that the reports and certificate cover every module, hosting region and environment in your proposal. List anything excluded. Mandatory Desirable
4. AT-04 List subservice organizations carved out of your SOC 2 report and the evidence you hold for each. Mandatory Desirable
5. AT-05 State your FedRAMP, GovRAMP or CSA STAR status, level and listing link, if applicable. Mandatory Desirable
6. AT-06 Provide PCI DSS v4.0.1 compliance evidence if card numbers will reach the platform, if applicable. Mandatory Desirable

DR · Data residency and processor terms Section weight %

1. DR-01 List the countries and regions used for production, backups, disaster recovery, archive and support access. Mandatory Desirable
2. DR-02 Sign a data processing agreement that meets GDPR Article 28, if applicable. Mandatory Desirable
3. DR-03 Sign a HIPAA business associate agreement covering all services that handle PHI, if applicable. Mandatory Desirable
4. DR-04 State the transfer mechanism for any personal data leaving our required region. Mandatory Desirable
5. DR-05 Confirm that our data and customer data will not be used or disclosed for any purpose other than providing the service. Mandatory Desirable

PI · Personal data in templates, test data and archives Section weight %

1. PI-01 Describe how non-production environments are protected, and whether they hold production data. Mandatory Desirable
2. PI-02 Provide tooling or services to mask or synthesize test data. Mandatory Desirable
3. PI-03 Detect personal data in templates and content blocks before publishing. Mandatory Desirable
4. PI-04 Apply retention rules to archives by document type and jurisdiction, with deletion when retention ends. Mandatory Desirable
5. PI-05 Mask card numbers when displayed and render them unreadable where stored, if applicable. Mandatory Desirable

AC · Access control and audit trail Section weight %

1. AC-01 Single sign-on through SAML 2.0 or OpenID Connect, with multi-factor authentication. Mandatory Desirable
2. AC-02 Role-based access control separating authoring, approval, publishing and production operations. Mandatory Desirable
3. AC-03 Describe which vendor staff can access production data, how access is approved and how it is logged. Mandatory Desirable
4. AC-04 Audit trail of template, content, configuration and access changes, exportable to our SIEM. Mandatory Desirable
5. AC-05 Log retention period and our ability to export logs at exit. Mandatory Desirable

EN · Encryption and key management Section weight %

1. EN-01 Encryption in transit for data feeds, APIs, print streams and delivery channels. Mandatory Desirable
2. EN-02 Encryption at rest for production, backups and archives. Mandatory Desirable
3. EN-03 Customer-managed keys as an option, with what happens to our data if we revoke a key. Mandatory Desirable

SP · Subprocessors and delivery partners Section weight %

1. SP-01 Provide the full subprocessor list with each one’s role, location and data handled, including print and mail, email and SMS providers. Mandatory Desirable
2. SP-02 Notify us in advance of new or replaced subprocessors and give us a period to object. Mandatory Desirable
3. SP-03 Flow down equivalent security and data protection obligations to each subprocessor. Mandatory Desirable
4. SP-04 Provide security evidence for each print and mail partner that handles our print files. Mandatory Desirable
5. SP-05 Describe how print files are transferred, how long the print partner keeps them, and how they are destroyed. Mandatory Desirable

AI · AI features and data use Section weight %

1. AI-01 For each AI feature, name the model, its provider and where it runs. Mandatory Desirable
2. AI-02 Confirm that our content and customer data are not used to train models, in writing. Mandatory Desirable
3. AI-03 Allow AI features to be switched off by role, environment or tenant. Mandatory Desirable
4. AI-04 Keep an audit trail and human approval step for AI-assisted changes. Mandatory Desirable
5. AI-05 Describe what data each AI feature sends, and whether it is retained by the model provider. Mandatory Desirable

IR · Testing, incidents and resilience Section weight %

1. IR-01 Provide a summary of your most recent independent penetration test and how findings were fixed. Mandatory Desirable
2. IR-02 State your breach notification commitment to us in hours, and the information you will provide. Mandatory Desirable
3. IR-03 Allow our audits, or audits by our appointed auditor, under the contract. Mandatory Desirable
4. IR-04 State recovery time and recovery point objectives, and the date of your last recovery test. Mandatory Desirable

EX · Exit, data return and deletion Section weight %

1. EX-01 Return templates, content, rules, archive and metadata in documented open formats at no extra charge. Mandatory Desirable
2. EX-02 Provide a transition period after termination long enough for a parallel run. Mandatory Desirable
3. EX-03 Delete our data after return, and provide a certificate stating the method used. Mandatory Desirable
4. EX-04 State how long backups persist after deletion and when they expire. Mandatory Desirable
5. EX-05 Confirm subprocessors, including print partners, return or delete our data on the same terms. Mandatory Desirable

Free to reuse. Regulatory lines use US, EU and UK rules as examples, so swap in the rules that apply to you.

How to score the answers

Treat every Mandatory line as a knock-out. Then weight the rest with your scorecard.

A “yes” without evidence counts as unproven. A report with exceptions isn’t a fail, but ask what changed since. Comparing finalists on everything else too? See the CCM benchmark and SmartCOMM alternatives.

Next, plan delivery with the CCM implementation guide, and if you still need budget sign-off, use the CCM business case calculator.