Why it matters to you
Your IT provider usually holds administrator-level access to your computers, email, files and cloud accounts. That makes the provider's own security part of your security. If someone breaks into a provider, they can reach many of its clients at once.
Most security frameworks were written for a business that only protects itself. The Trustmark was written for the provider's situation: holding keys to many other businesses' environments. The questions it asks are the ones you would want to ask any provider with access to your systems, such as who has admin access, how that access is limited, how client data is protected, and what happens when something goes wrong.
Who runs it and who checks the work
The Trustmark is issued by GTIA, the Global Technology Industry Association, a trade association for the technology industry.
The assessment is done by an independent third-party assessor, not by GTIA and not by the provider. Those assessors are accredited by CREST, an international not-for-profit accreditation body, under the CIS Controls Accreditation. A GTIA review group then confirms the results before assurance is granted. GTIA reviews the framework every year and updates it as needed.
Assurance also expires. A provider's certificate carries a valid-through date, and the provider has to be reassessed to keep it. Nobody is grandfathered in.
What it is based on
The backbone is the CIS Critical Security Controls version 8, at Implementation Group 2, which is the level aimed at organizations with some IT staff and more sensitive data. GTIA added safeguards and ideas from other well-known sources, including:
- The NIST Cybersecurity Framework.
- NIST SP 800-171, which matters for businesses that touch government contracts.
- The HIPAA Security Rule.
- The New York DFS cybersecurity regulation.
- Cyber insurance application questionnaires, so the standard reflects what insurers really ask.
That list means the Trustmark overlaps with work many businesses already do. It supports those efforts. It does not replace a certification or attestation under any of them.
What gets assessed
The assessment covers 177 safeguards across eight areas:
- Executive accountability, meaning a named leader owns cyber risk.
- Risk management, meaning how risks are found, rated, handled and revisited.
- Security governance, meaning written policies and whether they are kept current and followed.
- Operational security, including configuration, monitoring, patching, vulnerability management and incident response.
- Privileged access control, meaning who holds administrator access into client environments and how it is limited.
- Workforce awareness, meaning training so that staff behavior supports the controls.
- Data protection, meaning how client and company information is identified and protected.
- Continuous improvement, meaning gaps are tracked and closed between assessments.
It is a maturity model, not a one-time checklist. It asks whether security is run as a normal part of the business.
What it is not
It helps to be plain about this, and it is how you should read any provider's claim:
- It is not a SOC 2 report, an ISO 27001 certificate or a government certification, and it does not replace one.
- It assesses the provider's own security program. It does not certify your environment.
- Like any assessment, it reflects the provider's program when it was assessed, and the provider has to keep up the work after that.
How to use it when you compare providers
- Ask for the certificate. A provider that has earned the Trustmark can show it, with the date it was granted, the valid-through date and the GTIA signature.
- Check the date. An expired Trustmark is a question to ask, not proof of anything.
- Ask what "in process" means. If a provider says it is working toward the Trustmark, ask who the assessor is and when the assessment is scheduled.
- Use it with your insurer or auditor. An independent, CREST-accredited assessment can help answer vendor risk and insurance renewal questions about your IT provider.
- Keep asking about the basics. Multi-factor authentication, backups, how admin access is handled and how incidents are reported still matter, whether or not a provider has a Trustmark.
Where Blue Tree Technology® stands
We are in the process of earning the GTIA Cybersecurity Trustmark. We chose it because the assessment is done by someone outside our company, which is the kind of proof we would want from our own providers. We have not been awarded it yet, so we do not claim it. When assurance is granted, we will publish the date and valid-through date here, and clients and their insurers can ask us for a copy of the certificate.
If you are comparing providers and want help reading their security claims, book a free 15-minute discovery call.
FAQ
Is the Trustmark the same as SOC 2?
No. SOC 2 is a report about a company's controls under an AICPA framework. The Trustmark is a GTIA program designed for IT service providers and based on the CIS Controls. They answer different questions, and neither replaces the other.
Does a Trustmark mean my business is secure?
No. It speaks to how your provider runs its own security program. Your own protections, such as multi-factor authentication, backups and training, still matter.
Can a provider just buy it?
No. It is earned through an assessment by an independent, CREST-accredited assessor, and a GTIA review group confirms the result.
How long does it last?
Each award has a valid-through date, and providers must be reassessed to keep it.
Does Blue Tree Technology® have it?
Not yet. We are in the process of earning it.
Related Blue Tree Technology® pages
- What Is SOC 2? A Plain-English Guide for Kansas City Businesses
- A Client Sent Us a Security Questionnaire. How Should We Answer It?
- MSP Certifications, Audits, and References: What Actually Builds Confidence?
- IT compliance services
Still have a question?
Ask Little Sprout for general information. If you are comparing providers and want help reading their security claims, book a free 15-minute discovery call.