DSP and Pen testing for supporting agencies

e-Referral Service (e-RS)
1

We are a consultancy supporting a provider to integrate with e-RS.

The provider uses Salesforce as a platform.

Should the data security-type sections of the API applications be answered as Salesforce, or as the provider?

i.e. Should Salesforce be able to demonstrate their DSP Toolkit credentials, or the provider? Should Salesforce demonstrate a penetration test results, or the provider?

Are either of these examples applicable as a requirement for us, as the supporting implementation consultancy?

2

Hi Tim - It would be the integrating party in all cases, i.e. the supplier providing the software solution.

From what you’ve stated, this sounds like Salesforce.

3

Ok perfect thank you @zubeir.tai !