Security Center

Cora ensures enterprise-grade security for government agencies and organizations, integrating compliance, encryption, and continuous monitoring to protect project data and maintain regulatory standards while reducing risk exposure.

Capabilities

FedRAMP Ready

Cora has undergone a preliminary FedRAMP assessment, passing an initial security review and positioning itself for full FedRAMP authorization. This designation demonstrates compliance readiness, ensuring that Cora meets federal cybersecurity standards for cloud-based project and program management.

SOC 2 Type 2 Compliant

Cora adheres to SOC 2 Type 2 security controls, ensuring compliance with industry standards for security, availability, processing integrity, confidentiality, and privacy. A third-party auditor verifies that Cora maintains robust security measures aligned with AICPA’s Trust Services Criteria (TSC) for continuous risk management.

24/7 Audit Readiness

Cora maintains real-time compliance monitoring to ensure security controls, policies, and documentation align with regulatory requirements. Automated security checks, continuous audits, and proactive risk assessments keep Cora always audit-ready, supporting rapid response to compliance inquiries and security reviews.

IT Policy Compliance

Cora enforces IT security policies across all systems, aligning with ISO 27001, Cyber Essentials and Cyber Essentials Plus certifications. Regular security assessments ensure adherence to government and enterprise IT standards, reducing vulnerabilities and maintaining secure system configurations.

Cyber Vigilance

Cora implements continuous threat monitoring, phishing protection, and malware defence to safeguard digital assets. Employees undergo mandatory security training covering cybersecurity threats such as data breaches, CEO fraud, and two-factor authentication (2FA), ensuring an adaptive security posture that evolves with the threat landscape.

Data Encryption

Cora PPM infrastructure ensures end-to-end encryption for all project data, securing information both at rest and in transit. Using AES-256 encryption, Cora protects sensitive project and government data from unauthorized access, maintaining regulatory compliance and safeguarding operational integrity.

Cora Security FAQs

Cora keeps detailed logs of all relevant system activities, access controls, and security events, ensuring comprehensive audit trails are always available. Activities are date and time stamped giving you a full audit history.

The only mandatory personal data which Cora require is a name and work e-mail address to enable users’ access for login purposes. Thereafter, it depends on what if any personal data a customer as the data controller chooses to upload. Given the nature of PPM, it is not envisaged any personal or sensitive data would be stored or hosted on the PPM application however it is the responsibility of the Customer to be aware of what if any personal data it will store on the application.

If you are an existing customer, you as the Data Controller are best placed to answer what personal data you are storing on your PPM instance.

A CSR will contact customers at the appropriate time in relation to deletion and/or return of its data. If a customer wishes to have its data returned, Cora PPM has self-service functionality for customers to extract their data from PPM. Where a customer requires technical assistance for example, it does not want to use the self-service functionality and/or has specific requirements around the format it wants the data returned in, this will be charged on a time and materials basis.

If you are an existing customer and have queries or concerns around data retrieval or deletion, you should contact your CSR who will assist you.