Given the sensitive nature of these filings, I'd consider SOC 2 certification to be a minimum.