Adatree looks at a variety of factors when considering whether a prospective partner would be an appropriate CDR Representative, including existing security posture and certifications, reputation, business case and general business sophistication. Adatree also partners with providers who specialise in building CDR compliant environments, making it quicker and easier to become a CDR Representative. The requirements are: - Must have or willing to get an IT certification or audit (e.g. ISO27001, SOC-2 Type 2, ASAE3150), - Clearly documented security policies and controls. Adatree also accepts Representatives that are licensed by APRA (ADI) and companies with compliant, managed environments. Adatree must abide by the regulations that govern CDR Representatives, as a CDR Principal. Updated guidance issued by the CDR regulators is found here, which both Adatree as a Principal and the CDR Representatives must comply. There are no shortcuts to CDR access, and Representatives need to have the maturity and processes that are similar to an ADR. The regulators are frequently assessing and governing this.