3-3 Audits and Certifications To show compliance with Postal Service information security requirements, suppliers may submit reports generated by credible third-party auditing authorities. These reports may be used as evidence of compliance, but do not necessarily replace other Postal Service monitoring activities, listed above. Examples of acceptable evidence include the following: Service Organization Control 2 Type II (SOC 2 Type II). International Organization for Standardization (ISO 27001). National Institute of Standards (NIST 800-53). Federal Information Security Management Act (FISMA). Payment Card Industry Data Security Standard (PCI/DSS) and/or Payment Application Data Security Standard (PA/DSS).