NEST

Finance & Payments United Kingdom Website Reviewed Sept. 22, 2026

UK workplace pension master trust set up under statute; Nest Corporation is the public-corporation trustee running the scheme, accountable to the DWP.

Report an issue with this profile

Certifications & Accreditations

Certification Certifying Body Scope Achieved Expiry Status
ISO/IEC 27001:2022 Officially recognised certification body (not named) Nest’s Information Security Management System, audited annually. No certificate number, scope statement or dates published. — — Current

Compliance Frameworks

ISO/IEC 27001:2022
Partial
Stated in Nest’s January 2026 security white paper; certifying body, certificate number and dates not published.
GDPR 2016/679
Full
DPO appointed ([email protected]); ICO registration Z2343426. No public DPA template.

Contact & Responsible Disclosure

Regulatory status

Nest is a **TPR-authorised master trust** (authorisation announced 10 September 2019), established under statute and accountable to the DWP. It is **not FCA-regulated** — it is a trust-based occupational scheme. No scheme registry number is published on the authorisation announcement.

**CREST is referenced only as the accreditation of Nest’s third-party penetration testing provider** — it is not a Nest certification.

Nest publishes a genuine security contact, which is unusual for this group; phishing reports go to [email protected]. No formal vulnerability disclosure policy or bug bounty was found.

Assess NEST in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register