For the security certification, the general guideline is that it would need to be provided for the legal entity that hosts the node. Depending on your situation / set up of your node, if there is a need to consider something out of the norm, this can be checked with the EBP.