Security Assurance Assessment

Evidence

Evidence Position

What you could put in front of someone who asks, and how long it would take to find.

If a customer asked today for proof of your security controls, what would you send? We would have to work out what we even have A policy document, and hope it answers the question Policies, plus whatever evidence we can gather that week A prepared pack, updated when someone remembers A current pack we maintain deliberately, sent the same day Not applicable to us

How long does answering a customer security questionnaire actually take? Weeks, and it pulls in several senior people A week or more, mostly spent chasing internally A few days, because we reuse the last one A day or two, from a maintained answer set Hours, the answers exist and we check them rather than write them Not applicable to us

When did you last verify that a control you claim to have is actually operating? We have never checked Only when an auditor or customer made us At the last certification or penetration test Periodically, on the controls that matter most On a schedule, with the evidence retained each time Not applicable to us

Who could produce your current security documentation without asking anyone? Nobody, it would be assembled from scratch One person, and much of it is in their head One person, from files they maintain themselves Two or three people, from a shared place Anyone who needs it, from a single maintained source Not applicable to us

Obligation

Regulatory Obligation & Scope

What you are actually required to do, by whom, and by when.

Do you know which security regimes genuinely apply to you? No, and we have not looked We assume data protection law and have not gone further We have a rough idea, never written down We have listed them and review occasionally Written down, with owners and review dates Not applicable to us

How did you establish what your customer contracts commit you to on security? We have never looked at the security clauses Legal reviewed them at signature and nobody since We know what the largest customers asked for We have extracted the obligations from material contracts Obligations are tracked centrally and checked against reality Not applicable to us

If a new obligation came into force next quarter, who would notice? Nobody, until a customer or auditor told us Possibly our lawyers, if it were significant Someone would forward an article about it A named person tracks changes as part of their role Tracked formally, with an assessment of what changes for us Not applicable to us

What happens when a contract asks for a security control you do not have? We have not noticed that happening We sign, and deal with it if it ever comes up It gets flagged to the deal team and we usually sign anyway We negotiate it, or accept it knowingly with a plan It is caught before signature and either priced or remediated Not applicable to us

Access

Access & Identity

Who can reach what, and whether anyone has checked lately.

Could you list, today, everyone with administrative access to your core systems? No Roughly, after asking a few people Yes, for the main systems Yes, from a maintained record Yes, and it is reviewed on a schedule with sign-off Not applicable to us

What happens to someone's access when they leave? It is removed when somebody remembers HR tells IT and most of it goes There is a checklist, followed most of the time There is a process, and it is verified afterwards Driven from the HR record, with exceptions reported Not applicable to us

How do people sign in to your most sensitive systems? Passwords, some of them shared Individual passwords, no second factor Multi-factor on some systems Multi-factor everywhere that supports it Single sign-on with enforced multi-factor and conditional access Not applicable to us

When did the person accountable for sensitive data last review who can see it? Never Once, at some point At the last audit Annually, by the system owners Quarterly, with a record of the decisions made Not applicable to us

Third Party

Third-Party Assurance

What you can demonstrate about the suppliers who hold your data.

Do you know which suppliers hold or process your customer data? No We could probably work most of it out We have a list, and it is probably incomplete We maintain a list of the material ones Maintained, classified by what they hold, and reviewed Not applicable to us

What assurance do you take before a supplier handles sensitive data? None in particular We ask whether they are secure We send a questionnaire and file the answer We review their certification and check the scope covers us We assess proportionately, and re-check at renewal Not applicable to us

If a supplier were breached tomorrow, how would you find out? They would tell us eventually, or we would read about it Our account manager would probably hear Contracts require notification, though we have never tested it Notification terms exist and we know who receives them Terms, a named recipient, and a rehearsed response Not applicable to us

How do you handle software your teams adopt without asking? We do not know what has been adopted We find out when the invoice appears IT usually gets asked, eventually There is a route to get things approved and most people use it Discovery plus an approval route, with the gap actively closed Not applicable to us

Secure Delivery

How security works inside building software. Unticked by default; tick it if you build any.

Where does security checking happen in how you build or change software? It does not A penetration test before a major release Scanning runs, and the findings sit in a backlog Findings are ranked and owned, and block release when serious Checks run where the work happens, ranked before anyone sees them Not applicable to us

How do you know which open-source components you depend on? We do not Someone could reconstruct it from the code We generate a list occasionally Dependencies are inventoried and watched for advisories Inventoried, watched, and patched on a known clock Not applicable to us

How are secrets such as keys, tokens and credentials handled in your systems? In configuration files, and honestly some in the code Mostly in configuration, with a few in a manager In a secrets manager, with legacy exceptions In a manager, with rotation on the important ones Managed, rotated automatically, and scanned for in code Not applicable to us

Who is accountable when a security finding is not fixed? Nobody, it stays in the backlog It gets raised again at some point The engineering lead, informally A named owner with a due date A named owner, a due date, and visible escalation when missed Not applicable to us

Incident

Incident Readiness

What happens in the first hour, and whether anyone has tried it.

If you were breached this evening, who makes the first decision? We would work that out at the time Whoever is available and senior enough It would start with IT and escalate from there A named person, with a named deputy Named, with authority agreed in advance and out-of-hours cover Not applicable to us

Does an incident plan exist, and has anyone actually run it? There is no plan There is a document nobody has opened A plan exists and the people who wrote it have read it It has been walked through with the people named in it Rehearsed, including the board, and updated from what went wrong Not applicable to us

How quickly could you notify a regulator or a customer if you had to? We do not know what we would be required to do We would find that out at the time We know the deadlines exist We know the deadlines and who would draft the notification Templates, named owners, and a rehearsed clock Not applicable to us

What could you reconstruct about an incident afterwards? Very little Some of it, from memory and email Logs exist on the main systems Logs are retained centrally for a known period Retained, searchable, and we have tested reconstructing an event Not applicable to us

Governance

Governance & Accountability

Whether security reaches the board as a position rather than an incident.

Who at board level owns security? Nobody in particular It falls to whoever raises it It sits with IT and gets reported upward A named executive owns it A named executive owns it, with a standing agenda item Not applicable to us

What does the board actually see about security? Nothing Something, when an incident happens An occasional update on projects A regular report on position and risks Position, direction of travel, and the decisions being asked for Not applicable to us

How is security risk recorded? It is not In someone's notes On a risk register that is updated rarely On the risk register, with owners and review dates With owners, reviews, and evidence of risks actually being closed Not applicable to us

What is your security budget based on? There is no security budget Roughly whatever was spent last year Tooling renewals, mostly An assessment of risk, agreed annually Risk and obligation, with what the spend buys stated Not applicable to us

About you

A few things that are not scored

None of this affects your result. It tells us how to read it, and it is the part that makes any follow-up conversation useful rather than generic. Skip anything you would rather not answer.

What prompted you to look at this now? A customer security review or questionnaire An insurance renewal A transaction: diligence, acquisition or funding A regulatory or contractual requirement An incident, ours or somebody else's General review or benchmarking

Which best describes what the business does? Technology or software Financial services or insurance Health, care or life sciences Manufacturing or industrial Professional or business services Something else

Who currently carries security day to day? Nobody specifically An IT manager, alongside everything else A managed service provider A dedicated security person or small team A CISO or equivalent

Have you used external help for any of these in the last three years? Penetration testing ISO 27001, SOC 2 or Cyber Essentials Incident response retainer Answering customer security questionnaires Virtual or fractional security leadership None of these

If a customer asked you to prove it, what would you send?

Which areas do you want to assess?