Security questionnaire questions, and how to answer them
Practical guidance for the questions that come up in almost every customer security review.
Data protection
Access control
Infrastructure
- Do you perform penetration testing?
- How do you identify and patch vulnerabilities?
- Do you have a business continuity and disaster recovery plan?
- How often do you back up data, and how long are backups kept?
- How do you secure your software development lifecycle?
- Do you have a vulnerability disclosure or bug bounty program?
Governance
- Do you have a SOC 2 report?
- What do you say when a customer asks for a SOC 2 report and you don't have one?
- Are you ISO 27001 certified?
- Do you have a documented information security policy?
- Do employees receive security awareness training?
- Do you perform background checks on employees?
- Do you carry cyber liability insurance?