The questionnaire — every question, inline
1. Audit, Assurance & Compliance
3 questionsExternal attestations and audit rights.
1.1
Provide current SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018 reports and the audit firm name.
Critical
1.2
Do customers have the right to audit your controls directly, or only via pooled audits?
High
1.3
How are findings from internal audits tracked to remediation? Provide an example CAR/CAPA cycle.
Medium
2. Identity & Access Management
3 questionsTenant identity, federated access, privileged accounts.
2.1
Do you support SAML 2.0 and OIDC federation for customer identity? Any tier restriction?
Critical
2.2
Are privileged customer-environment access events logged with operator identity and reason-for-access?
Critical
2.3
What break-glass procedure exists for emergency access, and how is it reviewed?
High
3. Encryption & Key Management
3 questionsAt-rest, in-transit, and customer-managed keys.
3.1
Specify algorithms and key lengths for at-rest encryption (e.g. AES-256-GCM).
Critical
3.2
Can customers bring or hold their own encryption keys (BYOK / HYOK)? Describe the supported KMS integrations.
High
3.3
How are TLS certificates rotated and what is the minimum protocol version accepted?
High
4. Data Center & Physical Security
3 questionsWhere data physically lives.
4.1
List all data center regions and the underlying provider (AWS / GCP / Azure / Equinix / own).
Critical
4.2
Are data centers SSAE 18 SOC 2 + ISO 27001 audited? Provide the upstream provider attestations.
High
4.3
Can customer data residency be pinned to a single country / region? Describe failover behaviour.
Critical
5. Threat & Vulnerability Management
3 questionsPatching, scanning, pen testing.
5.1
Maximum window from public CVE disclosure (CVSS ≥ 9) to deployed fix in production?
Critical
5.2
Frequency, scope, and provider of external penetration tests? When was the last one?
High
5.3
Do you run a coordinated vulnerability disclosure or bug-bounty program? Provide the public policy URL.
Medium
6. Security Incident Management
3 questionsDetection, response, customer notification.
6.1
What is your maximum SLA from confirmed customer-impacting security incident to first customer notice?
Critical
6.2
Describe your 24/7 SOC capability — in-house, MSSP, or hybrid? Name the provider if MSSP.
High
6.3
Are post-incident reports (RCA) shared with affected customers? Provide a sample structure.
High
7. Business Continuity & Disaster Recovery
3 questionsResilience, RTO, RPO.
7.1
Published RTO and RPO for the production service? Provide the SLA document URL.
Critical
7.2
Are DR scenarios tested at least annually with full failover? Provide the most recent test summary.
High
7.3
How geographically diverse are backup copies (single-region, multi-region, multi-provider)?
High
8. Interoperability & Portability
2 questionsGetting in and getting out.
8.1
What APIs and bulk-export formats are available for customers to retrieve their data?
High
8.2
On termination, what is the SLA to deliver a final data export and to confirm complete deletion?
Critical
9. Supply Chain Management
3 questionsSubprocessors, open source.
9.1
Public subprocessor list URL — must include name, function, country, and data categories accessed.
Critical
9.2
Notice period for new or replaced subprocessors? Is opt-out available?
High
9.3
Do you produce an SBOM for the platform and share it with enterprise customers on request?
Medium
10. AI / ML Use Disclosure
2 questionsIf applicable to the service.
10.1
Does the service use customer data to train any AI/ML models? If yes, describe consent and opt-out.
Critical
10.2
List third-party AI/LLM providers in the data path (OpenAI, Anthropic, AWS Bedrock, etc.) and the data categories they receive.
Critical