Security Questionnaire — Response Pack (SAMPLE)

Client: Lumenbase, Inc. (fictional) — logistics analytics SaaS, 28 employees, AWS us-east-1, no SOC 2 yet

Questionnaire: Acme Bank Vendor Security Review v4.2 — 30 of 186 questions (sample extract)

Prepared by: VendorAnswers · Turnaround: 48 h from complete intake

Coverage: 24 Answered · 5 Partial · 1 GAP · 80 % (of the 30 sampled; the full questionnaire had 186 questions, 156 remaining)

Disclaimer: Prepared from client-provided evidence. Not a certification or audit. Answers marked PARTIAL or GAP need client action before submission. See 14-POLITICA-COMERCIAL-REEMBOLSOS-DISCLAIMERS.md (D1–D10).

A. Governance & policies

#	Question	Answer	Evidence	Status
1	Do you maintain a written information security policy, approved by management and reviewed at least annually?	Yes. Information Security Policy v2.1, approved by the CTO on 2026-03-14, next review 2027-03.	`ISP-v2.1.pdf` §1–§3, approval page	✅ Answered
2	Is there a designated security owner with defined responsibilities?	Yes. The CTO is the security owner; responsibilities are defined in ISP §2.2 and in the role charter.	`ISP-v2.1.pdf` §2.2; `RACI-security.xlsx`	✅ Answered
3	Are employees required to complete security awareness training?	Yes, annually, plus onboarding within 30 days. Completion is tracked.	`Training-Log-2026.csv` (94 % completion)	✅ Answered
4	Do you perform background checks on employees with access to customer data?	Partially. Background checks are performed for employees in the US; contractors are not screened.	`HR-Policy.pdf` §7; `Contractor-Agreement.docx`	⚠️ Partial
5	Is there a documented risk assessment process?	Yes. Annual risk assessment with a register and owners; last completed 2026-02.	`Risk-Register-2026.xlsx`; `ISP-v2.1.pdf` §9	✅ Answered

B. Access control & identity

#	Question	Answer	Evidence	Status
6	Is access to production systems restricted to authorized personnel using least privilege?	Yes. Production access is limited to 6 engineers via IAM roles; no shared accounts.	`AWS-IAM-export-2026-09.csv`; `Access-Control-Procedure.pdf` §3	✅ Answered
7	Is multi-factor authentication enforced for all administrative access?	Yes, MFA is enforced on AWS IAM, GitHub, Google Workspace and the admin console.	`MFA-enforcement-report.pdf` (100 % admins)	✅ Answered
8	Are user accounts provisioned and deprovisioned through a documented process?	Yes. Joiner/mover/leaver checklist with HR ticket; deprovisioning within 24 h.	`Access-Control-Procedure.pdf` §4; `Offboarding-checklist.pdf`	✅ Answered
9	Are access reviews performed at least quarterly?	Yes, quarterly; Q2 2026 review closed 2026-07-02 with 3 revocations.	`Access-Review-Q2-2026.pdf`	✅ Answered
10	Is privileged access logged and monitored?	Partially. CloudTrail is enabled, but there is no automated alerting on privileged actions yet.	`CloudTrail-config.pdf`; `Monitoring-Spec.pdf` §2	⚠️ Partial
11	Is remote access to production via VPN or zero-trust?	Yes. Access is via AWS SSO + short-lived credentials; no standing VPN.	`Access-Control-Procedure.pdf` §5	✅ Answered

C. Data protection & encryption

#	Question	Answer	Evidence	Status
12	Is customer data encrypted in transit?	Yes. TLS 1.2+ everywhere; HSTS enabled.	`TLS-scan-2026-09.pdf`	✅ Answered
13	Is customer data encrypted at rest?	Yes. AES-256 on RDS, S3 (SSE-S3) and EBS.	`AWS-Encryption-Config.pdf`	✅ Answered
14	Are encryption keys managed with a documented rotation process?	Partially. AWS-managed keys rotate automatically; customer-managed KMS keys are not in use yet.	`AWS-Encryption-Config.pdf`; `Key-Management-Policy.pdf` §2	⚠️ Partial
15	Is production data used in non-production environments?	No. Non-production uses synthetic data; no production data copies.	`SDLC-Policy.pdf` §6	✅ Answered
16	Is customer data segregated from other customers' data?	Yes. Tenant isolation at the application layer plus separate S3 prefixes and DB schemas; tested.	`Tenant-Isolation-Test-2026-08.pdf`	✅ Answered
17	Is there a documented data retention and deletion policy?	Yes. 30-day post-termination deletion with certificate; backups expire at 35 days.	`Data-Retention-Policy.pdf` §3–§4	✅ Answered

D. Operations, logging & monitoring

#	Question	Answer	Evidence	Status
18	Are production logs centralized and retained?	Yes. CloudWatch Logs with 90-day retention; application logs in S3 with 1-year lifecycle.	`Logging-Config.pdf`	✅ Answered
19	Do you monitor for security events and anomalies?	Yes. GuardDuty, AWS Config, and uptime checks; on-call rotation with 15-min acknowledgement.	`Monitoring-Spec.pdf` §1–§3	✅ Answered
20	Are changes to production managed through a documented change process?	Yes. PR review + CI + approval; release notes kept.	`SDLC-Policy.pdf` §2–§4	✅ Answered
21	Is there vulnerability scanning and patch management?	Yes. Weekly dependency scans; critical patches within 7 days; last scan 2026-09-28.	`Vuln-Scan-2026-09-28.pdf`; `Patch-Policy.pdf`	✅ Answered
22	Do you perform penetration testing?	Partially. One external pen test in 2025; no annual cadence defined.	`Pentest-2025-11.pdf`	⚠️ Partial

E. Incident response & business continuity

#	Question	Answer	Evidence	Status
23	Is there a documented incident response plan with roles and escalation?	Yes. IR Plan v1.4 with severity matrix, on-call, and 24 h customer notification commitment.	`IR-Plan-v1.4.pdf` §2–§5	✅ Answered
24	Has the incident response plan been tested in the last 12 months?	Yes. Tabletop exercise 2026-04; report with actions.	`IR-Tabletop-2026-04.pdf`	✅ Answered
25	Do you notify customers of security incidents within a defined timeframe?	Yes, within 24 h of confirmation, per contract and IR Plan §5.	`IR-Plan-v1.4.pdf` §5	✅ Answered
26	Are backups performed and tested?	Yes. Daily automated backups; restore test 2026-06 completed in 1 h 52 min.	`Backup-Restore-Test-2026-06.pdf`	✅ Answered
27	Is there a documented business continuity / disaster recovery plan?	Partially. BCP exists but RTO/RPO targets are not formally approved.	`BCP-draft-v0.9.pdf`	⚠️ Partial
28	What is your RTO and RPO?	GAP. No approved RTO/RPO. Operational targets are 4 h / 1 h but not signed off.	—	❌ GAP

F. Third parties & secure development

#	Question	Answer	Evidence	Status
29	Do you maintain a register of subprocessors and review their security?	Yes. 9 subprocessors with review dates; annual reassessment.	`Vendor-Register.xlsx`	✅ Answered
30	Is there a secure SDLC with code review and secrets management?	Yes. Mandatory PR review, secret scanning, no secrets in code; SAST in CI.	`SDLC-Policy.pdf` §2–§5; `CI-Config.pdf`	✅ Answered

Open items before submission (1 GAP + 5 PARTIAL)

#	Type	Item	Question	Risk for this deal	Minimum fix	Effort
O1	GAP	No approved RTO/RPO	Q28	High — enterprise buyers usually require it	approve BCP v1.0 with 4 h / 1 h targets	1 day
O2	PARTIAL	No annual pen-test cadence	Q22	Medium	schedule an annual pen test; attach last report	1 week
O3	PARTIAL	No alerting on privileged actions	Q10	Medium	enable GuardDuty/CloudTrail alerts	2 days
O4	PARTIAL	Contractors not background-checked	Q4	Low–medium	add a clause to the contractor agreement	1 day
O5	PARTIAL	Customer-managed keys not in use	Q14	Low–medium	document the AWS-managed rotation model	2 days
O6	PARTIAL	BCP RTO/RPO not formally approved	Q27	Medium	approve BCP and link it to O1	1 day

The remaining 156 questions were answered in the full deliverable. Items are flagged, not hidden: no evidence is fabricated (disclaimer D5).

*Sample for sales demonstration. Company, documents and metrics are fictional. Real deliverables use the client's own evidence and are reviewed by the client before submission.*