Security questionnaire answers: the Notice Labs Controls library

Controls marked with a star on a trust center come from this library. Each has the same wording wherever it appears, grouped by the question a security reviewer is asking. Where a control has a questionnaire page, it links to a model answer.

The company that publishes the trust center chooses which controls apply to it and states that they are true. Notice Labs doesn't audit or verify them.

When Notice Labs releases a new version of a control's wording, your dashboard shows how many controls have a new version waiting. Your page keeps the wording you chose until you accept the change.

Access

Who can get to your data?

Multi-factor authentication: Staff need more than a password to sign in to systems that hold customer data.; A stolen password alone doesn't get anyone in.; How to answer "Do you enforce multi-factor authentication?"
Least-privilege access: Staff, contractors and vendors get only the access their role needs.; Your data is reachable by as few people as possible.
Access reviews: Access to customer data is reviewed regularly, and access that's no longer needed is removed.; Access doesn't linger after someone changes role or leaves.; How to answer "Do you review user access regularly?"
Secrets management: Credentials and keys are kept out of source code, in secret storage with restricted access.; A leaked code repository doesn't hand over the keys.

Data

Is your data protected, kept apart, and removed when you leave?

Data encryption: Customer data is encrypted in transit and at rest.; Your data can't be read on its way to or from the service, or where it's stored.; How to answer "Is customer data encrypted in transit and at rest?"
Customer data isolation: Each customer's data is kept logically separate from every other customer's.; Another customer's mistake can't expose your data.
Production data separation: Customer data isn't copied into development or test environments unless anonymised.; Your live data isn't sitting in a test system.
Retention and deletion: Customer data is kept only as long as needed, and deleted when a customer leaves or asks.; When you leave, your data goes too.; How to answer "How long do you keep customer data, and how is it deleted?"

Foundations

Is the service built on solid ground, and will it stay up?

Audited cloud hosting: Production runs on cloud providers that hold independent security audits.; Physical and network security is handled by specialists.
Network protection: Traffic to production is filtered to block unauthorised access and denial-of-service attacks.; Internet noise and floods of traffic don't become an outage.
Email domain protection: Mail from the company's domain is authenticated, so others can't send it in its name.; Phishing email can't convincingly pretend to be this company.
Automated backups: Customer data is backed up automatically.; A failure or a bad change doesn't mean lost data.; How to answer "Do you back up customer data?"
Disaster recovery: Recovery from a major outage follows a tested plan.; A serious outage is handled by a rehearsed plan.; How to answer "Do you have a disaster recovery plan?"
Public status page: Availability and incidents are published on a public status page.; You can check uptime and incident history yourself.

Detection and response

If something goes wrong, will it be noticed, handled and reported to you?

Audit logging: Security-relevant actions, including staff access to customer data, are logged.; There's a record of who did what, including admins.
Security monitoring: Systems are watched for suspicious activity, and alerts reach someone who acts on them.; Someone is watching, not just collecting logs.
Incident response: Security incidents are handled through a documented, rehearsed process.; An incident is handled calmly, not improvised.; How to answer "Do you have an incident response plan?"
Breach notification: Customers are told without undue delay when a confirmed incident affects their data.; You won't hear about it from the news.; How to answer "Will you notify us of a security breach, and how quickly?"

Product security

Is the product built and changed safely?

Change review: Every change to production is reviewed by someone other than its author.; One person can't ship an unchecked change to your data.
Automated security checks: Code and dependencies are scanned automatically for known security problems before release.; Common mistakes are caught before they ship.
Vulnerability management: Known vulnerabilities are tracked and fixed in order of severity.; Known holes get closed, the worst first.; How to answer "How do you manage vulnerabilities?"
Independent penetration testing: Independent specialists test the product for vulnerabilities on a regular schedule.; Someone paid to break in has tried recently.; How to answer "Do you perform penetration testing?"
Vulnerability disclosure: Anyone can report a vulnerability through a published channel.; Researchers can report problems instead of exploiting them.

People and suppliers

Are the people, devices and vendors that could touch your data vetted?

Background checks: Staff are background-checked, where the law allows, before they can reach customer data.; The people with access to your data have been vetted.; How to answer "Do you perform background checks on employees?"
Security training: Staff are trained in security, including phishing and data handling, and refreshed regularly.; Staff are less likely to be the way in.; How to answer "Do employees receive security awareness training?"
Device security: Company devices that reach customer data are encrypted, managed and protected from malware.; A lost or infected laptop isn't an open door.
Vendor security review: Vendors that handle customer data are security-reviewed before use and periodically after.; Your data isn't handed to a vendor nobody checked.; How to answer "How do you assess the security of your vendors?"
Risk assessment: Security risks are assessed regularly, and the results set what's fixed first.; Security effort goes where the real risk is.

AI

If AI is used, is it governed, and is your data kept out of training?

No training on customer data: Customer data isn't used to train AI models without the customer's consent.; Your data doesn't quietly become part of a model.; How to answer "Is our data used to train AI models?"
AI use policy: Staff and product use of AI follows a written policy on approved tools and data handling.; AI is used deliberately, not ad hoc.; How to answer "Do you have an AI use policy?"
AI provider review: AI providers are reviewed like any other vendor, with contractual limits on keeping customer data.; The AI behind the product is held to the same bar.
Human oversight of AI: A person reviews AI output before it drives a decision that affects a customer.; AI doesn't get the final word on something affecting you.
AI evaluation: New or changed AI features are tested for accuracy and safety before release.; New AI features are checked before they reach you.

How we choose controls

The library has 33 controls in six categories, plus an optional AI category that appears only when a trust center picks one of its controls. The categories are the questions a reviewer asks: who can get to your data, whether it is protected, whether the service is built on solid ground, and so on.

We chose controls from what buyers need to know, then checked the list against 16 real trust centers and against what SOC 2, ISO 27001 and NIST CSF cover. It is a judgement about what a buyer will ask, not a copy of any standard.

Each control makes one claim in one present-tense sentence, with a plain line on what it means for a buyer. The wording has no specifics: the cadence, provider or number comes from the company that publishes it. Documents, certifications and named tools are not controls.

Controls are versioned, and a published version never changes. A change adds a new version with a note on what changed. Every control has a version number, and 5 of the 33 have been revised since release. The most revised control is at version 2.

Questions worth asking

What people ask before they use the library.

Do we have to use the library wording?

No. You choose which library controls apply to you, and you can write your own controls where the library doesn't cover something. Library controls carry a star on your trust center.

Does Notice Labs check that our controls are true?

No. You state that each control applies to you. Notice Labs doesn't audit, verify or monitor any of it, and the star means the wording is ours, not that we checked the claim.

What if we don't do one of these yet?

Don't turn it on. Where a control has a questionnaire page, it includes an honest answer for a team that doesn't do the thing yet.

Will the wording change on our page without us noticing?

No. A published version never changes. When a new version is released, your dashboard shows how many controls have one waiting, and your page keeps the wording you chose until you accept it.

Is this a SOC 2 or ISO 27001 checklist?

No. The library was checked against what SOC 2, ISO 27001 and NIST CSF cover, but it is a list of what buyers ask about, not a framework. Publishing these controls doesn't make you compliant with any standard.