Will you notify us of a security breach, and how quickly?
A detection and response question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. We notify affected customers without undue delay, and within [72 hours] of confirming a breach that affects their data, by email to [the account's security contact].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- The notification clause in your DPA or customer terms
- Your incident response plan's notification step
If you don't do this yet
Match the timeframe to what your contracts already promise. If your DPA says something different from your answer, the reviewer will notice.
Related questions
Do you have an incident response plan?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.