Do you have an incident response plan?
A detection and response question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Security incidents follow a documented process covering detection, triage, containment, customer notification and review. [Role] owns it, and it was last rehearsed in [month and year].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- The incident response plan or a summary
- A record of the last tabletop exercise
If you don't do this yet
A one-page plan naming who does what is enough to start. Say it's new and when you'll first rehearse it, rather than describing a process that exists only in someone's head.
Related questions
Will you notify us of a security breach, and how quickly?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.