SOC 2 auditor interview prep sheet

How do you make sure employees have read and agreed to the policies?

From the auditor question bank

Your policy says:

“People Operations retains evidence of screening, signed agreements, policy acknowledgments, training completion, role-change reviews and offboarding checklists for seven years after employment ends, or longer where law requires, in line with the Data Retention and Disposal Policy, so that these controls can be evidenced for any audit period.”

P18 §4.13, Human Resources Security Policy

“All personnel acknowledge this policy and the Acceptable Use Policy in writing at hire, at each annual review and after each material revision.”

P01 §4.6, Information Security Policy

Walk me through how Northwind Cloud Inc handles integrity and ethical values, and show me signed Acceptable Use Policy acknowledgment forms for every employee and contractor.

Derived from the criterion text

Your policy says:

“No account, device or system access is issued until the individual has signed an employment or services agreement with confidentiality and intellectual property terms and has acknowledged the Information Security Policy and the Acceptable Use Policy in writing.”

P18 §4.2, Human Resources Security Policy

“Contractors, agency workers and vendor staff with access to Northwind Cloud Inc systems meet the same screening, acknowledgment, training and offboarding requirements as employees.”

P18 §4.9, Human Resources Security Policy

Walk me through how Northwind Cloud Inc handles oversight by leadership, and show me leadership or board meeting notes showing a security update as an agenda item at least twice a year.

Derived from the criterion text

Your policy says:

“The Security Owner updates the register within ten business days of any change: new risks from incidents, audits, vendor reviews or personnel reports; completed actions with evidence; re-scored risks; and expired acceptances.”

P17 §5.6, Risk Assessment and Management Policy

“At least annually, someone who does not own the register (a member of Executive Management, an internal reviewer or an external advisor) evaluates whether the assessment was complete, scores consistent and treatments carried out, and records the outcome.”

P17 §4.13, Risk Assessment and Management Policy

Show me memo or email appointing the Security Owner, signed by the approver, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“Where acceptance is proposed, the Security Owner summarizes the risk, controls, residual score and reason, obtains written approval from the authority in 4.5, records approver and expiry in the register and adds the expiry to the review calendar.”

P17 §5.5, Risk Assessment and Management Policy

“Engineering, People Operations and the Security Owner collect the evidence in 4.9 on the cadence set in the relevant policy, record results against mapped risks and raise a ticket for any control not operating; the Security Owner reviews results monthly and re-scores affected risks.”

P17 §5.9, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles structure, reporting lines and authority, and show me current org chart exported from the HR or identity system.

Derived from the criterion text

Your policy says:

“Every risk has one named owner accountable for the treatment decision and for keeping the entry current; treatment actions have owners and due dates in the ticketing system, and overdue actions on High and Critical risks are reported to Executive Management at the next quarterly review.”

P17 §4.7, Risk Assessment and Management Policy

“Engineering designs, builds and operates Northwind and its infrastructure on AWS and Vercel in line with these policies.”

P01 §3, Information Security Policy

Show me Roles and Responsibilities section of the Information Security Policy naming the Security Owner, Engineering Lead and approver, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“Engineering leads own the technical policies assigned to them in the policy register.”

P01 §3, Information Security Policy

“People Operations identifies risks from hiring, role changes, departures, training gaps and insider threat, owns treatment actions in those areas, and reflects risk responsibilities in role descriptions.”

P17 §3, Risk Assessment and Management Policy

Do you conduct background checks and security training?

From the auditor question bank

Your policy says:

“All personnel complete security awareness training within 30 days of starting and at least every 12 months thereafter.”

P18 §4.4, Human Resources Security Policy

“The Security Owner maintains the curriculum and assigns it to new starters within 30 days and to all personnel annually.”

P18 §5.4, Human Resources Security Policy

Walk me through how Northwind Cloud Inc handles competent people, and show me job descriptions for security-relevant roles listing security responsibilities.

Derived from the criterion text

Your policy says:

“Every job description for a role with system access states its security responsibilities.”

P18 §4.10, Human Resources Security Policy

“Every candidate for a role with access to Northwind systems, customer data or company finances is screened before their start date: identity verification, right-to-work confirmation, verification of the most recent employment, and a criminal record check where legally permitted in the candidate's jurisdiction and proportionate to the role.”

P18 §4.1, Human Resources Security Policy

How do you make sure employees have read and agreed to the policies?

From the auditor question bank

Your policy says:

“People Operations retains evidence of screening, signed agreements, policy acknowledgments, training completion, role-change reviews and offboarding checklists for seven years after employment ends, or longer where law requires, in line with the Data Retention and Disposal Policy, so that these controls can be evidenced for any audit period.”

P18 §4.13, Human Resources Security Policy

“No account, device or system access is issued until the individual has signed an employment or services agreement with confidentiality and intellectual property terms and has acknowledged the Information Security Policy and the Acceptable Use Policy in writing.”

P18 §4.2, Human Resources Security Policy

Walk me through how Northwind Cloud Inc handles accountability, and show me enforcement sections of the approved policies describing the disciplinary process.

Derived from the criterion text

Your policy says:

“Violations are handled by People Operations with the Security Owner and may result in retraining, loss of access, disciplinary action up to and including termination of employment or contract, and, where the law requires, referral to authorities.”

P01 §7, Information Security Policy

“People Operations and the Security Owner handle violations together.”

P02 §7, Acceptable Use Policy

Walk me through how Northwind Cloud Inc handles quality information, and show me asset inventory export (MDM device list plus cloud resource inventory) with owner and classification columns.

Derived from the criterion text

Your policy says:

“Northwind Cloud Inc maintains an asset register covering hardware, cloud resources, software and services, and data assets.”

P05 §4.1, Asset Management Policy

“Every resource in AWS and Vercel is created through infrastructure-as-code or a documented change and carries tags for owner, environment, service and data classification.”

P05 §4.5, Asset Management Policy

Show me log retention configuration screenshot from the logging tool showing retention of at least 12 months for security logs, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“Security and audit logs are retained for at least 12 months with the most recent 90 days searchable without restoration; application debug logs are retained for 30 days.”

P12 §4.4, Logging and Monitoring Policy

“Company devices are procured through the IT/Operations Lead, configured to the baseline in the Endpoint and Workstation Security Policy before handover, enrolled in Kandji so that encryption, screen lock, update and inventory policies apply automatically, and recorded in the register with the assigned user on the day they are issued.”

P05 §4.3, Asset Management Policy

How do you make sure employees have read and agreed to the policies?

From the auditor question bank

Your policy says:

“All personnel acknowledge the Information Security Policy, the Acceptable Use Policy and this policy within five business days of starting and within 30 days of each revision.”

P18 §5.3, Human Resources Security Policy

“Three business days before the start date, People Operations opens an onboarding ticket listing role, manager, start date, device requirement and access profile.”

P18 §5.2, Human Resources Security Policy

Walk me through how Northwind Cloud Inc handles internal communication, and show me onboarding checklist showing policy distribution and security training as required steps.

Derived from the criterion text

Your policy says:

“People Operations collects acknowledgment from every new hire before access is granted and from all personnel at each annual review, assigns awareness training within thirty days of hire and annually thereafter, and reports outstanding items to the Security Owner monthly.”

P01 §5.3, Information Security Policy

“Security Owner (Dana Whitfield, CTO) owns the security content of the onboarding and offboarding checklists, defines the training curriculum, reviews access reconciliations and handles escalations of suspected policy violations.”

P18 §3, Human Resources Security Policy

How would customers be notified of a security incident affecting their data?

From the auditor question bank

Your policy says:

“The Security Owner assesses the risk to individuals, notifies supervisory authorities where the law requires (within 72 hours where the GDPR or a similar law applies), notifies affected customers within their contractual period and no later than 72 hours after confirmation, and notifies affected individuals where the risk to them is high.”

P22 §4.11, Privacy and Data Protection Policy

“Every vendor that processes personal data for Northwind Cloud Inc is bound by a written data processing agreement covering the scope and purpose of processing, security measures, onward sub-processing, and assistance with data subject requests and breach notification.”

P22 §4.5, Privacy and Data Protection Policy

Walk me through how Northwind Cloud Inc handles external communication, and show me public security page or trust page URL and a dated screenshot.

Derived from the criterion text

Your policy says:

“Northwind Cloud Inc monitors critical vendors between reviews through status pages, security advisories and published sub-processor changes, and treats any vendor breach notification as an incident under the Incident Response Policy.”

P16 §4.9, Vendor and Third-Party Risk Management Policy

“Incidents arrive from Datadog alerts, AWS and Vercel security notifications, secret-scanning and dependency alerts from GitHub, vendor notices, customer reports and personnel reports to security@northwindcloud.example.”

P13 §5.1, Incident Response Policy

Have you performed a risk assessment, and how is it documented?

From the auditor question bank

Your policy says:

“Control operation is monitored through defined evidence: access reviews, vulnerability scans, backup and restore tests, incident metrics, vendor reviews and training completion.”

P17 §4.9, Risk Assessment and Management Policy

“At least annually, someone who does not own the register (a member of Executive Management, an internal reviewer or an external advisor) evaluates whether the assessment was complete, scores consistent and treatments carried out, and records the outcome.”

P17 §4.13, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles objectives for risk assessment, and show me risk assessment scope statement naming the in-scope product, environments and Trust Services Categories.

Derived from the criterion text

Your policy says:

“The program exists to protect the confidentiality, integrity and availability of customer data and company systems; to meet the commitments Northwind Cloud Inc makes in contracts, its terms of service and its privacy notice; to satisfy the Security and Availability criteria selected for the SOC 2 examination; and to keep risk within the tolerance set by Executive Management.”

P01 §4.2, Information Security Policy

“The Security Owner maintains a mapping from each risk to the policies and controls that treat it and to the applicable Trust Services Criteria, so that the control set can be shown to follow from assessed risks and gaps are visible.”

P17 §4.8, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles identifying and analyzing risks, and show me completed annual risk register with likelihood, impact, treatment and owner columns.

Derived from the criterion text

Your policy says:

“Once a year the Security Owner arranges the evaluation required by 4.13, provides the register, treatment evidence and monitoring results, records findings as risks or actions and presents the evaluation to Executive Management.”

P17 §5.10, Risk Assessment and Management Policy

“Every assessment identifies assets and owners, threats and vulnerabilities, existing controls, and likelihood and impact on the Section 2 scales, considering external attack, internal misuse, error, vendor failure, environmental events, legal change and fraud, including misuse of privileged access and manipulation of financial or customer records.”

P17 §4.2, Risk Assessment and Management Policy

Show me vendor risk assessment records for critical vendors (SOC 2 report review notes or security questionnaire), and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“For Tier 1 vendors, the Security Owner obtains the current SOC 2 Type II report or ISO 27001 certificate, reviews scope, opinion, exceptions and complementary user entity controls, sends the Northwind Cloud Inc questionnaire where gaps remain and documents the data flow with Engineering; Tier 2 vendors need an assurance report or completed questionnaire.”

P16 §5.2, Vendor and Third-Party Risk Management Policy

“Participants agree inherent likelihood and impact on the Section 2 scales, list existing controls and agree residual scores; the Security Owner challenges scores inconsistent with comparable risks or incident history and records the rationale.”

P17 §5.3, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles fraud risk, and show me risk register entries tagged as fraud or insider-threat risks with their treatments.

Derived from the criterion text

Your policy says:

“Every assessment identifies assets and owners, threats and vulnerabilities, existing controls, and likelihood and impact on the Section 2 scales, considering external attack, internal misuse, error, vendor failure, environmental events, legal change and fraud, including misuse of privileged access and manipulation of financial or customer records.”

P17 §4.2, Risk Assessment and Management Policy

“At least annually, someone who does not own the register (a member of Executive Management, an internal reviewer or an external advisor) evaluates whether the assessment was complete, scores consistent and treatments carried out, and records the outcome.”

P17 §4.13, Risk Assessment and Management Policy

Show me segregation-of-duties statement in the Access Control Policy and a screenshot showing production deploys require a second approver, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“When monitoring shows a control has failed, the related risk is re-scored and, if it reaches High or Critical, a triggered assessment is opened.”

P17 §4.9, Risk Assessment and Management Policy

“Access to GitHub is granted through organization membership enforced by single sign-on with Okta, repository permissions are assigned by team, and protected branches require a review from someone other than the author before code is merged and deployed by GitHub Actions.”

P03 §4.8, Access Control Policy

Have you performed a risk assessment, and how is it documented?

From the auditor question bank

Your policy says:

“Participants agree inherent likelihood and impact on the Section 2 scales, list existing controls and agree residual scores; the Security Owner challenges scores inconsistent with comparable risks or incident history and records the rationale.”

P17 §5.3, Risk Assessment and Management Policy

“The Security Owner updates the register within ten business days of any change: new risks from incidents, audits, vendor reviews or personnel reports; completed actions with evidence; re-scored risks; and expired acceptances.”

P17 §5.6, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles changes that affect risk, and show me risk register revision history showing an update tied to a major change in the period.

Derived from the criterion text

Your policy says:

“The Security Owner reviews this policy on the annual review cycle and after any significant change to Northwind Cloud Inc's source control, pipeline tooling or cloud platforms, and after any incident caused by a change.”

P09 §8, Change Management Policy

“The Security Owner reviews every High and Critical risk with its owner, confirms progress, re-scores where circumstances have changed, chases overdue actions, checks acceptances expiring next quarter, reviews monitoring evidence and prepares the report required by 4.11.”

P17 §5.7, Risk Assessment and Management Policy

Do you perform periodic access reviews?

From the auditor question bank

Your policy says:

“Security Owner (Dana Whitfield, CTO) owns this policy, maintains the role-to-access matrix, runs the periodic access reviews, approves privileged and production access, and holds the evidence of every grant, review and removal.”

P03 §3, Access Control Policy

“Where acceptance is proposed, the Security Owner summarizes the risk, controls, residual score and reason, obtains written approval from the authority in 4.5, records approver and expiry in the register and adds the expiry to the review calendar.”

P17 §5.5, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles ongoing and separate evaluations, and show me annual internal control self-assessment using the Evidence Checklist, signed by the Security Owner.

Derived from the criterion text

Your policy says:

“Once a year the Security Owner arranges the evaluation required by 4.13, provides the register, treatment evidence and monitoring results, records findings as risks or actions and presents the evaluation to Executive Management.”

P17 §5.10, Risk Assessment and Management Policy

“Control operation is monitored through defined evidence: access reviews, vulnerability scans, backup and restore tests, incident metrics, vendor reviews and training completion.”

P17 §4.9, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles communicating deficiencies, and show me remediation tracker (spreadsheet or issue board) with owner, due date and status for each open finding.

Derived from the criterion text

Your policy says:

“Findings are tracked to closure in the risk register with an owner and due date.”

P01 §5.8, Information Security Policy

“Every SEV1 and SEV2 incident receives a blameless post-incident review within five business days of closure that produces a root cause, impact statement and corrective actions with owners and due dates, tracked to closure and reported to Executive Management.”

P13 §4.11, Incident Response Policy

Show me incident post-mortem documents with action items and their completion dates, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“Within five business days of closing a SEV1 or SEV2 incident, the Incident Commander convenes a blameless review covering the timeline, root cause, response timings, impact, what went well and badly, and corrective actions with owners and due dates; the Security Owner approves it and presents SEV1 reviews to Executive Management.”

P13 §5.8, Incident Response Policy

“The Security Owner updates the register within ten business days of any change: new risks from incidents, audits, vendor reviews or personnel reports; completed actions with evidence; re-scored risks; and expired acceptances.”

P17 §5.6, Risk Assessment and Management Policy

Have you performed a risk assessment, and how is it documented?

From the auditor question bank

Your policy says:

“Participants agree inherent likelihood and impact on the Section 2 scales, list existing controls and agree residual scores; the Security Owner challenges scores inconsistent with comparable risks or incident history and records the rationale.”

P17 §5.3, Risk Assessment and Management Policy

“The Security Owner updates the register within ten business days of any change: new risks from incidents, audits, vendor reviews or personnel reports; completed actions with evidence; re-scored risks; and expired acceptances.”

P17 §5.6, Risk Assessment and Management Policy

Walk me through how Northwind Cloud Inc handles selecting control activities, and show me TSC Crosswalk mapping each criterion to the policy section that addresses it.

Derived from the criterion text

Your policy says:

“Engineering, People Operations and the Security Owner collect the evidence in 4.9 on the cadence set in the relevant policy, record results against mapped risks and raise a ticket for any control not operating; the Security Owner reviews results monthly and re-scores affected risks.”

P17 §5.9, Risk Assessment and Management Policy

“Controls are selected and prioritized according to the risks they reduce, as recorded in the risk assessment maintained under the Risk Assessment and Management Policy, not solely because a framework lists them.”

P01 §4.4, Information Security Policy

Walk me through how Northwind Cloud Inc handles technology controls, and show me cloud IAM configuration export showing role-based groups rather than individual grants.

Derived from the criterion text

Your policy says:

“Production access to AWS and Vercel is granted only to engineers whose role requires it, through federated identity and short-lived credentials rather than long-lived access keys.”

P03 §4.6, Access Control Policy

“Access is reviewed at least quarterly for production, source code, identity administration and any system holding Restricted data, and at each annual review for all other systems.”

P03 §4.10, Access Control Policy

Show me branch protection settings export for production repositories, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“All production code and infrastructure-as-code lives in GitHub, and production reflects only what has been merged to the protected default or release branch.”

P09 §4.1, Change Management Policy

“Access to GitHub is granted through organization membership enforced by single sign-on with Okta, repository permissions are assigned by team, and protected branches require a review from someone other than the author before code is merged and deployed by GitHub Actions.”

P03 §4.8, Access Control Policy

How do you make sure employees have read and agreed to the policies?

From the auditor question bank

Your policy says:

“All personnel acknowledge the Information Security Policy, the Acceptable Use Policy and this policy within five business days of starting and within 30 days of each revision.”

P18 §5.3, Human Resources Security Policy

“Three business days before the start date, People Operations opens an onboarding ticket listing role, manager, start date, device requirement and access profile.”

P18 §5.2, Human Resources Security Policy

How often are policies reviewed, and can you show the last review?

From the auditor question bank

Your policy says:

“Each review is recorded in section 9 even where nothing changes; revisions are approved by Priya Natarajan, CEO before they take effect.”

P01 §8, Information Security Policy

“The Security Owner maintains a control matrix mapping each criterion in scope (Security and Availability) to the policy statements and evidence artifacts that satisfy it.”

P01 §5.5, Information Security Policy

How is access to production systems granted, and who approves it?

From the auditor question bank

Your policy says:

“Access requests are made in the ticketing system, name the system and role required, and are approved by the requester's manager and the system owner before provisioning.”

P03 §4.5, Access Control Policy

“Access is reviewed at least quarterly for production, source code, identity administration and any system holding Restricted data, and at each annual review for all other systems.”

P03 §4.10, Access Control Policy

Is multi-factor authentication enforced, and where?

From the auditor question bank

Your policy says:

“Multi-factor authentication is enforced for every workforce account, with phishing-resistant methods for administrative roles, under the Authentication and Password Policy.”

P03 §4.4, Access Control Policy

“Northwind protects customer accounts to at least the same standard: customer passwords are stored with a slow adaptive hash such as Argon2id or bcrypt and a per-user salt, are never logged or transmitted in plain text, are checked against breached-password lists, and customers are offered multi-factor authentication.”

P04 §4.11, Authentication and Password Policy

Is data encrypted at rest and in transit, and how are keys managed?

From the auditor question bank

Your policy says:

“All production data at rest on AWS and Vercel, including databases, object storage, volumes, snapshots, backups and log storage, is encrypted with AES-256 or a provider-equivalent algorithm, enabled before any data is written.”

P08 §4.2, Encryption and Key Management Policy

“Data classified Confidential or Restricted under the Data Classification and Handling Policy is encrypted at rest and in transit without exception, including when exported, emailed, shared with vendors or backed up.”

P08 §4.11, Encryption and Key Management Policy

Do you perform periodic access reviews?

From the auditor question bank

Your policy says:

“Security Owner (Dana Whitfield, CTO) owns this policy, maintains the role-to-access matrix, runs the periodic access reviews, approves privileged and production access, and holds the evidence of every grant, review and removal.”

P03 §3, Access Control Policy

“Owners respond within ten business days, removals are completed within five business days of the response, and the signed-off review is retained as evidence.”

P03 §5.3, Access Control Policy

What happens when an employee or contractor leaves?

From the auditor question bank

Your policy says:

“The device is collected and wiped through Kandji, and the timestamped checklist is stored with the personnel record.”

P18 §5.6, Human Resources Security Policy

“When People Operations confirms a departure, Engineering disables the Okta account, revokes sessions and tokens, removes membership of GitHub and AWS and Vercel, and rotates any shared or break-glass credentials the leaver could have known.”

P03 §5.4, Access Control Policy

How is access to production systems granted, and who approves it?

From the auditor question bank

Your policy says:

“Requests beyond the bundle are raised as tickets, approved by the manager and the system owner (the Engineering lead for production, the Security Owner for identity and security tooling), and closed with a note of the permission granted.”

P03 §5.1, Access Control Policy

“Access requests are made in the ticketing system, name the system and role required, and are approved by the requester's manager and the system owner before provisioning.”

P03 §4.5, Access Control Policy

Do you perform periodic access reviews?

From the auditor question bank

Your policy says:

“Security Owner (Dana Whitfield, CTO) owns this policy, maintains the role-to-access matrix, runs the periodic access reviews, approves privileged and production access, and holds the evidence of every grant, review and removal.”

P03 §3, Access Control Policy

“Owners respond within ten business days, removals are completed within five business days of the response, and the signed-off review is retained as evidence.”

P03 §5.3, Access Control Policy

How do you address physical security, for offices and for remote staff?

From the auditor question bank

Your policy says:

“All production systems for Northwind run in facilities operated by AWS and Vercel, and Northwind Cloud Inc relies on those providers' physical and environmental controls (access control, surveillance, power, cooling and fire suppression) as described in their independent assurance reports.”

P21 §4.1, Physical and Remote Work Security Policy

“Where Northwind Cloud Inc maintains an office, entry is restricted to authorized personnel through keys, badges or a managed access system, with access issued at onboarding and revoked on the last working day.”

P21 §4.2, Physical and Remote Work Security Policy

Walk me through how Northwind Cloud Inc handles physical access, and show me cloud provider SOC 2 Type II report (or bridge letter) covering data center physical security.

Derived from the criterion text

Your policy says:

“Security Owner (Dana Whitfield, CTO) approves office access arrangements, reviews provider data center assurance, handles reports of physical security incidents and approves exceptions.”

P21 §3, Physical and Remote Work Security Policy

“Company devices are never left unattended in public places, in vehicles or in unsecured shared spaces.”

P21 §4.5, Physical and Remote Work Security Policy

What happens when an employee or contractor leaves?

From the auditor question bank

Your policy says:

“People Operations includes device return in the offboarding checklist and provides a prepaid shipping label for remote staff.”

P05 §5.7, Asset Management Policy

“When an engagement ends, the Okta account is disabled and sessions revoked before the end of the last working day (immediately for involuntary departures or leave pending investigation), and all remaining access is removed within one business day, as set out in the Access Control Policy.”

P18 §4.6, Human Resources Security Policy

How long do you retain data, and how do you dispose of it?

From the auditor question bank

Your policy says:

“Engineering configures lifecycle rules, time-to-live settings or scheduled deletion jobs for each category and documents them alongside the schedule; changes follow the Change Management Policy.”

P07 §5.2, Data Retention and Disposal Policy

“When a service, environment or account on AWS and Vercel is retired, Engineering completes a checklist: delete volumes and buckets, expire snapshots and backups, revoke credentials and keys, remove DNS and monitoring, and update the asset inventory.”

P07 §5.6, Data Retention and Disposal Policy

How do you address physical security, for offices and for remote staff?

From the auditor question bank

Your policy says:

“All production systems for Northwind run in facilities operated by AWS and Vercel, and Northwind Cloud Inc relies on those providers' physical and environmental controls (access control, surveillance, power, cooling and fire suppression) as described in their independent assurance reports.”

P21 §4.1, Physical and Remote Work Security Policy

“At onboarding, and whenever a person's primary work location changes, People Operations issues the home-office checklist covering workspace privacy, Wi-Fi security, router configuration and equipment storage.”

P21 §5.5, Physical and Remote Work Security Policy

Is multi-factor authentication enforced, and where?

From the auditor question bank

Your policy says:

“Northwind protects customer accounts to at least the same standard: customer passwords are stored with a slow adaptive hash such as Argon2id or bcrypt and a per-user salt, are never logged or transmitted in plain text, are checked against breached-password lists, and customers are offered multi-factor authentication.”

P04 §4.11, Authentication and Password Policy

“Multi-factor authentication is mandatory for every workforce account at Northwind Cloud Inc, without exception for seniority.”

P04 §4.2, Authentication and Password Policy

How are laptops and other endpoints secured?

From the auditor question bank

Your policy says:

“The loss, theft or suspected compromise of any endpoint is reported to security@northwindcloud.example within one hour of discovery, as the Incident Response Policy requires.”

P19 §4.12, Endpoint and Workstation Security Policy

“Kandji enforces the configuration in Sections 4.4 to 4.8 and reports compliance to the Security Owner.”

P19 §4.3, Endpoint and Workstation Security Policy

How is your network and cloud infrastructure secured?

From the auditor question bank

Your policy says:

“Vercel: workloads sit in private subnets or equivalent private segments with no direct inbound route from the internet; databases and caches accept connections only from application segments; security groups and firewall rules default to deny and allow only documented ports and sources; and a web application firewall or equivalent edge protection fronts every public HTTP endpoint.”

P20 §4.2, Network and Infrastructure Security Policy

“Every compute image, container base image and managed service is configured against a documented hardening baseline informed by provider best practices and CIS benchmarks: unnecessary services disabled, default credentials removed, instance metadata access restricted and logging enabled.”

P20 §4.8, Network and Infrastructure Security Policy

How do you classify data, and how is customer data handled?

From the auditor question bank

Your policy says:

“Northwind Cloud Inc classifies information into four levels.”

P06 §4.1, Data Classification and Handling Policy

“Personal data is collected only for the purposes in the privacy notice of Northwind Cloud Inc, limited to what those purposes require, not repurposed without a lawful basis, and handled under the Privacy and Data Protection Policy.”

P06 §4.8, Data Classification and Handling Policy

Is data encrypted at rest and in transit, and how are keys managed?

From the auditor question bank

Your policy says:

“All production data at rest on AWS and Vercel, including databases, object storage, volumes, snapshots, backups and log storage, is encrypted with AES-256 or a provider-equivalent algorithm, enabled before any data is written.”

P08 §4.2, Encryption and Key Management Policy

“Restricted information is encrypted at rest and in transit under the Encryption and Key Management Policy.”

P06 §4.4, Data Classification and Handling Policy

How are laptops and other endpoints secured?

From the auditor question bank

Your policy says:

“All laptops and mobile devices used for company work have full-disk encryption enabled, enforced and reported through Kandji.”

P08 §4.9, Encryption and Key Management Policy

“The loss, theft or suspected compromise of any endpoint is reported to security@northwindcloud.example within one hour of discovery, as the Incident Response Policy requires.”

P19 §4.12, Endpoint and Workstation Security Policy

How do you find and fix vulnerabilities, and what are your remediation timelines?

From the auditor question bank

Your policy says:

“All findings from every source are tracked in a single vulnerability register with asset, severity, source, owner, detection date, due date, status and closure evidence.”

P11 §4.5, Vulnerability and Patch Management Policy

“Penetration test findings enter the register at the tester's severity, adjusted under 4.2 where warranted, are remediated within the 4.3 timelines, and Critical and High findings are retested by the tester before closure.”

P11 §4.12, Vulnerability and Patch Management Policy

How are laptops and other endpoints secured?

From the auditor question bank

Your policy says:

“The loss, theft or suspected compromise of any endpoint is reported to security@northwindcloud.example within one hour of discovery, as the Incident Response Policy requires.”

P19 §4.12, Endpoint and Workstation Security Policy

“Kandji enforces the configuration in Sections 4.4 to 4.8 and reports compliance to the Security Owner.”

P19 §4.3, Endpoint and Workstation Security Policy

How do you find and fix vulnerabilities, and what are your remediation timelines?

From the auditor question bank

Your policy says:

“All findings from every source are tracked in a single vulnerability register with asset, severity, source, owner, detection date, due date, status and closure evidence.”

P11 §4.5, Vulnerability and Patch Management Policy

“The Security Owner engages an independent penetration testing firm annually, tracks findings to closure in the vulnerability register and retains the report and remediation evidence.”

P20 §5.6, Network and Infrastructure Security Policy

How is your network and cloud infrastructure secured?

From the auditor question bank

Your policy says:

“Each quarter Engineering exports every rule permitting inbound traffic from the internet, plus all public IP addresses, buckets and endpoints, and reviews them with the Security Owner.”

P20 §5.2, Network and Infrastructure Security Policy

“Vercel: workloads sit in private subnets or equivalent private segments with no direct inbound route from the internet; databases and caches accept connections only from application segments; security groups and firewall rules default to deny and allow only documented ports and sources; and a web application firewall or equivalent edge protection fronts every public HTTP endpoint.”

P20 §4.2, Network and Infrastructure Security Policy

What logging and monitoring is in place, and who responds to alerts?

From the auditor question bank

Your policy says:

“Alerts are acknowledged and triaged within defined timelines: Critical within 1 hour at any time; High within 4 business hours; Medium within 2 business days; Low at the weekly review.”

P12 §4.8, Logging and Monitoring Policy

“Before a new service, cloud account, vendor or environment goes live, the change record includes a logging checklist confirming audit logging is enabled, forwarding is verified with a test event, sensitive fields are masked, retention is set and alert rules cover the new source.”

P12 §5.2, Logging and Monitoring Policy

Walk me through how Northwind Cloud Inc handles monitoring for anomalies, and show me logging tool alert rules export (for example Datadog monitors) covering authentication failures, privilege changes and production errors.

Derived from the criterion text

Your policy says:

“Alert rules exist for at least: repeated authentication failures or credential stuffing; multi-factor authentication disabled or reset; a new administrator or privilege escalation; changes to cloud identity policies or roles; use of a root, owner or break-glass account; a security group or firewall rule opened to the internet; a storage bucket made public; a secret detected in GitHub; logging disabled; unusual data export or deletion volume; changes to GitHub Actions configuration or deployment credentials; a device falling out of compliance in Kandji; and any endpoint security detection.”

P12 §4.7, Logging and Monitoring Policy

“At minimum the following are logged: for each platform in AWS and Vercel, the provider's management and API audit log, identity and access changes, network flow or firewall logs where available, and access logs for storage holding customer data; Okta sign-in events, multi-factor enrollment changes and administrator actions; the organization audit log of GitHub and repository security setting changes; GitHub Actions runs and configuration changes; Northwind authentication successes and failures, password and multi-factor changes, authorization failures, privileged actions, API key creation and revocation, data exports and deletions, and security setting changes; Kandji enrollment and compliance changes; endpoint security agent events; and vendor administrator audit logs where available.”

P12 §4.1, Logging and Monitoring Policy

Do you have an incident response plan, and has it been tested?

From the auditor question bank

Your policy says:

“Each quarter the Security Owner reports to Executive Management the number of incidents by severity, mean time to acknowledge, contain and resolve, notifications made, overdue corrective actions and trends.”

P13 §5.9, Incident Response Policy

“Within 24 hours of confirming that customer or personal data was affected, the Security Owner prepares a notification assessment listing who must be told and by when; Executive Management approves it and the messages, counsel reviews regulatory notices, and copies of every notice are attached to the incident record.”

P13 §5.7, Incident Response Policy

Walk me through how Northwind Cloud Inc handles evaluating security events, and show me incident severity classification table from the Incident Response Policy.

Derived from the criterion text

Your policy says:

“Within the acknowledgment target, the Security Owner or on-call responder confirms whether the event is an incident, assigns a severity (choosing the higher when facts are uncertain), opens a record with an identifier in the form INC-YYYY-NNN and, for SEV1 and SEV2, appoints the Incident Commander.”

P13 §5.2, Incident Response Policy

“The on-call responder acknowledges each within the target for the suspected severity.”

P13 §5.1, Incident Response Policy

How would customers be notified of a security incident affecting their data?

From the auditor question bank

Your policy says:

“Where personal data is involved, supervisory authorities are notified within 72 hours where the GDPR or UK GDPR applies, affected individuals and state attorneys general where US state breach-notification laws require it, and customers acting as data controllers in time to meet their own deadlines.”

P13 §4.9, Incident Response Policy

“Incidents at vendors, including Supabase, Stripe, Datadog and Slack, that affect Northwind Cloud Inc data or Northwind are handled under this policy, and vendor contracts must require notification to Northwind Cloud Inc within 72 hours under the Vendor and Third-Party Risk Management Policy.”

P13 §4.10, Incident Response Policy

Walk me through how Northwind Cloud Inc handles responding to incidents, and show me approved Incident Response Policy with contact details and severity levels.

Derived from the criterion text

Your policy says:

“Every report is triaged and assigned a Section 2 severity within the acknowledgment target for that level; severity may be raised by any responder and lowered only by the Incident Commander with a written rationale.”

P13 §4.2, Incident Response Policy

“Each quarter the Security Owner reports to Executive Management the number of incidents by severity, mean time to acknowledge, contain and resolve, notifications made, overdue corrective actions and trends.”

P13 §5.9, Incident Response Policy

Do you have an incident response plan, and has it been tested?

From the auditor question bank

Your policy says:

“Each quarter the Security Owner reports to Executive Management the number of incidents by severity, mean time to acknowledge, contain and resolve, notifications made, overdue corrective actions and trends.”

P13 §5.9, Incident Response Policy

“Within 24 hours of confirming that customer or personal data was affected, the Security Owner prepares a notification assessment listing who must be told and by when; Executive Management approves it and the messages, counsel reviews regulatory notices, and copies of every notice are attached to the incident record.”

P13 §5.7, Incident Response Policy

What are your backup and disaster recovery arrangements, and do you test them?

From the auditor question bank

Your policy says:

“As part of the disaster recovery test under the Business Continuity and Disaster Recovery Policy, Engineering restores the full Tier 1 data set from backups into a rebuilt environment, runs the application test suite against it, and records the achieved recovery time and data age.”

P15 §5.4, Backup and Recovery Policy

“Engineering restores a Tier 1 environment from infrastructure code and backups into an isolated account or region, measures elapsed time and the age of restored data, and records whether RTO and RPO were achieved, with the runbook used, timestamps, verification evidence and defects found.”

P14 §5.8, Business Continuity and Disaster Recovery Policy

How are changes to production reviewed, tested and approved?

From the auditor question bank

Your policy says:

“All code is peer reviewed through a pull request in GitHub under the Change Management Policy, and reviewers apply a security checklist covering authorization, input handling, secrets, logging of sensitive data, error handling and dependency changes.”

P10 §4.4, Secure Software Development Policy

“Branch protection on default and release branches requires at least one approving review from someone other than the author, requires all status checks from GitHub Actions to pass, dismisses stale approvals on new commits, blocks force pushes and branch deletion, and applies to administrators without bypass.”

P09 §4.2, Change Management Policy

Walk me through how Northwind Cloud Inc handles change management, and show me branch protection settings export requiring pull request review and passing checks before merge.

Derived from the criterion text

Your policy says:

“After approval and passing checks the change is merged to the protected branch; GitHub Actions deploys to staging, runs smoke tests and then deploys to production, automatically or on approval of a named engineer per repository configuration, tagging each deployment with the commit identifier.”

P09 §5.4, Change Management Policy

“The Security Owner samples at least ten percent of production changes and no fewer than five, verifies independent approval, passing checks and a deployment record for each, confirms branch protection settings in GitHub remain as required, investigates any bypass or emergency change, and summarizes the results to Executive Management.”

P09 §5.8, Change Management Policy

What are your backup and disaster recovery arrangements, and do you test them?

From the auditor question bank

Your policy says:

“Tier 1 recovery is tested at least annually by restoring a production-equivalent environment from infrastructure code and backups, and the whole plan is exercised at least annually through a tabletop with Executive Management; achieved recovery times are recorded against the objectives.”

P14 §4.10, Business Continuity and Disaster Recovery Policy

“Restores are tested at least quarterly for a sample of Tier 1 databases and storage, and at least annually for a full Tier 1 environment as part of the disaster recovery test.”

P15 §4.8, Backup and Recovery Policy

Walk me through how Northwind Cloud Inc handles mitigating business disruption risk, and show me business continuity and disaster recovery plan with recovery time and recovery point objectives per system.

Derived from the criterion text

Your policy says:

“Emergency access granted to recover a system is time-limited, logged and revoked when recovery is complete.”

P14 §4.7, Business Continuity and Disaster Recovery Policy

“After every declared disaster and every test, Engineering completes a review within ten business days recording the timeline, achieved RTO and RPO, deviations from the plan and corrective actions with owners and due dates; unresolved gaps affecting Tier 1 objectives are entered in the risk register.”

P14 §4.13, Business Continuity and Disaster Recovery Policy

How do you manage vendor and third-party risk?

From the auditor question bank

Your policy says:

“The requester states the business purpose, data to be shared, systems to be accessed, expected users and cost, and any existing alternative in the inventory; the Security Owner assigns a provisional tier within five business days and lists the due diligence required.”

P16 §5.1, Vendor and Third-Party Risk Management Policy

“Each quarter the Security Owner reconciles the inventory against vendor payments, the single sign-on application list and OAuth grants found by Engineering, adds vendors found outside the process and has the responsible person complete intake or stop use.”

P16 §5.9, Vendor and Third-Party Risk Management Policy

Walk me through how Northwind Cloud Inc handles vendor and business partner risk, and show me vendor inventory with data access level, criticality tier and review date for each vendor.

Derived from the criterion text

Your policy says:

“Northwind Cloud Inc maintains a vendor inventory recording, for every vendor, the business owner, service provided, data shared and its classification, systems accessed, tier, contract and renewal date, last review date and outcome, and assurance evidence held, and reviews it for completeness at least annually.”

P16 §4.1, Vendor and Third-Party Risk Management Policy

“Contracts with Tier 1 and Tier 2 vendors include confidentiality obligations, security controls appropriate to the data, notification of incidents affecting Northwind Cloud Inc data within 72 hours of the vendor becoming aware, restrictions on sub-processors, return or deletion of data on termination, and a right to assurance evidence.”

P16 §4.4, Vendor and Third-Party Risk Management Policy

Walk me through how Northwind Cloud Inc handles capacity management, and show me capacity or utilization dashboard screenshot from the monitoring tool (CPU, memory, storage, database connections).

Derived from the criterion text

Your policy says:

“Each month Engineering reviews availability against the service level objectives, documents any breach and its cause, updates the capacity forecast and reports the results to Executive Management.”

P12 §5.9, Logging and Monitoring Policy

“Vercel: workloads sit in private subnets or equivalent private segments with no direct inbound route from the internet; databases and caches accept connections only from application segments; security groups and firewall rules default to deny and allow only documented ports and sources; and a web application firewall or equivalent edge protection fronts every public HTTP endpoint.”

P20 §4.2, Network and Infrastructure Security Policy

Show me alert rules for capacity thresholds with the person or channel they notify, and tell me who keeps it current.

Derived from the criterion text

Your policy says:

“Alert rules are tuned to keep false positives manageable; changes to a rule's logic, threshold or severity are recorded with the reason, and rules that produced only false positives for a quarter are reviewed for relevance.”

P12 §4.11, Logging and Monitoring Policy

“When the criteria in 4.5 are met, the declaring person records the declaration, names the recovery lead, opens the alternative channel and notifies Executive Management.”

P14 §5.3, Business Continuity and Disaster Recovery Policy

What are your backup and disaster recovery arrangements, and do you test them?

From the auditor question bank

Your policy says:

“Tier 1 recovery is tested at least annually by restoring a production-equivalent environment from infrastructure code and backups, and the whole plan is exercised at least annually through a tabletop with Executive Management; achieved recovery times are recorded against the objectives.”

P14 §4.10, Business Continuity and Disaster Recovery Policy

“Restores are tested at least quarterly for a sample of Tier 1 databases and storage, and at least annually for a full Tier 1 environment as part of the disaster recovery test.”

P15 §4.8, Backup and Recovery Policy

How do you address physical security, for offices and for remote staff?

From the auditor question bank

Your policy says:

“All production systems for Northwind run in facilities operated by AWS and Vercel, and Northwind Cloud Inc relies on those providers' physical and environmental controls (access control, surveillance, power, cooling and fire suppression) as described in their independent assurance reports.”

P21 §4.1, Physical and Remote Work Security Policy

“Where Northwind Cloud Inc maintains an office, entry is restricted to authorized personnel through keys, badges or a managed access system, with access issued at onboarding and revoked on the last working day.”

P21 §4.2, Physical and Remote Work Security Policy

What are your backup and disaster recovery arrangements, and do you test them?

From the auditor question bank

Your policy says:

“As part of the disaster recovery test under the Business Continuity and Disaster Recovery Policy, Engineering restores the full Tier 1 data set from backups into a rebuilt environment, runs the application test suite against it, and records the achieved recovery time and data age.”

P15 §5.4, Backup and Recovery Policy

“Engineering restores a Tier 1 environment from infrastructure code and backups into an isolated account or region, measures elapsed time and the age of restored data, and records whether RTO and RPO were achieved, with the runbook used, timestamps, verification evidence and defects found.”

P14 §5.8, Business Continuity and Disaster Recovery Policy

Walk me through how Northwind Cloud Inc handles recovery testing, and show me backup restore test record with date, dataset restored, time taken and who performed it.

Derived from the criterion text

Your policy says:

“Each quarter Engineering restores a backup of at least one Tier 1 database and one storage bucket, no more than one day old, into an isolated environment, verifies row counts, checksums or sample records against production, measures elapsed time against the RTO, deletes the copy and files the test record for the Security Owner's review.”

P15 §5.3, Backup and Recovery Policy

“Each test records what was restored, the backup age, the elapsed time, the verification performed and any defects, and is retained as evidence.”

P15 §4.8, Backup and Recovery Policy