# Customer Security Questionnaire Response Package — SaaS Analytics ## 1. Scope and Assumptions Five customer questions for one SaaS analytics product. E1–E3 are supplied as approved summaries, not independently inspected originals. No product-wide security attestation, customer MFA evidence, incident-history confirmation, penetration-test release approval or exact customer contract terms were supplied. Draft status: NOT APPROVED FOR CUSTOMER SUBMISSION. ## 2. Evidence and Disclosure Register | Ref | Evidence | Scope | Approved/freshness | Sharing restriction | |---|---|---|---|---| | E1 | Access Control Standard v3, 1 Jul 2026 | Employee SSO | Approved summary; applicability to administrator types needs checking | Share only approved policy summary | | E2 | Backup Restore Exercise, 15 Aug 2026 | Production analytics database | Successful exercise stated in supplied record | Release vetted exercise summary, not internal runbook | | E3 | Privacy Statement v2, 1 Sep 2026 | Contracted EU hosting; subprocessor portal | Approved statement | Cite public statement if customer-authorised | | E4 | Incident history confirmation | Not provided | Missing | Owner approval required | | E5 | Penetration-test summary | Not provided | Missing | Restricted; obtain vetted customer version | ## 3. Question-by-Question Response Matrix | ID | Exact customer question | Proposed answer | Status | Evidence | Confidence | Action | |---|---|---|---|---|---|---| | Q1 | Is MFA required for administrators and customers? | Our approved Access Control Standard requires MFA for employee single sign-on. Coverage of all administrator identities and customer accounts has not yet been confirmed. | Partial | E1 | Medium | Verify admin and customer enforcement with IAM owner; HOLD complete yes/no | | Q2 | Have you tested restoration of production data? | An exercise dated 15 August 2026 documented a successful restoration of the production analytics database. | Supported within scope | E2 | High for supplied claim | Confirm approval of external wording | | Q3 | Is all customer data stored only in the EU? | EU hosting is available on contracted plans; we cannot confirm that every customer's data is EU-only without the applicable service agreement and data-flow scope. | Partial | E3 | Medium | Confirm customer's plan, backups and subprocessor transfers | | Q4 | Have you had any security incidents in the past 24 months? | HOLD — an authorised incident-history response has not been provided. | Unverified | E4 missing | Not assessed | Security incident/legal owner to approve factual disclosure | | Q5 | Can you share your latest penetration test report? | HOLD — no externally approved report or summary is available in the materials provided. | Unverified | E5 missing | Not assessed | Security assurance lead to offer vetted summary or approved secure access | ## 4. Claims and Contradictions Do not say 'MFA applies to all users': E1 only covers employee SSO. Do not say 'all data stays in the EU': E3 describes an optional contracted service, not the customer's actual configuration. Do not say 'no incidents' or 'annual penetration tests': neither is established. ## 5. Owner Follow-Up Register | Priority | Question | Owner to confirm | Evidence or decision | Due | |---|---|---|---|---| | Critical | Q4 | Incident response lead and legal counsel | Approved 24-month incident-history position and permitted customer wording | Agree before submission | | High | Q1 | Identity and access manager | Administrator vs employee vs customer MFA evidence | Agree before submission | | High | Q3 | Privacy lead and hosting owner | Customer plan, region, subprocessors and cross-border processing | Agree before submission | | High | Q5 | Security assurance lead | Externally releasable penetration-test executive summary or secure portal option | Agree before submission | | Medium | Q2 | Backup/control owner | Confirm the test date, restore coverage and approved customer excerpt | Agree before submission | ## 6. Disclosure Strategy Use approved E1/E2/E3 excerpts only. Do not attach raw IAM settings, database restore logs, vulnerability details or internal penetration-test reports. Route any restricted attachment through an authorised trust portal or agreed secure process. Confirm the customer's permitted security disclosure channel. ## 7. Submission Gate Security must review Q1, Q2 and Q5; privacy/legal must review Q3 and Q4; the account owner confirms the customer's product and contract scope. A reviewer must formally authorise release. No approval has been evidenced. ## 8. Customer-Ready Wording Q2 may be considered for release once the control owner approves: 'A documented exercise on 15 August 2026 successfully restored the production analytics database.' Q1 and Q3 remain provisional. Q4 and Q5: HOLD — DO NOT SUBMIT. ## 9. Maintenance Store the final approved answer, version, evidence and approval date in a controlled answer library. Reassess when identity settings, hosting terms, test evidence or incident disclosure guidance change. ## 10. Disclaimer Draft coordination support only. This pack does not establish technical control effectiveness, legal compliance or customer acceptance; subject to security, privacy, legal and commercial owner approval.