A shorter alternative to the 200-line security questionnaire: six questions, and what a decent answer sounds like.
Big security questionnaires have their place. But for a small company buying a payroll system or a CRM, a 200-line spreadsheet usually gets filled in by a sales engineer and never read again. We'd rather ask fewer questions and listen properly to the answers.
Where is our data stored, and who on your side can see it? A good answer names a cloud provider and region, and explains how staff access is controlled and logged. "It's very secure" is not an answer.
When did someone independent last test the product? You're looking for a recent penetration test by an outside party, and a willingness to share at least a summary under NDA.
How will you tell us about a breach, and how fast? This should be in the contract. Under Sri Lanka's Personal Data Protection Act you are probably the controller and the vendor is processing data for you, so you need them to tell you quickly.
Can we get our data out if we leave? In a usable format, without a large exit fee.
Who else touches our data? Their hosting, email and support tools. There should be a list of subprocessors, and it should be current.
What does support look like in our time zone? Easy to forget. A support desk that opens in the evening Sri Lanka time isn't much help during a morning outage.
Write down the answers and who gave them. If something goes wrong later, you'll be glad you did.
Comments (0)
No public comments yet.