Security Questionnaire Inquiries from Customers

At Mycroft, we proudly offer Managed Services and Success Packages featuring industry expertise through our virtual CISOs. For our Enterprise customers we act as their Risk Operations Center to continuously support their needs around privacy, security and risk.

For these customers we currently have a Security Questionnaire module in beta that allows our AI agents to answer complex questionnaires up to 1000 questions, and counting.

Interested in adding a Mycroft Virtual CISO to your subscription with a Success Package? Reach out to us today!

Below are inquiries about Security Questionnaires that our Virtual CISOs have addressed, with answers modified to benefit a wider audience.

Enterprise Questionnaires

Answering Security and Compliance Questionnaires for Enterprise Customers

When responding to enterprise customer security and compliance questionnaires, particularly for financial institutions, you'll need to provide detailed information about your security posture, compliance programs, and technical capabilities. Here's how to address common questionnaire categories:

Compliance Management

Compliance Management Program: We utilize Mycroft, a comprehensive Compliance Management Program that ensures ongoing compliance with SOC 2 regulations and offers support for additional compliance frameworks including GDPR, ISO27001, and PCI.

Privacy Law Compliance: We use Mycroft to manage compliance with privacy laws such as GDPR and PIPEDA.

ESG Policy: We do/do not currently have a policy that incorporates ESG (Environmental, Social, and Governance) factors into business considerations.

Security and Data Protection

Incident Response: We have implemented an Incident Response Plan aligned with NIST Computer Security Incident Response guidance for promptly notifying clients of security incidents or breaches.

Multi-tenant Data Segregation: We ensure data segregation and security through multiple controls including:

• Application Authentication

• User Segregation

• Role-based Access Control

• Password Manager

• Onboarding/Offboarding Checklists

• Access Review and MFA

• Row-level security (RLS) with non-PII controls at application tier and PII controls at data tier

Data Encryption: Sensitive and confidential business data is encrypted both in transit and at rest using TLS and AES-256 encryption standards.

Technical Capabilities

Mobile Support: Our solution is a web application only and does not support mobile applications.

Encryption Key Management: We do not manage our own encryption keys. Keys are managed by our SaaS and PaaS providers, specifically utilizing managed services by AWS.

Active Directory Integration: Yes, our application can leverage active directory groups and API integration to automate access provisioning for granular roles and privileges beyond SSO, implemented through Auth0.

Cryptographic Capabilities: Our solution does not handle or provide cryptographic capabilities directly.

Infrastructure and Operations

Hosting: Our application is hosted on Amazon Web Services (AWS).

Resiliency Strategy: We maintain a resiliency strategy that includes controls around platform availability monitoring, alerts, architecture design, and recovery plan testing.

Third Party Risk Management (TPRM): Yes, we have a TPRM program in place through Mycroft and maintain a Vendor Risk Management Policy that can be shared as needed.

PCI Compliance: We are (not) currently PCI compliant, as/though this capability is achievable through our Mycroft platform.

Other Questions We've Been Asked

Does my organization need to be PCI DSS compliant?

Only if your organization accepts or processes credit or debit card payments, or if you are a service provider that stores, processes or transmits cardholder data on behalf of another entity.

I'm not SOC 2 certified yet - what can I share with prospects in the meantime to not lose a sale?

We recommend using Mycroft's Trust Center to demonstrate your security posture with any documentation that you already have, including:

• Letter of Engagement from your auditor that your compliance is pending

• Final Report of pen-testing

• Relevant policies and controls

• Architecture diagram

• Frequently Asked Questions - Our Trust Center has a feature to add FAQ to your Trust Center, proactively address security questions and maintaining a bank of answers to save time on future questionnaires
  

A prospect is asking me how they would be protected against IP Leakage/Proprietary Logic (our codebase). How can I respond to ease their concerns?

Here is the response our Virtual CISO crafted that was applicable to the customer:
Our terms of service and service agreement explicitly restricts usage of IP. We operate on a need to know, principles of least privilege and our access is highly limited that any data that comes to our side would not be rendered useful. Even if so, our security / privacy programs are aligned against enterprise grade SOC 2 standards along with other privacy principles that we respect and adhere to for all our customers.

A prospect is asking me how they would be protected against sensitive data in code since history can contain items like API keys, passwords, tokens, etc.. What is a good response to this?

Here is the response our Virtual CISO crafted that was applicable to the customer:

Our application is strictly tested through a certified penetration tester on an annual basis to ensure that this type of leakage cannot happen. Note that we do not recommend EVER putting sensitive data on code such as hard coded secrets.