Audit and assurance · 8 answer guides
How to answer audit and assurance questions in a security questionnaire
Certifications, independent assessments, internal audits, policies, metrics, and audit logs. This is where a SOC 2 or ISO 27001 report does most of the talking.
Compliance certifications
What compliance certifications do you maintain (e.g., SOC 2, ISO 27001)?Independent security assessments
Do you conduct independent third-party security assessments annually?Internal audits
How often do you conduct internal audits?Audit findings remediation
How do you track and remediate audit findings?Compliance monitoring
Describe your compliance monitoring program.Information security policies
What formal information security policies do you maintain, and how are they documented, approved, and reviewed?Security metrics
What technical and operational security metrics do you define, collect, and report against your business objectives?Customer audit logs
Do administrators have access to detailed audit logs with export capabilities?