Independent security assessments: how to answer it in a security questionnaire

What is an independent security assessment?

An independent security assessment is an evaluation of an organization's controls by a qualified outside party. Examples include SOC 2 audits by a CPA firm, ISO 27001 certification audits, and third-party penetration tests. Independence means the assessor has no stake in the result.

What the buyer is really asking

Buyers want an outside party checking your controls every year. That can be a SOC 2 audit, an ISO certification audit, or an independent penetration test. Name the assessor and the date of the last assessment.

Other ways buyers ask it

Every one of these wants the same answer:

• →“Do you conduct independent third-party security assessments annually?”
• →“Who performs your external security audits?”
• →“When was your last independent assessment?”

Evidence to have ready

• The most recent audit or assessment report
• An engagement letter for the next one

Related audit and assurance questions

• How often do you conduct internal audits?
• How do you track and remediate audit findings?
• Describe your compliance monitoring program.
• What formal information security policies do you maintain, and how are they documented, approved, and reviewed?

All audit and assurance questions →