02 — Capability · BC-1270.20
Customer Security Review
Answer customers' and prospects' security and privacy questions quickly and consistently, from a maintained body of evidence, so assurance does not stall the sale or the renewal.
- Security Questionnaires
- Trust Center
- Vendor Risk Response
In scope
- Public trust center and shared documentation
- Questionnaire response from an approved answer library
- Customer audits and penetration test summaries
Out of scope
- Contract redlines on security terms (see BC-150)
- Assessing the company's own suppliers (see BC-640)
Decomposes into · 3
- BC-1270.20.10Trust Center PublishingPublish policies, certifications, subprocessors and architecture summaries where buyers can self-serve them.
- BC-1270.20.20Questionnaire ResponseAnswer security assessments from a governed library of approved answers, with a reviewer for anything new.
- BC-1270.20.30Customer Audit SupportHost customer audits and share test results under agreement without exposing more than necessary.