Scheduling your supplier security review

Hello Nadia, Thanks for taking the time to speak with me. As promised, here is a note to get the security review into the diary. To be precise about what I would like to cover with you: how the brain runs inside Fenmoor's own Snowflake account, who holds access and how it is controlled, and how your connected systems are read. I will bring an architecture diagram so we are both looking at the same picture. If you could send me your questionnaire ahead of the session, I can answer what I am able to in writing beforehand and keep the time itself for the harder points. Anything I am not certain of, I will check with a colleague on our security side before I put it in front of you. Would a slot early next week suit you, or is later in the week better? Tell me what works and I will send an invitation. Thanks, Hannah

Hello Hannah, Thank you for your note, and apologies for the slow reply. Thursday morning works for me. For the audit trail, I would like to list what I need ahead of it: First, the architecture diagram, in advance rather than on the day, so that I can circulate it internally. Second, a written statement of where data is held and processed. Can you evidence that it stays within our Snowflake account? Third, a description of how access is granted and removed, and what is recorded when it is. I will need the answers in the questionnaire. A verbal answer will not do for our capacity providers. I should also say that I cannot give a sign-off date until they have seen the pack, so please do not read the session as the end of the process. Kind regards, Nadia

Hello Nadia, Thursday morning is fine, and I will send the invitation today. On your three points: First, the diagram will reach you before the session, so you have time to circulate it. Second, the short answer is that the brain is built and run inside your Snowflake account. The longer answer is in the written statement I am preparing, which sets out what is read from each connected system and where it sits. I will put that in writing and attach it to the questionnaire. Third, I will describe access granting and removal, and what is logged, as it actually operates. I will not describe it more generously than that. If any detail needs confirming with my colleague first, I will say so in the document rather than leave it implied. Understood on the sign-off. I will treat Thursday as a working session and leave the timing to you and your capacity providers. Thanks, Hannah