Security review: scheduling the next session

Dear Declan, Thank you for your time on the call today. I would like to fix the next security review session so we do not let the open items drift. As I have it, the open findings and their owners are as follows: First, the incident history and notification times, which are with me and, for the platform detail, with Ewan on our platform team. I will not answer for the platform side without him. Second, the exit plan, which is with me. I want to give you something you can test rather than a description. Third, the evidence pack behind the questionnaire answers, so that each answer carries a control reference you can trace. We can evidence that for each control we have claimed, and I will mark clearly anything that is still a draft. Could you tell me which two or three days later this week or early next week suit you and your team for a working session of around an hour? If anyone from your ICT third-party risk side should join, please let me know and I will send them the pack in advance. Thanks, Theo

Theo, Thank you. Your summary of the open findings matches mine, with one addition. Under DORA we need the incident notification commitments in writing, with the dated commitment attached, for the register of information. A verbal assurance from the call will not be sufficient for the file. Please include that in the pack, and please say plainly who at BB-Demo will notify us and within what time. On timing, Thursday afternoon is workable, or Friday morning if that is easier for you. One colleague from my ICT risk team will join. Please send the pack the day before so that we can read it properly and not on the call. Regards, Declan Furlong, CISO