Security review session for your team

Ravi, I'm Theo, a solutions engineer at BG-Demo, and I'm running the security review for Etowah Lane. I'd like to book a working session with you to go through the review. To make it useful, I'll send ahead a list of the open findings with an owner against each one, and the control reference for every answer we've given so far. Where we can evidence a control, the evidence will be attached. Where we can't yet, I'll say so and give you a dated commitment. Could you tell me which days suit you next week, and who from your team should join? If you already have your own list of questions, send it over and I'll map my answers to it. Thanks, Theo

Theo, Thank you. I can do Tuesday or Thursday next week, in the afternoon. Before we meet, I need the following in writing: First, who has standing access to the Snowflake account where the brain runs, and how is that access reviewed? Please evidence that. Second, where does Etowah Lane data live, and which of your staff can see it, in any circumstances? Third, what is your incident history? Please be complete, not selective. I will not close any finding without evidence. A reference customer is not a substitute for a control. Ravi Subramanian

Ravi, Understood. I'll answer in the same order as your questions, so your three points can be checked against my replies one for one. First, standing access: I'll send the access model and the review process, with the evidence attached. Second, data location and visibility: I'll set out what runs inside your Snowflake account and what BG-Demo staff can and cannot reach, with the control reference for each statement. Third, incident history: I'll give you the full record. Anything I can't evidence yet, I'll flag and give a dated commitment. I'll also check anything I'm not certain of with our platform lead before it goes to you, so nothing is overstated. Let's take Tuesday at 14:00. I'll send the written answers ahead of that so you have time to read them. Thanks, Theo