Fenmoor Specialty Underwriting / B-Brain – Security Review
Callcompleted
Fenmoor Specialty Underwriting: documents · 2025-11-28 11:30
Nadia Osei walked through eleven open items with Hannah Lowe: most received, two partial, none refused. Her capacity providers must review the pack first, so she will set no sign-off date. The review concerns the expansion only.
What was said
What this says
Current to 10 Oct 26Nadia Osei walked through eleven open items with Hannah Lowe: most received, two partial, none refused. Her capacity providers must review the pack first, so she will set no sign-off date. The review concerns the expansion only.
What happened: Nadia worked through a numbered register of eleven items. Most are received, the access review is partial, and the incident procedure can be shared under a confidentiality agreement.
Customer view: Nadia called it the most orderly supplier review she had run this year. She will not close anything on a verbal answer and asked that nobody implies a sign-off date.
Commercial: Hannah said the commercial side hoped to land the Enterprise paperwork by 31 Dec 2025, but the review has its own sequence. SSO and SCIM evidence is a recorded future item if Fenmoor moves from Growth to Enterprise.
Watch: Nadia expects her providers to press on the model provider retention point. A Fenmoor-specific written statement may be requested, and legal should be ready.
Themes
Current to 9 Oct 26Theme
Enterprise security review
Importance
upsell
Sentiment
positive
Voice
decision-maker
Who was there
B-Brain
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe sends the written access review confirmation within the next few days.
- Hannah Lowe drafts a one-page architecture summary for the capacity providers.
- Hannah Lowe tells Priya and Daniel that no sign-off date should be implied.
Risks
Current to 9 Oct 26- The capacity providers review on their own timetable, so the hoped-for 31 Dec 2025 Enterprise paperwork date may slip.
- The model provider retention point may draw a request for a Fenmoor-specific written statement needing legal review.
- The access review confirmation from a second reviewer is still outstanding.
Opportunities
Current to 9 Oct 26- A successful review supports moving Fenmoor from Growth to Enterprise.
- SSO and SCIM evidence is a recorded follow-on if the Enterprise move proceeds.
Transcript
Nadia Osei NoneHello, Hannah. Can you see my screen? I've put the open items register up so we're looking at the same thing.
Hannah Lowe NoneI can, yes. Morning, Nadia. Lovely, that's much easier than me trying to recall which number is which. How was your week after last Friday?- Nadia Osei NoneLong, but fine. The audit call went as expected. Shall I begin with the list, since that's what we're here for?
- Hannah Lowe NonePlease do. Though before you do, can I ask what you most need out of today? I have the written note ready and I'd like to focus on whatever is actually blocking you.
- Nadia Osei NoneGood question. What I most need is to know exactly what is closed, what is open and who owns each open item, so that I can put a pack in front of our capacity providers. I'll open with the register. There were eleven items after last week's session.
- Hannah Lowe NoneEleven, yes. I've closed eight of them in the note I sent on Monday, to be precise, and the other three are the ones where I wanted to give you something exact rather than something quick.
- Nadia Osei NoneLet's take the closed ones briefly, then. One, the incident roles. I have your role definitions. They're clear. I'm marking that as received.
- Hannah Lowe NoneGood. Received, not signed off, if I'm reading your column correctly.
- Nadia Osei NoneCorrect. Received means I have the evidence and I'm content with it. Closed for my purposes means my providers have seen it too. I don't close anything on a verbal answer, and I don't close it before they've looked.
- Hannah Lowe NoneThat's absolutely fine, and it's how I'd want it. Carry on.
- Nadia Osei NoneTwo, notification wording. Your note quotes the procedure and the order form language side by side. That's helpful. I'd have liked a stronger commitment, but I can see what it says and I can evidence it. I'll flag the wording to my providers as it stands.
- Hannah Lowe NoneUnderstood. I didn't want to dress it up. If your providers want something firmer, that becomes a commercial conversation with Priya and it would be written into the Enterprise order form. It wouldn't be something I'd agree on a call.
- Nadia Osei NoneNoted. Three, the last exercise date. You've given me the date from the record. Thank you. Four, report delivery. You confirmed it is in the procedure, with the reference.
- Hannah Lowe NoneYes. I checked that one twice, since I'd said on the last call I believed it was there, and I wanted to be sure rather than lucky.
- Nadia Osei NoneAppreciated. Five, the register extract. I have it. I looked at the fields and I'm satisfied with the structure. Six, subprocessor change notice. Seven, the retention position with the model provider.
- Hannah Lowe NoneSeven is the one I'd like to say a word about, if that's all right, because the answer is a bit more nuanced than a tick.
- Nadia Osei NonePlease.
- Hannah Lowe NoneThe short answer is that the retention position is a contract term, not only a setting. The longer answer is that there is also a configuration that enforces it, and the two are consistent today. If the configuration were ever changed, the contract would still stand, but I'd expect us to treat that as an incident. I've put the contract extract in the note, and I've been clear about which is which.
- Nadia Osei NoneThat is much better than I expected. Can you evidence that the contract term applies to Fenmoor's usage specifically, and not only to a generic arrangement?
- Hannah Lowe NoneIt's an arrangement that applies to the service as a whole, so it covers Fenmoor's usage by being part of how the service operates. I don't have a Fenmoor-specific clause and I won't pretend there's one. If your providers want a Fenmoor-specific statement, we could give a written statement from our side confirming applicability. I'd want legal to look at the wording.
- Nadia Osei NoneI'll add that as an option, not a requirement, and let my providers say whether it's needed. I don't want to create work that nobody asked for.
- Hannah Lowe NoneSensible.
- Nadia Osei NoneEight, the access review extract with the matching sample. Nine, whether the incident procedure can be shared with our providers. Those two are the ones I believe are still open.
- Hannah Lowe NoneRight. Eight, I did send the extract and the sample, and you've got them. What I wasn't able to give you was the second person's review of the extract. It has been reviewed, but the written confirmation of that wasn't back in time for Monday. So I'd classify eight as sent but with one piece outstanding.
- Nadia Osei NoneUnderstood. I'll mark it as partial. Could you say when the confirmation will arrive? I'm not asking for a promise, only your best estimate.
- Hannah Lowe NoneI'd say within the next few days. I'd rather say that and be early than name a day and miss it. I'll write to you the moment it's in.
- Nadia Osei NoneThat's fine. And nine?
- Hannah Lowe NoneNine, I asked, as I said I would. The answer from our legal side is that the procedure can be shared with a customer's capacity providers under a confidentiality agreement. So it's a yes, but with a condition, and the condition is the agreement. I can't tell you more about the form of it. They'd need to be in touch with us, or you'd route it through Priya.
- Nadia Osei NoneThat works. I'll tell my providers that it's available subject to confidentiality and let them decide whether they want it. Ten, the subprocessor incident chain. And eleven, the data flow diagram labels.
- Hannah Lowe NoneTen, I've set out what the terms with each one say, and I've stated the limit that we can only pass on what we're told, as we agreed. Eleven, the revised diagram is attached. I changed the service side labels and added a short key. Please look at it with fresh eyes, because I've been staring at it for days.
- Nadia Osei NoneI will. I looked at it this morning, as it happens, and I think it reads better. The key helps. Let me say that I'm quite pleased with the position overall. Most of this is received, two items are partial, and none is a refusal.
- Hannah Lowe NoneThat's a fair summary and I'm glad it reads that way. So where does that leave us? I think the question you and I haven't said out loud is what happens next with your providers.
- Nadia Osei NoneYes. Let me be careful here. The sign-off isn't mine alone. Fenmoor's supplier security reviews are audited by our capacity providers, and the pack has to go to them. They'll review it on their own timetable. Until they have seen it, I'm not going to set a sign-off date, and I'd ask that nobody on your side or ours implies one.
- Hannah Lowe NoneUnderstood, and I'll make sure Priya and Daniel know that. I think there's been a hope on the commercial side to land the Enterprise paperwork by 31 Dec 2025, but that's a hope on our side. It isn't something your review has to bend to.
- Nadia Osei NoneI appreciate you saying that. I'm aware of the timetable. I'd simply rather it was clear that the review has its own sequence. If my providers have questions, those questions come first.
- Hannah Lowe NoneOf course. Is there anything we can do to make their review easier? A cover note, a single summary page, a contact on our side they can call directly?
- Nadia Osei NoneA one-page summary of the architecture would help, I think, written for someone who hasn't heard any of these calls. And a named contact on your side for technical questions, which I assume would be you.
- Hannah Lowe NoneIt would be me for technical questions, yes. If it's something outside my area I'll route it to our security lead rather than guess. The one-page summary I can do. I'll draft it and you tell me whether it's pitched right for them.
- Nadia Osei NoneGood. I'll also put the summary alongside the evidence list in the pack, with a cross-reference, so each claim points to a document. For the audit trail, I want every statement traceable.
- Hannah Lowe NoneThat's how I'd structure it too. One question from me, if I may. Is there anything in the pack that you personally still feel uncomfortable about? I'd rather hear it now than learn it from your providers.
- Nadia Osei NoneThat's a fair question. Honestly, the one I'd watch is the model provider retention point. I'm content with what you've written, but it is the one I expect them to press on. If they want the Fenmoor-specific statement, we'll come back to you quickly.
- Hannah Lowe NoneThen I'll have legal ready to look at it as soon as you ask, so it doesn't sit in a queue. That's a reasonable thing to prepare for.
- Nadia Osei NoneThank you. I also want to mention, because it's on my list, that for the Enterprise tier the SSO and SCIM configuration would need to be evidenced as well. That's a later stage, but I'd like it recorded as a future item so it doesn't surprise anyone.
- Hannah Lowe NoneRecorded. That would come into scope if Fenmoor moves from Growth to Enterprise. I'll note it as a follow-on, with a configuration walkthrough, and I'd put it in writing when we get there.
- Nadia Osei NonePerfect. Then I think we're done with the list. To confirm what happens now. You send the written confirmation for the access review, the one-page summary, and anything else that changes. I assemble the pack, send it to our capacity providers, and tell you when they've responded.
- Hannah Lowe NoneYes. And I'll let Priya and Daniel know the position so the commercial side isn't guessing. I'll also make clear that the contract you have today runs to 30 Jun 2026 and that nothing in the review changes it. The review is about the expansion only.
- Nadia Osei NoneYes, that's my understanding as well. Thank you, Hannah. I'll say, for the record, that this has been the most orderly supplier review I've run this year, and I don't say that lightly.
- Hannah Lowe NoneThat's very kind. The credit goes to you for the numbered questions, honestly. They made it easy to be exact. Right, I'll get the confirmation and the summary to you as soon as they're ready.
- Nadia Osei NoneThank you. Kind regards, Hannah. Have a good weekend.
- Hannah Lowe NoneAnd you, Nadia. Thanks, Hannah. Bye for now.
Callsmade from