Security Questions

Security Questions that are often asked during the purchase process.

No PDF data is stored in our environment. See Basic Questions - Security

Question

Answer

(Yes/No)

Comments & details
1- Do you have an information security policy? Yes  
2- Do you have a process to conduct regular and comprehensive cyber risk assessments? Yes We perform yearly penetration tests on our environments.
3- Do you have security certification such SOC 2 Type II, ISO 27001? If yes, Can you provide the reports? No We do not have certifications yet, but we are working towards the NIST framework and are aiming for SOC II compliance next year
4- Do you process personal information?
If so, are you in compliance with privacy laws such as the Personal Information Protection and Electronic Documents Act of Canada (PIPEDA) or the laws* on the protection of personal information in Quebec ( including its amendments under Bill 64/Bill 25) or any other law applicable to your jurisdiction?
If not, what is your plan to comply with your legal framework?		 No We don’t process any personal information
5- How do you protect data in motion and at rest? Yes All our project data lives in M365, and it is protected at rest with Microsoft encryption. We use DLP policies, conditional access policies, and Micrpsoft defender for protecting data in motion
6- Is there any segregation of customer data? Yes Customer data is protected by permissions and Azure information protection sensitivity labels, which are only accessed on corporate devices by users having accurate permissions
7- Where are located your data centers that could host our data?   All our data is in M365 and hence on Microsoft-hosted data centers
8- Do you apply access control policy to access customer data? Yes Customer data is protected by permissions and Azure information protection sensitivity labels which are only accessed on corporate devices by users having accurate permissions
9- Do you use secure application development (SDLC) practices? Yes All our code is checked in to TFS online and safe coding guidelines are followed
10- Do you have the security tools in place to protect yourself from cyber attacks? If yes, please specify. Yes SoHo uses Microsoft defender, which enables us to use safe links, safe attachments, anti-spam and anti-malware policies to protect our tenants from cyber attacks
11- Is there a vulnerability management program in place? No  
12- Do you regularly perform penetration tests of your infrastructure? Do you have a frequency? Yes Penetration tests are performed annually
13- Do you perform logging and monitoring of your infrastructure activities? Yes All our infrastructure is in the cloud and doesn’t need server logging. Activity and sign-in logs are currently maintained through MS cloud app security, and we are in the process of implementing SIEM logs using MS Sentinel
14- Do you have an incident management process? Yes Please find our incident management policy attached
15- For outsourcing of critical IT service, do you consider cyber security risk as part of your due diligence process? Yes Since our internal IT services are in the cloud, it is a global availability. We do our due diligence with the usage of MS endpoint management software- InTune, and make sure our data is accessible and downloadable only on corporate devices
16- Do you have a business continuity plan (BCP) or a disaster recovery plan (PRA)? If so, are tests carried out and which date? Yes We use Datto SaaS protection for backing up our M365 environment and restores are tested every 6 months. BCP included in the InfoSec policy
17- Do your employees and consultants undergo criminal background checks? Do they sign confidentiality and non-disclosure agreements? Yes These are a part of our onboarding procedures
18- Do you have an information security awareness program and contextualized training for database administrators and developers? Yes We provide annual cybersecurity training to our end users
19- Do you have a cyber insurance contract in force? Yes We have Cybersecurity Insurance
   CLOSE

PDF Markup Tool Buy Professional PDF Editor Now