Customer type
What a bank's security questionnaire reaches for
Banks send the SIG or their own spreadsheet built on it, map it to the NIST Cybersecurity Framework, ask for a SOC 2 report by name, and ask card questions wherever a payment touches the service.
Frameworks ticked by default for this customer: ISO/IEC 27001:2022, SOC 2 (Trust Services Criteria), SIG (Shared Assessments), NIST Cybersecurity Framework 2.0, PCI DSS v4.0.1 and GDPR, Regulation (EU) 2016/679. Read a questionnaire as this customer.
Families, with the clauses from this customer's other frameworks
| Family | Anchor clauses in this customer's frameworks |
|---|---|
| Information security policy | SOC 2 CC5.3 · SIG domain B |
| Risk assessment | SOC 2 CC3.2 · SIG domain A |
| Independent audit and certification | SOC 2 CC4.1 |
| Background checks | SIG domain E |
| Security awareness training | SIG domain E |
| Confidentiality terms and leavers | SIG domain E |
| Multi-factor authentication | SOC 2 CC6.1 · SIG domain H · NIST CSF PR.AA-03 · PCI DSS 8.4.2 |
| Password policy | SOC 2 CC6.1 · SIG domain H |
| Access provisioning and review | SOC 2 CC6.2 · SIG domain H · NIST CSF PR.AA-05 · PCI DSS 7.2.4 |
| Privileged access | SIG domain H · NIST CSF PR.AA-05 |
| Encryption at rest | SOC 2 CC6.1 · SIG domain D · NIST CSF PR.DS-01 · PCI DSS 3.5.1 · GDPR Art. 32 |
| Encryption in transit | NIST CSF PR.DS-02 · PCI DSS 4.2.1 |
| Data retention and secure deletion | SIG domain D · PCI DSS 3.2.1 · GDPR Art. 28 |
| Data location and transfers | GDPR Art. 44 · GDPR Art. 46 |
| Cardholder data and PCI DSSno ISO 27001 clause: beyond an ISO 27001 certificate | PCI DSS 3.2.1 · PCI DSS 12.5.2 |
| Logging and monitoring | SOC 2 CC7.2 · SIG domain G · NIST CSF DE.CM-01 · PCI DSS 10.4.1 |
| Vulnerability and patch management | SOC 2 CC7.1 · SIG domain P · NIST CSF ID.RA-01 · PCI DSS 6.3.3 · PCI DSS 11.3.1 |
| Penetration testing | SIG domain P · PCI DSS 11.4.3 |
| Secure development and change | SOC 2 CC8.1 · SIG domain I |
| Incident response plan | SOC 2 CC7.4 · SIG domain J · NIST CSF RS.MA-01 · PCI DSS 12.10.1 |
| Notifying the customer of an incident | SOC 2 CC7.4 · SIG domain J · GDPR Art. 33 |
| Business continuity plan | SOC 2 A1.3 · SIG domain K · NIST CSF RC.RP-01 |
| Backup and disaster recovery | SOC 2 A1.2 · SIG domain K · NIST CSF PR.DS-11 |
| Subcontractors and subprocessors | SOC 2 CC9.2 · SIG domain T · PCI DSS 12.8.1 · GDPR Art. 28 |
| Assessing your own suppliers | SOC 2 CC9.2 · SIG domain T · NIST CSF GV.SC-07 |
| Data subject requests | SIG domain O · GDPR Art. 15 · GDPR Art. 28 |
| Lawful basis, consent and privacy notice | SIG domain O · GDPR Art. 6 |
| Data processing agreement | SIG domain O · GDPR Art. 28 |