Customer type

What a software company's security questionnaire reaches for

Software customers send the CAIQ or a SOC 2 driven list, and ask about subprocessors, data location and secure development in detail.

Frameworks ticked by default for this customer: ISO/IEC 27001:2022, SOC 2 (Trust Services Criteria), CSA Cloud Controls Matrix v4.0.1 and GDPR, Regulation (EU) 2016/679. Read a questionnaire as this customer.

Families, with the clauses from this customer's other frameworks

Family	Anchor clauses in this customer's frameworks
Information security policy	SOC 2 CC5.3
Risk assessment	SOC 2 CC3.2
Independent audit and certification	SOC 2 CC4.1
Background checks	CSA CCM HRS-01
Multi-factor authentication	SOC 2 CC6.1 · CSA CCM IAM-14
Password policy	SOC 2 CC6.1 · CSA CCM IAM-02
Access provisioning and review	SOC 2 CC6.2
Encryption at rest	SOC 2 CC6.1 · CSA CCM CEK-03 · GDPR Art. 32
Encryption in transit	CSA CCM CEK-03
Data retention and secure deletion	CSA CCM DSP-16 · GDPR Art. 28
Data location and transfers	CSA CCM DSP-19 · GDPR Art. 44 · GDPR Art. 46
Logging and monitoring	SOC 2 CC7.2
Vulnerability and patch management	SOC 2 CC7.1 · CSA CCM TVM-03
Secure development and change	SOC 2 CC8.1
Incident response plan	SOC 2 CC7.4 · CSA CCM SEF-03
Notifying the customer of an incident	SOC 2 CC7.4 · CSA CCM SEF-07 · GDPR Art. 33
Business continuity plan	SOC 2 A1.3 · CSA CCM BCR-04 · CSA CCM BCR-06
Backup and disaster recovery	SOC 2 A1.2 · CSA CCM BCR-08
Subcontractors and subprocessors	SOC 2 CC9.2 · CSA CCM DSP-13 · GDPR Art. 28
Assessing your own suppliers	SOC 2 CC9.2
Data subject requests	CSA CCM DSP-11 · GDPR Art. 15 · GDPR Art. 28
Lawful basis, consent and privacy notice	GDPR Art. 6
Data processing agreement	GDPR Art. 28