Question group
Needs a person
Questions no standard asks: insurance, breach history, litigation, financial statements and customer references. They are set apart for the person who owns the answer, usually in finance, legal or sales, and never matched to a clause.
The families
5 families| Family and a typical question | ISO 27001 | Evidence expected |
|---|---|---|
| Cyber insuranceDo you hold cyber insurance? State the limit. | no clause | The insurance schedule or broker certificate naming the cover and the limit. Finance or the broker holds it. |
| Breach historyHas your organisation suffered a breach in the last 3 years? | no clause | A statement from the security lead, cleared by legal, of any notifiable incident in the period asked. No standard sets the answer. |
| Litigation and regulatory actionAre there any pending legal proceedings against your company? | no clause | A statement from legal of pending or recent proceedings and regulatory action. Legal owns it. |
| Financial statementsProvide your audited financial statements for the last two years. | no clause | The latest filed or audited accounts, or a letter from the finance lead. Finance owns it. |
| Customer referencesProvide two customer references of similar size. | no clause | Named contacts at customers who have agreed to take the call. Sales owns them. |