Corstorphine Building Society / BG-Demo – Exec Sponsor
Callscheduled
Corstorphine Building Society · 26 Nov 2026 13:15
The security review with Corstorphine Building Society is dated 2026-11-26, after the as-of date, so it is booked and not held. This record describes no outcome.
What was said
What this says
As at Fri 9 Oct 2026The security review with Corstorphine Building Society is dated 2026-11-26, after the as-of date, so it is booked and not held. This record describes no outcome.
What happened: The call is recorded for 2026-11-26 as a security review with Nell Ashcombe as host. That date is after the as-of date of 2026-10-09, so the call is a plan.
Customer view: Nothing said on a booked call can be reported as held. The customer's position is not read from this record.
Commercial: The call sits in the Enterprise sales motion, where a security review precedes the order form. Any commercial or contractual outcome has to wait until the call has taken place.
Watch: Re-read this call once it has been held and a record of it exists.
Themes
As at Fri 9 Oct 2026Theme
Booked security review
Importance
neutral
Sentiment
neutral
Voice
unknown
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Next steps
As at Fri 9 Oct 2026- Hold the booked security review on 2026-11-26 and read it again once it has taken place.
Transcript
Tom AshdownAfternoon, afternoon. Can you hear me alright? I've got a bit of an echo on my side.
Catriona MuirAfternoon Tom. Yes, you're fine. Slight echo but I can hear you.
Euan RattrayGood afternoon. I can hear you both. I'm on the wired connection today, so I should be stable.- Tom AshdownBrilliant. How's your week been? Anything settled yet or is it still all hands?
- Catriona MuirBusy. We've got the board pack going out and half my supplier files seem to have decided to expire at once. But we're fine. Thank you for asking.
- Tom AshdownNo drama, we'll try not to add to the pile. Hannah, are you with us?
Hannah LoweI'm here, sorry, I was just muting a notification. Hello both. Before we start, Euan, what do you most need to leave this call with? I'd rather aim at that than walk through everything again.- Euan RattrayThat's helpful, thank you. I'll be direct. I have two findings open from the first session and I'd like to go through them in order. Then I want the July outage dealt with properly, because the two are connected as far as I'm concerned.
- Hannah LoweUnderstood. Go ahead.
- Euan RattrayFinding one is standing access. Who has standing access to anything that holds our data, whether that's our Snowflake account or your own environment? I wrote that question down last time and I don't believe I got an answer that I could put in front of the risk committee.
- Hannah LoweFair. The short answer is that the design doesn't give BG-Demo engineers standing access to your data. The longer answer has a part that I owe you in writing, so let me be precise about which is which.
- Euan RattrayPlease do.
- Hannah LoweThe brain runs inside your own Snowflake account. So the data doesn't leave your estate and the roles that touch it are roles that your administrators create and own. If one of our engineers needs to look at something, say a connector that has stopped loading, your administrator grants access for that piece of work and then removes it. That's how it's meant to work.
- Euan RattrayMeant to work. Is that enforced or is that a procedure?
- Hannah LoweGood question, and I'd rather not blur it. The grant sits in your account, so you control it technically. What is a procedure is the expectation that grants are time-limited. Nothing on our side stops your administrator leaving a grant in place. So I'd describe that as a control you own with a process we recommend, not a control we enforce.
- Euan RattrayThank you. That's a more honest answer than I had last time. So the access of your engineers to the Snowflake account is only what we give them.
- Hannah LoweYes. And I'll put that in writing, with the role definitions, so you can see what a support grant would actually contain.
- Euan RattrayAnd your own environment? Build pipelines, the place where the code is kept. Who has standing access there?
- Hannah LoweThat's the part I can't answer fully on this call. There is a list, and I believe it's short, but I won't give you a number from memory, because if I'm wrong it ends up in your file. I'll get the access list confirmed by our security lead and send it with the date it was taken.
- Euan RattrayPlease evidence that. A list with a date, and a statement of who reviews it and how often. I'd like that to be a review that actually happens, not one that exists on paper.
- Catriona MuirCan I just flag, Euan, that if the review frequency ends up as a commitment then I'd like it in the contract. Is that in the contract at the moment, Tom?
- Tom AshdownNot in the draft as it stands, no. I'd rather be straight with you. Leave that with me, I'll speak to our legal side about where it sits, either the order form or the security schedule, and come back to you in writing.
- Catriona MuirThank you. I'll need that for the file.
- Euan RattrayRight. Finding one stays open until I have the role definitions and the dated list. Finding two. The incident.
- Hannah LoweYes. Before you ask, I know the July outage is the thing you've been waiting on. I'd like to take it in two halves, what happened and what has been done since. Is that alright?
- Euan RattrayThat's fine. But I should say I'm less interested in the narrative than in the closure of the actions. What's the incident history for this product? Is July the only one?
- Hannah LoweFor the record I'd rather not say only, because I haven't got the full register in front of me and I don't want to overstate it. I'll ask for the incident register to be extracted and I'll send you what it shows, including July.
- Euan RattrayThank you. Please do not summarise it. I'd like the entries.
- Hannah LoweUnderstood, the entries themselves. On July: the service was unavailable for a period, customers on the affected platform were told, and a post-incident review followed. The review produced a list of actions. That list is what I think matters most for your question.
- Euan RattrayHow many actions, and how many are closed?
- Hannah LoweRight, and this is where I have to be careful. I have the review document, and most of the actions are marked done. But marked done is a status, not evidence, and I take your point on that. For a couple of them I can't point you at the thing that proves it. I'd rather tell you that than say they're all complete.
- Euan RattrayI appreciate that. That's the finding, in effect. The report says done. I need to see that it's done. A change record, a test result, a monitoring rule, whatever is appropriate to that action.
- Hannah LoweAgreed. What I'll do is take each action, state what it was, what the evidence is, who closed it and when. Where there's no evidence yet I'll say so and give the date it will exist.
- Tom AshdownCan I come in there, just so I understand? Euan, is it the content of the actions you're worried about, or is it more that you can't see the proof?
- Euan RattrayMostly the proof, Tom. If the actions are sensible and evidenced, I'm content. A sensible action with no evidence behind it is a finding. An action that I think is weak, I'll say so, and we'll discuss it.
- Tom AshdownFair enough. That's clear.
- Euan RattrayOne more on this. Did the outage affect the integrity of anything, or only availability? The risk committee will ask me directly.
- Hannah LoweThe short answer is that it was an availability event. The longer answer is that I want the review to say so in plain words, and I'll check that it does before I repeat it to you as fact. If there is any wording in it about data being affected, I'll tell you, even if it's awkward.
- Euan RattrayThat's all I ask.
- Catriona MuirCan I bring in my list now? I don't want the time to go. I have a few documents outstanding for the supplier file and I'll go through them quickly.
- Tom AshdownPlease, go on.
- Catriona MuirFirst, the exit plan. What's the exit plan? If the society decided to leave, how do we get our data and our configuration out, and in what format, and how long do you keep anything afterwards?
- Hannah LoweThe data point is the easier part, because it's all in your Snowflake account already. If we weren't there, it would still be there. What would go is the brain layer and its configuration. I'll write that down properly rather than improvise it now.
- Catriona MuirPlease, with the retention position. Second, the list of any subcontractors who could touch our data. Third, the business continuity summary. Fourth, evidence of insurance. And fifth, the outsourcing assessment questionnaire, which is the long one.
- Tom AshdownRight, I've got those. Exit plan with retention, subcontractors, continuity summary, insurance, the questionnaire. I'll own the insurance and the subcontractor list and Hannah has the technical ones. Is that fair, Hannah?
- Hannah LoweYes. I'll take the exit plan technical section, the continuity summary and the questionnaire. If the questionnaire has a question I'm not certain of, I'll check it before I answer, not guess.
- Catriona MuirThat's exactly what I want to hear. And I will say, Tom, that the questionnaire answers need to be right first time. I'd sooner wait than have a second round.
- Tom AshdownWouldn't argue with that. And while we're on the commercial side, the deal as it stands is the one hundred and fifty-five thousand, £155,000, that's the total including the implementation. I'll confirm that in writing with the exact split, I'm not going to quote it from memory.
- Catriona MuirThank you. I don't discuss that on the phone anyway. Send it over and I'll put it with the rest.
- Euan RattrayAnd I don't discuss price at all, so you can carry on without me.
- Tom AshdownNoted, Euan, and I'll not drag you into it.
- Catriona MuirTiming, then. We've said the target is 30 Sep 2026 for a decision. Realistically, with the committee cycle, I need everything for the file in good time before that. I can't let it slide quietly, so if something is going to be late, tell me early.
- Tom AshdownThat's fair and we'll do that. Hannah, can you get the written responses out soon, so Euan has time to look at them properly?
- Hannah LoweI'll aim for the end of next week for the access material and the incident actions. The register extract might take a little longer, because I need it from another team. I'll tell you if it's going to slip.
- Euan RattrayThat's acceptable. I'll review within a few working days of receiving it and I'll write back with whichever findings I can close and any new ones. I won't close anything without evidence.
- Hannah LoweI wouldn't want you to. One last thing from me. If a call would be quicker than another round of email on the incident actions, I'm happy to do a short one with you and walk through the evidence line by line.
- Euan RattrayI may take you up on that. Let's see what arrives first.
- Tom AshdownBrilliant. Let's get something in the diary once the paperwork's with you. Anything else before we let you go?
- Catriona MuirNot from me. I'll send a short note of the outstanding items after this so we're all working from the same list.
- Euan RattrayNothing further. Thank you, both, for the straight answers today.
- Hannah LoweThanks all. Speak soon.
- Tom AshdownCheers everyone. Have a good rest of the afternoon.
Callsmade from