Ardcarne Life Assurance - Security Questionnaire v1
Documentdraft Ardcarne Life Assurance · security_questionnaire · draft · 2026-05-05
Draft DORA ICT third-party security questionnaire for a prospect, dated 5 May 2026. Several answers are Open, including incident notification times and recovery evidence. It states it is not a contractual commitment and no executed order form exists.
What it says
What this says
Current to 13 Oct 26Draft DORA ICT third-party security questionnaire for a prospect, dated 5 May 2026. Several answers are Open, including incident notification times and recovery evidence. It states it is not a contractual commitment and no executed order form exists.
What it is: a draft questionnaire prepared by Theo Gallagher for Declan Furlong, CISO at Ardcarne Life Assurance. It opens with five open findings, OF-A to OF-E, so the review call can start from them.
Commits: nothing. The text says "Nothing here is a contractual commitment" and the contract position is "Prospect. No executed order form exists." It states no price, availability figure, response time or refresh deadline.
Unusual: for a Enterprise-style regulated buyer, incident notification (INC-A) has "No committed time" yet, and DORA needs a dated commitment in writing. Recovery evidence, subcontractor list and encryption split are also unanswered.
Not settled: administrator logging, access roles, transition period and Ardcarne's register of information format. The document is stale-prone: it was last modified on 2026-05-05 and promises a reissue once open rows close.
As found in this document
The document
Body
Ardcarne Life Assurance - Security Questionnaire v1
Status: Draft. Not final. Answers marked Open have no evidence attached yet and must not be relied on for the register of information.
| Item | Detail |
|---|---|
| Prepared for | Declan Furlong, Chief Information Security Officer, Ardcarne Life Assurance |
| Prepared by | Theo Gallagher, Solutions Engineer, BB-Demo |
| Account owner | Matteo Ricci |
| Customer success manager | Elena Novak |
| Date of this draft | Tuesday 5 May 2026 |
| Scope | DORA ICT third-party questionnaire for the BB-Demo company brain |
| Contract position | Prospect. No executed order form exists. |
Open findings and owners
Listed first so that the review call can start from them.
Read the whole document (6,876 characters)
| Ref | Finding | Owner | Position |
|---|---|---|---|
| OF-A | Incident notification times to Ardcarne | Theo Gallagher, with the platform team | Open. Needs a dated commitment in writing. |
| OF-B | Exit plan and data return steps | Theo Gallagher | Open. Draft steps below, evidence to follow. |
| OF-C | Sub-processor and subcontracting list for the register of information | Theo Gallagher, with the platform team | Open. Not yet confirmed. |
| OF-D | Business continuity and recovery evidence | Platform team | Open. Theo has asked, no answer yet. |
| OF-E | Ardcarne's own register of information format | Declan Furlong | Open. Needed from Ardcarne so answers can be laid out to match. |
How to read this document
- Each answer says what BB-Demo can state today and what we can evidence.
- Where a control depends on the platform team, Theo has not answered on their behalf. Those rows say so.
- Nothing here is a contractual commitment. The executed order form and the MSA will decide terms.
Section A: Governance and service description
| Ref | Question | Answer | Evidence | Status |
|---|---|---|---|---|
| GOV-A | What service is being provided and to which Ardcarne functions? | The company brain: one AI-queryable layer over Ardcarne's CRM, calls, emails, tickets and related data, used to give broker distribution and customer service one view of each broker firm. | Scope statement in the proposal | Answered |
| GOV-B | Where does the service run? | Inside Ardcarne's own Snowflake account. BB-Demo does not hold a separate copy of Ardcarne's data in a BB-Demo-owned warehouse. | Architecture description to be attached | Answered, evidence to follow |
| GOV-C | Is the service supporting a critical or important function? | Ardcarne's classification decision. BB-Demo will describe the service and its dependencies so Ardcarne can make that assessment. | None required from BB-Demo | For Ardcarne |
| GOV-D | Who is the named security contact at BB-Demo? | Theo Gallagher, Solutions Engineer, for the duration of the review. | None | Answered |
Section B: Access control and identity
| Ref | Question | Answer | Evidence | Status |
|---|---|---|---|---|
| ACC-A | Is single sign-on supported? | SSO and SCIM are part of the Enterprise tier. | Tier description | Answered |
| ACC-B | How is access to Ardcarne's environment by BB-Demo staff controlled? | BB-Demo staff work inside the customer's Snowflake account under access the customer grants. The exact roles and the review cycle are to be confirmed with the platform team. | Role list requested | Open |
| ACC-C | Is administrator activity logged? | We expect so, but Theo will not state this as a control until the platform team has confirmed what is logged and for how long. | Log description requested | Open |
Section C: Data protection and residency
| Ref | Question | Answer | Evidence | Status |
|---|---|---|---|---|
| DAT-A | Can data be kept in the EU? | Because the brain runs in Ardcarne's own Snowflake account, location follows the region Ardcarne chooses for that account. Dedicated EU data residency is also available as an add-on. | Add-on description | Answered |
| DAT-B | Is data encrypted in transit and at rest? | Theo will confirm which protections are provided by Snowflake and which by BB-Demo before answering. | Control reference to follow | Open |
| DAT-C | Which source systems are connected? | Only those Ardcarne chooses. Typical systems are the CRM, the helpdesk, the call recorder, the mailbox and the accounting system. The final list is agreed during implementation. | Connector list to be agreed | Answered |
Section D: Incident management and notification
| Ref | Question | Answer | Evidence | Status |
|---|---|---|---|---|
| INC-A | What is the notification time for a major ICT incident affecting Ardcarne? | No committed time can be given in this draft. Under DORA, Ardcarne needs a dated commitment, so Theo will obtain one from the platform team and put it in writing. | Dated commitment to follow | Open |
| INC-B | Is there a history of incidents Ardcarne should know about? | BB-Demo will provide an incident history for the service. It has not been compiled for this draft. | Incident summary to follow | Open |
| INC-C | Who tells Ardcarne first? | The named security contact above. The escalation path will be written down and attached. | Escalation path to follow | Open |
Section E: Business continuity and exit
| Ref | Question | Answer | Evidence | Status |
|---|---|---|---|---|
| BCP-A | What recovery arrangements apply? | Not answered. Evidence is with the platform team and has been requested. | Recovery evidence requested | Open |
| EXT-A | What is the exit plan? | Because the data and the brain sit in Ardcarne's own Snowflake account, Ardcarne keeps its data on exit. The steps for removing BB-Demo's access, handing over configuration and confirming deletion of anything BB-Demo holds are being written. | Exit plan document to follow | Open |
| EXT-B | Is there a transition period? | To be set out in the contract. Not stated here. | None | Open |
Section F: Subcontracting and the register of information
| Ref | Question | Answer | Evidence | Status |
|---|---|---|---|---|
| SUB-A | Which subcontractors support the service? | The list is not confirmed. Snowflake is the platform the brain runs on, in Ardcarne's own account. Any other party will be named only once the platform team has confirmed it. | List to follow | Open |
| SUB-B | Can BB-Demo supply data in the format Ardcarne needs for its register? | Yes in principle. We need Ardcarne's format first (see OF-E). | Format from Ardcarne | Open |
Next steps
- Theo to obtain written answers from the platform team on OF-A, OF-C and OF-D, and to say what he can and cannot evidence.
- Theo to send the exit plan draft and the incident history as separate documents.
- Declan Furlong to confirm the register of information format and to mark any answer he will not accept without evidence.
- This draft is reissued as a new version once the open rows are closed. It is not final until then.
Thanks, Theo
Unusual terms
Current to 9 Oct 26- No committed incident notification time
- Dated written commitment needed under DORA
- Subcontractor list unconfirmed