Scheduling the security review session

Hi Nadia, Thanks for your time on the call. To be precise about where we left it: we agreed to set aside a proper working session for the security review, so that we can go through your open items together rather than trading them by email. Could you tell me what you most need to see? I'd like to prepare the right material. From our conversation I expect it to cover how the brain runs inside Fenmoor's own Snowflake account, how access is controlled, and what evidence I can give you for the audit trail. If I have missed something your capacity providers will ask about, please say, and I'll put that in writing before the session. For timing, I could do Tuesday or Thursday next week, mornings or afternoons. I'd suggest an hour and a half so we are not rushed, and I can bring a colleague from our side if you would like someone else present for the questions I'd want to check before answering. Tell me which suits you and I'll send the invitation. Thanks, Hannah Hannah Lowe Solutions Engineer, BG-Demo

Dear Hannah, Kind regards for your note, and apologies for the slow reply. The last few days went on supplier reviews for our capacity providers. Thursday works for me, which is tomorrow, if that is still free for you. Afternoon is better, say 14:00. An hour and a half is fine. So that we use the time well, these are my open items: First, where the data sits and who can reach it. Can you evidence that, in writing, rather than describe it? Second, how access is granted and removed, including for your own staff. Third, the questionnaire. I'll need your answers in it, not in an email, so that I have the paper trail for the audit. One caution: I can't give a sign-off date on this until our capacity providers have seen the pack. Please don't read the session as a commitment on that. It is helpful that you offered to bring a colleague. Please do. Kind regards, Nadia Nadia Osei IT Security Lead, Fenmoor Specialty Underwriting