Security pack: evidence and next steps

Hello Nadia, Following our session, I have put the written answers together for the questions you raised. To be precise about what is attached to the pack: the architecture diagram showing the brain inside Fenmoor's Snowflake account, the access-control description with how named users are managed, and the steps for revoking connector credentials. One point I want to flag honestly: where a control depends on Fenmoor's own configuration rather than ours, I have said so in the answer instead of implying we cover it. I checked the residency wording with a colleague before writing it, so I'm comfortable it is accurate. Would you read it through and tell me which answers need more evidence before it goes to the capacity providers? I'd rather fix gaps now than have them come back with questions. Thanks, Hannah

Dear Hannah, Thank you, this is clearer than the first draft of the questionnaire answers. Two observations. First, the access-control answer describes the review process but not how often it happens. Can you evidence that, or tell me where it is recorded? Second, the credential revocation steps are good, but I'll need them confirmed in the questionnaire itself, for the audit trail, and not only in the attachment. I'll hold the pack until those two are in. The capacity providers have not yet seen it, so I am not able to give a sign-off date. Kind regards, Nadia

Hello Nadia, That's fair on both. I'll put the review frequency in writing and enter the revocation steps directly into the questionnaire, so nothing relies on the attachment alone. I'll come back to you tomorrow with the updated answers. If anything in the frequency wording needs a second check on our side, I'll tell you that plainly rather than guess. Thanks, Hannah