Security review: evidence ahead of the session

Dear Sabine, Following our last session, here is where we stand and what I propose for the next one. 1. Closed with evidence: the processing location answers, which are now attached per component with their control references. 2. Open, owner Theo: the access log retention statement. I have the extract, but I want the platform team to confirm the wording before I send it, because I do not want to overstate it. 3. Open, owner Theo: the subprocessor list, which I will send as soon as it is confirmed. The exit plan document is a draft at the moment and I will not describe it as final. We can walk through it together so that your comments go in before it is finished. Could we find an hour later this week or early next week? Please tell me what suits you. Thanks, Theo

Dear Theo, Thank you, this is a clear status and I appreciate that you have kept it to what you can evidence. I have recorded item 1 as closed on my side. Items 2 and 3 stay open until I have the documents. For the session, Thursday at 11:00 is possible for me. I would like the draft exit plan at least a day before, so that I can read it properly and come with numbered questions. Please also state in writing when you expect the retention wording and the subprocessor list. Let us agree the next step on that date. Sabine Kranz