Security review session: arranging a date

Dear Sabine, I have taken over the questionnaire work for Brenneck Pay and would like to set up a working session with you on the open security review items. To make the session useful, I propose we cover the following, mirroring your questionnaire: First, where the data is stored and processed in the EU region, with the control reference for each answer. Second, access logs: what is recorded, who can see it, and how long it is kept. Third, the DORA and outsourcing points, including the exit plan. For each item I will bring what we can evidence, and I will say plainly where something is still a draft. Where an answer depends on our platform team, I will check with them first and not answer on their behalf. Would early next week suit you? Here is the dated commitment from my side: I will send you the evidence list one working day before we meet. Thanks, Theo

Dear Theo, Thank you for your message. Wednesday at 14:00 is possible for me. My open questions, so that you can prepare: First, where exactly is the data processed? I need the processing location for storage, for the nightly refresh and for support access. A statement that it is in the EU is not sufficient. Second, please provide evidence for the access logs: a sample export, and the retention rule in writing. Third, please provide the exit plan as a document, with the steps and the roles on both sides. This is a requirement, not a preference, because our outsourcing register must reflect it. I will close a finding only when I have the evidence in hand. Please therefore send the evidence list in advance, as you proposed, and mark every draft as a draft. Sabine Kranz