Security review: finding a date

Hello Euan, Thanks for the time on our last call. To be precise about where we left it: you wanted the security review run as a proper working session rather than a slide walk-through, and you wanted the architecture shown against your own questions. I'd like to get that into the diary. The short answer on what I'll cover is the deployment model: BB-Demo runs inside your Snowflake account, so the data does not leave your environment. The longer answer is how access is granted, who holds standing access on our side, and how the connectors authenticate. I'll put all of that in writing ahead of the session so you can mark it up. Could you tell me which days suit you next week, and who else from your team should be there? If someone from your risk committee secretariat needs to see the output, I'd rather plan for that now than retrofit it. If you send over any questionnaire or standing list of supplier controls you work from, I'll answer against that format so nothing needs translating. Thanks, Hannah

Hannah, Thank you. A working session is the right format and I am content to proceed on that basis. A few points before we fix a date: First, please send the architecture description and the access model at least a few working days before the session, not on the morning. I will not be able to close anything live. Second, who has standing access to the environment from the BB-Demo side, and how is that access reviewed? Please evidence that rather than describe the policy. Third, what is the incident history? I would like it stated plainly, including the position if there has been none. Fourth, I will bring a small number of colleagues from technology and one from risk. I will confirm names once we have a date. Thursday or Friday of next week would suit me best, mornings preferably. I would ask that you do not take any of the above as agreement to anything beyond the review itself. Euan Rattray