Security review session: open findings and arrangements

Hello Euan, Following our most recent call, I wanted to get the next review session fixed and to be clear about what I'm bringing, so that nothing arrives as a surprise. To be precise, I have gone back through your open findings from the earlier sessions and I'll have a written response against each one, with the evidence attached where one exists. Where I don't have evidence yet, I'll say so rather than offer a reference in its place. For anything I'm not certain of, I'll check with the right person on our side before I put it in writing. Could you let me know which day this week or next suits you and your colleagues? I'd also find it helpful to know whether you want the data residency and access model walked through again, or treated as settled. Thanks, Hannah

Hannah, Thank you. I will start with my open findings, as I always do, so your approach is sensible. To set expectations: I will not close a finding on a statement alone. Please evidence that for each, and where a control is described, show me the control itself rather than a reference to one. The access model is not settled for me until I have seen who has standing access and how it is reviewed. Please include it again. I would also ask that the written responses reach me before the session, so my colleagues can read them in advance. The following week is workable for us, with Wednesday or Thursday preferred. I will confirm attendees once you have proposed a time. Euan Rattray