Form - Rhymetec vCISO Kick Off Questions

Rhymetec vCISO Kick Off Questionnaire

The purpose of this form is to gather as much information as possible to provide for a smooth Kickoff Meeting. If you don't know how to answer a question or don't have an answer for it, please add N/A.

Your Full Name(Required)

Email(Required)

Company Name(Required)

What is your company's domain name?(Required)

Who will be our primary point of contact in your company? (Provide first name, last name, and email address)(Required)

Primary Point of Contact Time Zone(Required)

Who will be our primary POC in your engineering department? (Provide email address)(Required)

Engineering POC Time Zone(Required)

Have you selected an auditor?(Required)

What is the name of your auditor?(Required)

Contact email for the auditor(Required)

What type of PII or sensitive data does your company collect from customers?(Required)

General PII (First Name, Last Name, Email, Physical Address)

Sensitive PII (Criminal Record, Sexual Identity, Sexual Orientation, Marital Status, Racial or Ethnic Origin, Religious or Philosophical Beliefs, etc.)

Healthcare Information (Health or Medical Info, Medical Record Number, Fitness Data, Disability Info, etc.)

Financial Information (Banking Info, Payment Card Data, Credit Info, Tax Information, etc.)

Does your product have any AI/ML models?(Required)

Are there departments in your organization that use AI/ML to perform their job functions?(Required)

In which geographical regions are the client’s customers?(Required)

Do you have a data map? Please link your data map if applicable.

Max. file size: 50 MB.

Do you have a network diagram? Please link your data map if applicable

Max. file size: 50 MB.

What country is your data stored?(Required)

What compliance framework is your highest priority? (If you are only contracted for one framework, then this question is not applicable).

Will you require compliance with the EU AI Act, ISO/IEC 42001, or other AI-related frameworks?

EU AI Act

ISO/IEC 42001

Other

When your desired date to receive be a final report from an auditor?(Required)

When was your last penetration test?(Required)

When was your last risk assessment?(Required)

Link to existing policies

Max. file size: 50 MB.

Link to existing certifications / reports

Max. file size: 50 MB.

What are the audit trust services criteria you have selected?(Required)

Security

Confidentiality

Privacy

Processing Integrity

Availability

None

SOC 2 has 5 Trust services criteria. If you don't know which ones you'd like to comply with, select "none".

What is the name of the compliance monitoring tool you are using?(Required)

What is your IaaS provider?(Required)

Who is your identity provider? Please select all that apply.(Required)

Gsuite

Office 365 / Azure AD

OKTA

JumpCloud

One Login

Other

Are your databases:(Required)

Multi-Tenant

Single Tenant

N/A

Do you use:(Required)

Standalone Servers

Kubernetes

Serverless Infrastructure

We do not have any servers

Other

Are your testing and development environments separated?(Required)

What is your source code tool?(Required)

Github

Bitbucket

Gitlab

Azure Devops

Other

Do you have branch protection rules enforced on all production repositories?(Required)

Please select all types of devices used by your employees(Required)

macOS

Windows / PC

Linux

ChromeOS

Other

Do you use an mobile device management tool to manage your computers?(Required)

What MDM Tool are you using to manage your computers?(Required)

Do you use an Anti-virus tool?

If Yes, what Anti-virus tool are you using on your endpoints?

Do you have a performance monitoring tool in place? If so, how are you monitoring the performance of your application?(Required)

Do you have a vulnerability monitoring solution in place?(Required)

If yes, what vulnerability monitoring solution are you using?

Do you use a VPN or IP whitelisting when accessing production data? Please describe.(Required)

Do you conduct background checks on your employees? If so, what tool do you use to run background checks?(Required)

Are your employees required to go through annual performance reviews? If so , please describe this process.(Required)

Do you take interview notes during the recruiting process? If so , where are these notes stored?

Do you use an HR system to manage new hires and terminations? If so , what is the name of the tool?(Required)

What is the current onboarding flow for hiring new employees?(Required)

Are employees required to sign policies, and watch awareness training on their first day?(Required)

How are employees granted access to SaaS applications on their first day?(Required)

Do you have an onboarding checklist? If so , please add a link to it here through Google drive.(Required)

Is access to SaaS applications revoked on the last day of an employee?(Required)

How do employees request access to SaaS applications? Do you have a formal access request process?(Required)

Do you require approval from managers prior to granting access to SaaS systems?(Required)

AI Frameworks Questionnaire

Because you selected requirements around AI compliance, please complete the following:

(If applicable) EU Authorized Representative Contact Information

First Last

EU Authorized Representative Phone

EU Authorized Representative Email

EU Authorized Representative Address

Street Address Address Line 2 City State / Province / Region ZIP / Postal Code Country

AI System Name & Version(Required)

Briefly describe the system's primary function:(Required)

What is its specific "Intended Purpose"? (How is it marketed and what is it designed to do?)(Required)

Is this system a component of another product you sell?(Required)

Yes

If yes, which product?

Is this a General-Purpose AI (GPAI) model? (i.e., designed for a wide range of tasks like GPT-4, Llama, Claude)(Required)

Yes

Does the system interact directly with users? (e.g., a chatbot)(Required)

Yes

Does the system generate content? (e.g., text, images, audio, video)(Required)

Yes

Does the system perform emotion recognition or biometric categorization?(Required)

Yes

Does the system generate "deepfakes"? (manipulated, realistic content)(Required)

Yes

Human Oversight: Who oversees the output of this system? What can they do (e.g., override, stop, disregard)? How are they trained?(Required)

Describe the datasets used to train, validate, and test this model. (Include source, size, key characteristics, and any steps taken to identify and mitigate bias)(Required)

Testing & Validation: How do you test the system for accuracy, robustness, and fairness?(Required)

What are the key performance metrics you use?(Required)

Logging: Does the system automatically generate logs of its operations?(Required)

Yes

If yes, what information is logged, where is it stored, and what is your retention policy?

Post-Market Monitoring: Do you have a process to monitor the system's performance after it has been deployed?(Required)

Yes

If yes, describe how you collect and analyze data from the real world.

Cybersecurity: What measures are in place to protect the system and its pipeline from cyber threats (e.g., data poisoning, model evasion)?(Required)

Documentation for Downstream Users: What documentation do you currently provide to developers who want to integrate your model into their own applications?(Required)

Training Data Summary: Can you provide a high-level summary of the content used to train the model (e.g., types of data, sources)?(Required)

Yes

Adversarial Testing (for Systemic Risk Models): Have you performed adversarial testing ("red teaming") to identify potential harms and vulnerabilities?(Required)

Yes

Right to Explanation: Do you currently have a process for individuals to request an explanation about an automated decision?(Required)

Yes

Corrective Actions: Do you have a formal process for handling a non-conformant product (e.g., a product recall or withdrawal plan)?(Required)

Yes

Conformity & Quality Management: Do you have an existing Quality Management System (QMS), for example, based on ISO 9001 or ISO 42001?(Required)

Yes

Additional Information

Is there anything else you would like our team to know?

What are your desired timelines for this project?