Home
Services
Customers
Resources
Company

Person coding at a computer

Rhymetec vCISOKick Off Questionnaire

Our team of experts is excited to assist you in building and maintaining your cybersecurity, compliance and data privacy programs. To better understand your goals and the details of our engagement, please complete the following questionnaire so we can further tailor our services to your organization’s unique needs.

vCISO Questionnaire

Complete the Form Below

Your Full Name(Required)

Email(Required)

Company Name(Required)

What is your company's domain name?(Required)

Who will be our primary point of contact in your company? (Provide first name, last name, and email address)(Required)

Primary Point of Contact Time Zone(Required)

Who will be our primary POC in your engineering department? (Provide email address)(Required)

Engineering POC Time Zone(Required)

Have you selected an auditor?(Required)

What is the name of your auditor?(Required)

Contact email for the auditor(Required)

What type of PII or sensitive data does your company collect from customers?(Required)

General PII (First Name, Last Name, Email, Physical Address)

Sensitive PII (Criminal Record, Sexual Identity, Sexual Orientation, Marital Status, Racial or Ethnic Origin, Religious or Philosophical Beliefs, etc.)

Healthcare Information (Health or Medical Info, Medical Record Number, Fitness Data, Disability Info, etc.)

Financial Information (Banking Info, Payment Card Data, Credit Info, Tax Information, etc.)

Does your product have any AI/ML models?(Required)

Are there departments in your organization that use AI/ML to perform their job functions?(Required)

In which geographical regions are the client’s customers?(Required)

Do you have a data map? Please link your data map if applicable.

Max. file size: 50 MB.

Do you have a network diagram? Please link your data map if applicable

Max. file size: 50 MB.

What country is your data stored?(Required)

What compliance framework is your highest priority? (If you are only contracted for one framework, then this question is not applicable.

When your desired date to receive be a final report from an auditor?(Required)

MM slash DD slash YYYY

When was your last penetration test?(Required)

MM slash DD slash YYYY

When was your last risk assessment?(Required)

MM slash DD slash YYYY

Link to existing policies

Max. file size: 50 MB.

Link to existing certifications / reports

Max. file size: 50 MB.

What are the audit trust services criteria you have selected?(Required)

Security

Confidentiality

Privacy

Processing Integrity

Availability

None

SOC 2 has 5 Trust services criteria. If you don't know which ones you'd like to comply with, select "none".

What is the name of the compliance monitoring tool you are using?(Required)

What is your IaaS provider?(Required)

Who is your identity provider? Please select all that apply.(Required)

Gsuite

Office 365 / Azure AD

OKTA

JumpCloud

One Login

Other

Are your databases:(Required)

Multi-Tenant

Single Tenant

N/A

Do you use:(Required)

Standalone Servers

Kubernetes

Serverless Infrastructure

We do not have any servers

Other

Are your testing and development environments separated?(Required)

What is your source code tool?(Required)

Github

Bitbucket

Gitlab

Azure Devops

Other

Do you have branch protection rules enforced on all production repositories?(Required)

Please select all types of devices used by your employees(Required)

macOS

Windows / PC

Linux

ChromeOS

Other

Do you use an mobile device management tool to manage your computers?(Required)

What MDM Tool are you using to manage your computers?(Required)

Do you use an Anti-virus tool?

If Yes, what Anti-virus tool are you using on your endpoints?

Do you have a performance monitoring tool in place? If so, how are you monitoring the performance of your application?(Required)

Do you have a vulnerability monitoring solution in place?(Required)

If yes, what vulnerability monitoring solution are you using?

Do you use a VPN or IP whitelisting when accessing production data? Please describe.(Required)

Do you conduct background checks on your employees? If so, what tool do you use to run background checks?(Required)

Are your employees required to go through annual performance reviews? If so , please describe this process.(Required)

Do you take interview notes during the recruiting process? If so , where are these notes stored?

Do you use an HR system to manage new hires and terminations? If so , what is the name of the tool?(Required)

What is the current onboarding flow for hiring new employees?(Required)

Are employees required to sign policies, and watch awareness training on their first day?(Required)

How are employees granted access to SaaS applications on their first day?(Required)

Do you have an onboarding checklist? If so , please add a link to it here through Google drive.(Required)

Is access to SaaS applications revoked on the last day of an employee?(Required)

How do employees request access to SaaS applications? Do you have a formal access request process?(Required)

Do you require approval from managers prior to granting access to SaaS systems?(Required)

Is there anything else you would like our team to know?

What are your desired timelines for this project?

Δ

Follow Us

COMPANY

Home
About
Customers
Contact

SERVICES

vCISO
Penetration Testing
ISO Internal Audit
FAQ

SIGN UP FOR OUR NEWSLETTER

Email

CAPTCHA

Comments

This field is for validation purposes and should be left unchanged.

Δ

Privacy Policy
Master Services Agreement

© 2024 Rhymetec. All Rights Reserved.