Security assessment outcome and conditions

Theo, I have completed my assessment of your security submission, including the post-incident review and the evidence attached to the questionnaire. The assessment is passed, subject to two conditions: 1. Monthly written reports on the two post-incident actions, until both are closed. Each report should state the current status, the owner and the evidence of progress. Please evidence closure; a statement that the action is complete will not be enough. 2. A summary of each annual penetration test, provided to us once it is complete. I would expect the scope, the findings by severity and the status of remediation. I will record the outcome against both conditions on our side. Please confirm that you accept them and tell me who will own each report. Sarah is copied so the procurement record reflects the outcome. Anil Bhatt

Anil, Sarah, Thank you for the outcome. We accept both conditions. Answers below, numbered to match your note. 1. Monthly reports on the two post-incident actions. We will send one at the end of each month, starting at the end of next month, and continue until both actions are closed. Each report will give the status, the named owner and the evidence, with the control reference where one applies. Closure will be shown by evidence, and I will not mark an action closed on description alone. I will confirm the owner for each action with our platform team before the first report, so that the name you receive is the person actually doing the work. 2. Penetration test summaries. We will provide a summary of each annual test once it is complete, covering the scope, findings by severity and remediation status. If a finding is still open when the summary is sent, it will say so, and the report will show who owns it and what the dated commitment is. If you would like a different format for either, tell me and I will adjust. Sarah, please record our acceptance in the log. Tom is copied for the commercial record. Thanks, Theo