Security questionnaires, the cyber sections of tenders, contract clauses: we prepare accurate answers, backed by your evidence, and track the commitments made until they fall due.
A questionnaire filled in a hurry creates two risks: losing the deal with an over-cautious answer, or committing to a measure you do not apply. The second comes to light at the client’s audit, or after an incident.
So we answer from what exists and can be proven. Each answer points to evidence; each new commitment enters a tracked plan, with an owner and a due date.
The same base of answers serves all your clients; it grows with each questionnaire.
You getA grid of requirements, ranked by stake
You getSubstantiated answers, with their attachments
You getA reasoned position, clause by clause
You getA register of commitments and evidence
Your clients do not ask out of curiosity: their own texts require them to oversee their providers, and they pass the requirements on to you.
Financial entities must include in their ICT services contracts, among other things, provisions on data protection and on the provider’s assistance when an incident related to the service occurs.123
The directive asks Member States to ensure that entities take into account the quality of products and the cybersecurity practices of their suppliers; the ReCyF (working version) sets them the objective of ensuring, notably by contract, that the IT services they receive comply with their own obligations.456
The processing contract stipulates that the processor takes the security measures of Article 32 and makes available the information needed to demonstrate compliance, including during audits.78
The CNIL recommends that controllers set their processors’ security obligations by contract and provide the means to verify that they are effective.910
The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.
You choose the level; the scope and deliverables are set by contract.
We keep your base of answers up to date and flag outdated evidence and commitments falling due.
DeliverablesWe analyse each request and prepare the answers and the position on clauses, which you approve.
DeliverablesWe run the follow-up of commitments with your teams, without making the changes in your systems.
DeliverablesOne measure answers questions phrased after ISO 27001, DORA, NIS 2 or the CNIL guide: we describe it once.
An AI assistant drafts answers from your documents; an expert reviews and approves each answer before it is sent.
Security assurance plan, security annex, notification clauses: templates to adapt, already tested against clients’ requirements.
No. We prepare the answers and the evidence; you approve and send them. The commitment remains yours, and we only have you promise what you apply or have planned.
The regulation requires the financial entity to include certain provisions in its ICT services contracts; it therefore passes them on to you. We help you tell what the text requires from what the client adds, which can be negotiated.1
The processing contract must provide that you contribute to audits conducted by the controller or by an auditor it mandates. Better to agree the terms in advance: notice, scope, frequency, confidentiality.8
Write it down. A « no, planned for such a date » answer with a plan is often better received than a fragile « yes ». We size the gap and propose the wording and the date.
Describe the request and its deadline. We come back to you with a first reading of the requirements and a proposed scope.
Exact text, in its original language, from the frameworks extracted from the official text.
32022R2554-a30-p2The contractual arrangements on the use of ICT services shall include at least the following elements:32022R2554-a30-p2-3provisions on availability, authenticity, integrity and confidentiality in relation to the protection of data, including personal data;32022R2554-a30-p2-6the obligation of the ICT third-party service provider to provide assistance to the financial entity at no additional cost, or at a cost that is determined ex-ante , when an ICT incident that is related to the ICT service provided to the financial entity occurs;32022L2555-a21-p2-4supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;32022L2555-a21-p3Member States shall ensure that, when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. Member States shall also ensure that, when considering which measures referred to in that point are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1).recyf:obj-3Les entités [importantes ou essentielles] réalisent et maintiennent à jour une liste des prestataires et fournisseurs informatiques intervenant dans la réalisation de leurs activités ou dans la fourniture de leurs services et avec lesquels il existe une relation de droit ou de fait ainsi que le périmètre et la nature de la prestation ou du service fourni.
Les entités [importantes ou essentielles] mettent en place des processus visant à s’assurer, notamment par la voie contractuelle de la conformité des prestations informatiques dont elles bénéficient aux obligations auxquelles l’entité est assujettie notamment en matière de gestion des risques qui menacent la sécurité de leurs réseaux et systèmes d’information et de notification des incidents importants.32016R0679-a28-p3-3takes all measures required pursuant to Article 32;32016R0679-a28-p3-8makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.F14-PE-02Prévoir un contrat avec les sous-traitants, qui définit notamment l’objet, la durée, la finalité du traitement ainsi que les obligations des parties, notamment en termes de sécurité. S’assurer qu’il contient en particulier des dispositions fixant : la répartition des responsabilités et des obligations en matière de confidentialité des données personnelles confiées ; des contraintes minimales en matière d’authentification des utilisateurs ; les conditions de restitution et de destruction des données en fin du contrat ; les règles de gestion et de notification des incidents. Celles-ci devraient comprendre une information du responsable de traitement en cas de découverte de faille de sécurité ou d’incident de sécurité et cela dans les plus brefs délais lorsqu’il s’agit d’une violation de données personnelles ; l’assistance que doit fournir le sous-traitant pour garantir le respect des obligations de sécurité ; la revue régulière des mesures de sécurité et, le cas échéant, les conditions de leur révision.F14-PE-03Prévoir les moyens permettant de vérifier l’effectivité des garanties offertes par le sous-traitant en matière de protection des données (ex. : audits de sécurité, visite des installations). Ces garanties incluent notamment : le chiffrement des données selon leur sensibilité ou, à défaut, l’existence de procédures garantissant que la société de prestation n’a pas accès aux données qui lui sont confiées si cela n’est pas nécessaire à l’exécution de son contrat ; le chiffrement des transmissions de données (ex. : connexion de type HTTPS, mise en place de VPN) ; des garanties en matière de protection du réseau, de traçabilité, de gestion des habilitations, d’authentification, de pratiques d’administration, d’audits, etc.