Start with the controls you can actually demonstrate.
Our security page and AI-use statement describe current status and delivery boundaries. A readiness review applies that discipline to your scope: distinguish a working control, missing evidence and an unresolved requirement.
Controls commonly covered in a review.
Review multi-factor settings, named accounts, administrative and remote access, an access matrix and offboarding evidence within the agreed scope.
Review backup scope, frequency, location, encryption and retention. Any restore exercise needs an approved test environment and recovery procedure; record unresolved dependencies.
Review device encryption, updates, endpoint protection and email authentication, including SPF, DKIM and DMARC where access and scope allow.
Review incident contacts, escalation responsibilities, relevant vendors and their data terms, plus exposed public artifacts within the agreed scope.
A clear evidence pack and an actionable gap list.
Draft answers supported by available screenshots, policies, logs or recovery records. Mark unsupported answers and unresolved controls clearly; the customer approves the final submission.
The written scope identifies which access, DNS, backup or configuration changes fit inside the fee. Changes require approved access, dependencies and a recovery plan; additional work is scoped separately.
List unresolved items, an accountable owner and proposed next steps. Estimates and target dates remain subject to investigation, purchases and approval; this does not establish an insurance outcome.
What this is not.
This is not a penetration test, SOC 2 audit, certification or insurance advice. Where a questionnaire requires a qualified auditor or another specialist, that requirement must be identified before acceptance.