Resource / Practical, ungated guidance
Security-question crosswalk
Translate common RFP questions into evidence requests and explicit delivery responsibilities.
Separate a control design from an attestation
Ask what exists now, what is proposed for the engagement, and what evidence will be delivered. Conduit does not claim SOC 2 certification, FedRAMP authorization, ISO/HITRUST certification, or a published VPAT. A readiness plan or use of an authorized cloud service is different from an attested application.
- Certification name, scope, and actual evidence
- Current versus planned status
- Application boundary versus cloud-service boundary
- Evidence owner and delivery milestone
Ask for inspectable artifacts
For identity, request the role matrix and access tests. For audit, request example events and retention rules. For recovery, request objectives and a tested restoration plan. For residency, identify every storage and processing location, including logs and backups.
- Identity provider and role matrix
- Record and site partition tests
- Audit event samples and access rules
- Retention and export plan
- Recovery objectives and test record
- Storage, processing, logging, and backup locations
Assign the operating responsibility
A system's control posture depends on configuration and operation. State who manages identity, patches, alerts, backup restoration, incident intake, and customer changes. Request a scoped DPA, SSP summary, or architecture review rather than assuming a universal document already exists.
- Customer and supplier responsibility matrix
- Patch and monitoring ownership
- Incident escalation route
- Contract-specific assurance deliverables
- Transition acceptance criteria