{"schema_version":"2026-07-05.day16","scope":"controlled_pilot_procurement_answers","source_page":"/security-questionnaire","source_artifact":"docs/security-questionnaire-readiness.md","procurement_page":"/procurement-pack","answers_url":"/procurement-pack/answers.json","limitations":["This is not a completed buyer questionnaire.","This is not a signed DPA, completed DPIA, security certification, or pen test.","Buyer legal, DPO, security, and operations owners must approve production use."],"answers":[{"question_area":"Access control and tenant isolation","current_answer":"Prototype access uses role-bound operator keys, organisation allowlisting, and single-use proof links. It does not evidence production SSO, MFA, SCIM, password policy, or persistent user directory.","evidence_today":"Admin tenant-isolation report, identity-provider tenant-mapping readiness, role-capability evidence, and proof-link replay protections.","owner_to_confirm":"security owner","required_before_production":"Production SSO, MFA, SCIM/deprovisioning, session policy, and formal audit."},{"question_area":"Data processing and Article 28","current_answer":"Processor posture is documented for pilot review, but legal terms are unsigned.","evidence_today":"DPA/DPIA technical annex and data-processing/cookies posture page.","owner_to_confirm":"customer legal owner","required_before_production":"Customer-approved Article 28 terms, DPIA support pack, and privacy notice."},{"question_area":"Cyber Essentials and cloud security","current_answer":"EvidenceTrail is not Cyber Essentials certified.","evidence_today":"Security baseline and NCSC Cloud Security Principles launch gate.","owner_to_confirm":"security owner","required_before_production":"Cyber Essentials or buyer-approved equivalent and cloud control mapping."},{"question_area":"Incident response and breach support","current_answer":"Draft intake and incident-response workflows exist; no live monitored contact.","evidence_today":"Security contact intake draft and incident-response draft.","owner_to_confirm":"operations owner","required_before_production":"Live security contact, tested escalation, controller notification support, tabletop."},{"question_area":"Backup, restore, and business continuity","current_answer":"SQLite prototype restore probe exists; no approved production DR posture.","evidence_today":"Backup/restore draft and executable prototype restore probe.","owner_to_confirm":"operations owner","required_before_production":"Customer-approved RPO/RTO, encrypted backups, restore evidence, DR owner."},{"question_area":"Vulnerability and dependency management","current_answer":"Dependency-audit scaffold exists; no production CI security gate or pen test.","evidence_today":"Dependency checks, procurement dependency template, and security baseline.","owner_to_confirm":"security owner","required_before_production":"CI scanning, vulnerability-management owner, disclosure programme, pen test."}]}