Permitted information
Identify the sources, purposes, licence conditions and permissions relevant to the engagement. Establish what information may enter the analytical workflow.
Engage with KADESecurity & trust03 / 05
Establish the boundary
before the analysis.
An institutional discussion starts with the conditions under which information may be accessed, processed and returned, and the evidence needed to assess the proposed arrangement.
01 / Explore the approach
Define the conditions.
Inspect the evidence.
Security and trust need to be considered against the actual environment and scope. Controls and responsibilities should be established through technical and contractual review.
Processing location
Review the proposed deployment model and its processing boundaries. Hosted, hybrid sovereign and fully sovereign describe different approaches; a particular configuration and its readiness must be assessed separately.
Access and responsibility
Establish who may access the environment and how responsibilities for identity, access review, administration and change management would be allocated.
Evidence for diligence
Identify the documentation and technical review needed to assess the arrangement. Any assurance statement should be supported by evidence relevant to the proposed service.
02 / The essential questions
Topics for institutional diligence
Identity and access
Authentication options, permissions, administrative access and access review.
Information lifecycle
Encryption, logging, retention, deletion and the handling of sensitive information.
Hosting and suppliers
Processing locations, external services, subprocessors and deployment responsibilities.
Operational response
Security contacts, incident arrangements, escalation and relevant assurance material.
Let’s talk
Request a security discussion.
Set out the institution’s security questions and proposed deployment boundary.
Start a conversation Any evaluation, implementation or support arrangement is subject to an agreed scope and terms.