We are considering purchasing SonarCloud’s services for our organization but have some questions about the security policy that were not answered on other posts and the security statement. Any information provided would be greatly appreciated for us to move forward:
- is your security program being audited by an external 3rd party (ISO 27001, SOC 2 etc.)?
- Do you have a formal information classification procedure? If so, how would personal data be categorized?
- Do you have formal processes in place for security policy maintenance and deviation?
- Do you have a process that addresses the identification and measurement of potential information security risks?
- Do you have a process for putting in place mitigating controls (measures taken to reduce risk)?
- Do you have a process that addresses the acceptance or transfer (Insurance policies, warranties for example) of the remaining (residual) risk after mitigation steps have been applied?
- Does your insurance cover cyber liabilities?
- Does your organization have a documented incident response plan?
During the investigation of a security incident, is evidence properly collected and maintained?
Thank you in advance!
-mariana