Turnflow Sign in

Sample · fictional companies

A completed questionnaire, ready to read

Acme Cloud's answers to Globex's vendor security assessment, completed from Acme's sample SOC 2 report and company fact sheet. Both companies are made up. You get the same answers written into your customer's own spreadsheet.

Download the Excel file

Each answer shows the document, section and page it came from, with the exact sentence quoted. Partly supported means the evidence backs only part of the question (for example, an auditor found an exception), so the choice is left to you. Not answered means none of the documents covered it; the note says what would.

Company

1.1

What is the legal entity name of your company?

AnswerAcme Cloud Inc.

  • Acme_Cloud_Company_Fact_Sheet.md · page 1Legal entity name: Acme Cloud Inc.
1.2

Where is your company headquartered?

AnswerWe are headquartered in Austin, Texas, United States.

  • Acme_Cloud_Company_Fact_Sheet.md · page 1Headquarters: 500 Example Street, Austin, Texas, United States.
1.3

How many employees does your company have?

AnswerWe have 142 full-time employees as of September 2026.

  • Acme_Cloud_Company_Fact_Sheet.md · page 1Number of employees: 142 full-time employees as of September 2026.

Governance

2.1

Do you maintain a documented information security policy that is reviewed annually?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC5.3 · page 3The Company maintains a documented Information Security Policy that is reviewed and approved by management annually.
2.2

Do you hold a current ISO 27001 certification?

Not answeredLeft blank for you to decide.

Not answered from the evidence provided. No document in the evidence provided matches this question.

HR Security

2.3

Do all employees complete security awareness training annually?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC1.4 · page 3All employees complete security awareness training upon hire and annually thereafter.
2.4

Are background checks performed for all employees prior to hire?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC1.4 · page 3Background checks are performed for all employees prior to their start date.

IAM

3.1

Is multi-factor authentication required for all access to production systems?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.1 · page 3Multi-factor authentication is required for all workforce access to production systems.
  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.1 · page 3Test result: No exceptions noted.
3.2

Are user access reviews performed at least quarterly?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.2 · page 3User access reviews for production systems are performed quarterly.
3.3

Is access for terminated employees revoked within 24 hours?

Partly supportedLeft blank for you to decide.

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.3 · page 4Access for terminated employees is revoked within 24 hours of termination.
  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.3 · page 4For 2 of 25 sampled terminations, production access was revoked 48 hours after
  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.3 · page 4Management response: The offboarding workflow was automated in May 2026.

Partial: left for you to choose, because the evidence supports this only in part. Still needed: There is no evidence that the automated offboarding workflow from May 2026 works. Proof would need to be a later SOC 2 report, a bridge letter, or an internal or external test showing that all terminated employees lose access within 24 hours after the fix.

Encryption

4.1

Is customer data encrypted at rest using AES-256 or stronger?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.1 · page 3Customer data at rest is encrypted using AES-256 via AWS Key Management Service (KMS).
4.2

Is data in transit encrypted using TLS 1.2 or higher?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.7 · page 4Data in transit over public networks is encrypted using TLS 1.2 or higher.
4.3

Do you support customer-managed encryption keys (BYOK)?

Not answeredLeft blank for you to decide.

Not answered from the evidence provided. We need a document that says outright whether customers can bring or manage their own encryption keys. Any of these would work: (1) a product security or encryption whitepaper or fact sheet saying whether customer-managed keys or BYOK are offered, for example customer-owned AWS KMS keys used across accounts, imported key material, or an external key store; (2) a SOC 2 or ISO 27001 control description covering customer-managed keys; or (3) customer-facing documentation or a contract term describing the key ownership model. If BYOK is not offered, a written statement saying keys are managed only by the vendor or AWS would support a "No" answer.

4.4

Describe your encryption key management and key rotation practices.

AnswerWe encrypt customer data at rest with AES-256 using keys managed in AWS Key Management Service (KMS). AWS KMS rotates our encryption keys every year. Our SOC 2 Type II audit tested this control and noted no exceptions.

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.1 · page 3Customer data at rest is encrypted using AES-256 via AWS Key Management Service (KMS).
  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC6.1 · page 3Encryption keys are rotated annually by AWS KMS.

Tenancy

5.1

Is customer data logically segregated from other tenants?

Partly supportedLeft blank for you to decide.

  • Acme_Cloud_SOC2_Type_II_2026.pdf · page 2Customer data is logically segregated by a tenant identifier enforced at the application and database layers.

Partial: left for you to choose, because the evidence supports this only in part.

5.2

Can customers choose EU-only data residency?

Not answeredLeft blank for you to decide.

Not answered from the evidence provided. We need a written statement that settles this, from a product/hosting fact sheet, a data residency policy, a Data Processing Agreement (DPA) or subprocessor/hosting-location list, or a SOC 2/ISO 27001 system description. It must say either: (a) customers can choose to have their data stored and processed only in the EU, naming the EU region(s), such as AWS eu-west-1 or eu-central-1, or (b) the service is hosted only in US regions (us-east-1/us-west-2) and offers no EU data residency option.

Testing

6.1

Is a penetration test performed by an independent third party at least annually?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC7.1 · page 4An independent third party performs a penetration test of the platform annually.
  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC7.1 · page 4Test result: No exceptions noted.
6.2

Are vulnerability scans performed at least monthly?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC7.1 · page 4Vulnerability scans of the production environment are performed weekly.

Monitoring

6.3

Are security events logged and monitored centrally?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC7.2 · page 4Security events are logged centrally and monitored by a SIEM with alerting to the on-call security engineer.

Incident

6.4

Do you have a documented incident response plan that is tested annually?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC7.3 · page 5The Company maintains a documented Incident Response Plan that is tested annually.
6.5

Will you notify affected customers of a confirmed security breach within 72 hours?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC7.3 · page 5Affected customers are notified of a confirmed security breach within 72 hours.

SDLC

6.6

Do all production code changes require peer code review before deployment?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC8.1 · page 5All changes to production code require peer code review and approval before deployment.

BCDR

6.7

Are production databases backed up daily?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · A1.2 · page 5Production databases are backed up daily and backups are retained for 35 days.
6.8

Is disaster recovery testing performed at least annually?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · A1.2 · page 5Disaster recovery testing is performed annually.

Vendors

6.9

Are subprocessors assessed for security risk?

AnswerYes

  • Acme_Cloud_SOC2_Type_II_2026.pdf · CC9.2 · page 5Subprocessors are assessed for security risk prior to onboarding and reviewed annually.

Globex note: provide subprocessor list.