Security Readiness Review

What the Organization asks for before its AI team starts work.

The business

Halcyon Data Ltd. 24 staff, B2B data tooling.

Why now

First enterprise customer is in procurement and sent a 40 question security questionnaire

What I asked for

What can we actually prove, and what will we fail on

Who owns security

Nobody formally. The platform lead in practice.

What we think we have

Encryption, MFA, backups, logging. Engineering is confident.

What we know we lack

Anything written down

Deadline

Questionnaire due back in three weeks

Out of scope

Testing. We know we need a proper pen test eventually.

Attached by the buyer.

• Cloud configuration export (JSON)
• Identity provider user and policy report (CSV)
• Endpoint manager device report (CSV)
• Backup job history, 90 days (CSV)
• Restore test record, July 2026 (PDF)
• HR leavers list (XLSX)
• Customer security questionnaire, 40 questions (XLSX)

1. Company supplies current tools, policies, questionnaires and approved security evidence.
2. Evidence agent maps what is demonstrably true today.
3. Control agent organizes security domains and identifies missing ownership or documentation.
4. Questionnaire agent drafts only from approved evidence.
5. Technical remediation and penetration testing remain with qualified security practitioners.

• Current-state summary
• Controls evidenced
• Controls missing/unclear
• Ownership gaps
• Priority remediation list
• Questionnaire evidence map
• Professional testing needs
• Next review date