Scheduling the security review

Hello Megan, Jordan has asked me to pick up the security review with you. I run these for BB-Demo, so you will be dealing with me directly. Before we fix a time, may I ask what you most need to know first? The short answer for what I can bring is an architecture diagram showing how the brain runs inside a customer's own Snowflake account, how access is controlled, how data is handled, and our incident history. The longer answer is that I will put every answer to your questions in writing, so you have a record to take to your risk committee. Could you suggest a few slots next week, and send over any questionnaire or open findings you already hold? That way I can answer them properly rather than on the fly. Thanks, Hannah

Hannah, Thank you. For the record, the scope of the review is as follows. First, the architecture and data flows for any workload touching patient-related data. Second, access control, logging and the handling of administrator credentials. Third, your incident history. Please describe any incidents in the last ninety days, and how each was disclosed to customers. I am available Tuesday or Wednesday afternoon, Eastern time. I will send the questionnaire separately. Please note that I do not give verbal approvals. Anything discussed on the session will inform our risk posture, and the outcome will be communicated in writing only. Megan Alvarez, CISO