BR-006Supported
Is customer data encrypted in transit?
The supplied configuration records TLS 1.2 as the minimum and TLS 1.3 enabled.
Source 1 · 19 Jul 2026
Public outcome sample
See what a careful answer looks like when the evidence is imperfect.
This fictional sample shows eight buyer questions, cautious answer language, distinct evidence states and sanitised source references. It contains no real company, person or customer data.
FICTIONAL REVIEW CASE · DEMONSTRATION
Buyer questionnaire matrix
- Q-01
Is MFA required for privileged access?
- Draft response
- Required by policy; one legacy exception is unresolved.
- Evidence sources
- SRC-007 · SRC-019
- Evidence date
- 28 Jul 2026
- Owner confirmation
- Pending
- Review status
- Contradictory
- Open action
- Confirm exception status
- Q-02
Are production backups encrypted?
- Draft response
- Yes, for the documented managed database boundary.
- Evidence sources
- SRC-011 · SRC-012
- Evidence date
- 03 Aug 2026
- Owner confirmation
- Confirmed
- Review status
- Supported
- Open action
- None
- Q-03
Is the incident plan tested annually?
- Draft response
- A plan exists; the supplied exercise record is overdue.
- Evidence sources
- SRC-004 · SRC-016
- Evidence date
- 16 Nov 2024
- Owner confirmation
- Confirmed
- Review status
- Stale evidence
- Open action
- Provide current exercise record
- Q-04
Are subprocessors reviewed before use?
- Draft response
- The owner states that review occurs; no accepted record supports the claim.
- Evidence sources
- Owner statement
- Evidence date
- 12 Aug 2026
- Owner confirmation
- Confirmed
- Review status
- Assertion only
- Open action
- Supply review evidence
- Q-05
Can customer data be deleted on request?
- Draft response
- Documented for the primary platform; backup expiry remains to be confirmed.
- Evidence sources
- SRC-021 · SRC-022
- Evidence date
- 05 Aug 2026
- Owner confirmation
- Pending
- Review status
- Partially supported
- Open action
- Confirm backup expiry
Fictional demonstration
The sample demonstrates evidence preparation only. It is not certification, a compliance attestation, legal advice, independent assurance or an audit opinion.
FICTIONAL SAMPLE
Response and evidence ledger
Human reviewed
BR-011Partially supported
How is privileged access approved and reviewed?
Roles and alerts are evidenced; one quarterly review record is missing.
Sources 1–2 · Mar–Jul 2026
BR-021Contradictory
Is the subprocessor register current?
The current register and the older customer DPA list different providers.
Sources 1–2 · Jan 2025–Jul 2026
BR-028Unsupported
Are customer-facing security claims supported?
Several claims are broader than the available evidence. A positive answer is not supportable.
Sources 1–2 · 20 Jul 2026
Status is not derived from hit count. Evidence, contradictions and confirmations are adjudicated before release.
Six distinctions a useful pack must preserve
- Supported
- The supplied evidence directly supports a bounded answer.
- Partially supported
- Some elements are evidenced; material limits remain.
- Contradictory
- Current or historical sources cannot both be true as written.
- Stale evidence
- Relevant material exists but is overdue or no longer representative.
- Customer assertion only
- A named owner states the fact, but the supplied evidence does not independently support it.
- Unsupported
- A positive answer cannot be justified from the accepted material.
Why the source line matters
A buyer answer is easier to review when the supporting source, date and owner can be found without reconstructing the whole evidence folder. The public sample sanitises those details; a customer pack preserves them inside the agreed case boundary.
Integrity is not truth.
The delivery archive can be checked for file changes and manifest consistency. That detects alteration after release; it does not prove that a policy was followed or that an answer is professionally assured.
Use the sample to judge the work, then scope the live request.
Civitas qualifies the product, question count, file count, deadline and transfer boundary before accepting evidence or payment.
Request scope confirmation