Example · a questionnaire in 93 Compliance
A hospital's 45-question security questionnaire, checked against the policies
Fernhollow Health, a fictional company we use for demos, sells clinic scheduling software. A hospital customer, Mercy Valley Health Network (also fictional), sent its 45-question vendor security assessment, and Marcus Oyelaran, who runs security there, imported it. On 2026-11-12 93 Compliance tested each question against the company's 8 published policies: green, yellow or red, the reason, and what it flagged. Under each one is the answer the assistant drafted from the policies, evidence documents and conversations with the team. Nothing here is made up for the page: it's the demo company's own data as of 2026-11-12, shown as it is, with the answers half done.
- IR-02 is red: the hospital wants breach notice within 72 hours, and two policies promise 10 days.
- GOV-04 is green, but the honest answer is “No”: the policy promises a yearly risk assessment that hasn't happened yet.
- HIP-04 is red: the hospital asks about AI tools, and the policies only say not to paste data into unapproved ones.
Questions
45
green · Handled
15
yellow · Partly handled
19
red · Not handled
11
Mercy Valley Health Network: Vendor Security Assessment
Tested against the published policies · drafted answers: 19 answered, 5 need you, 21 open
Governance
GOV-01Do you maintain a documented information security policy that has been approved by management and communicated to all employees? Provide policy name, version and approval date.
Partly handledAn overarching Information Security Policy exists, is CEO-approved, and references communication to the workforce, but no finding explicitly confirms all-employee acknowledgment/communication beyond named owners and review cadence.
Covered in: Information Security Policy; HIPAA Privacy and Security Policy
What the test flagged (1)
- Information Security PolicyNo explicit statement confirming the policy (and its sub-policies) has been communicated to and acknowledged by all employees, beyond the AUP's signature requirement.
Yes — Information Security Policy, version 1.2, approved by the CEO; dated 2026-09-01.
Based on: Information Security Policy · high confidence
GOV-02Is the information security policy reviewed at least annually? Provide the date of the most recent review.
HandledThe Information Security Policy and all major sub-policies require at least annual review by named owners, with CEO approval of changes.
Covered in: Information Security Policy; HIPAA Privacy and Security Policy
Yes — Reviewed at least annually by the Security Officer; current version 1.2 dated 2026-09-01.
Based on: Information Security Policy · high confidence
GOV-03Have you designated an individual responsible for information security? Provide name, title and contact details.
Partly handledMarcus Oyelaran is clearly named as Security Officer across multiple policies with defined responsibilities, but no document provides contact details (email/phone) as required by the questionnaire.
Covered in: Information Security Policy
What the test flagged (1)
- Information Security PolicyNo contact details (email or phone) are provided for the designated Security Officer anywhere in the tested documents.
Marcus Oyelaran, Head of Operations & Security (Security Officer, and HIPAA Security Officer). Need his direct contact email to complete the answer.
Based on: Information Security Policy · medium confidence
GOV-04Do you perform a formal information security risk assessment at least annually? Provide the date of the most recent assessment.
HandledBoth the Information Security Policy and HIPAA Policy require formal, written annual risk assessments performed by the Security Officer, with triggered reassessments and a documented last-completion date.
Covered in: HIPAA Privacy and Security Policy
No — No formal risk assessment has been run yet; one is planned. Policy commits to an annual assessment but this has not yet happened in practice.
Based on: Marcus Oyelaran, in chat · high confidence
GOV-05Do you hold a current SOC 2 Type 2, ISO 27001 or HITRUST certification or report? If not, state your planned date. Attach report or bridge letter if available.
Not handledNo document states current certification status, type, or a planned target date for SOC 2, ISO 27001, or HITRUST; only a vague reference to 'progress on the SOC 2 program' exists.
What the test flagged (1)
- Information Security PolicyOnly a passing mention of 'progress on the SOC 2 program' exists; no certification status, scope, or target completion date is stated anywhere.
No — Not currently certified to SOC 2, ISO 27001 or HITRUST.
Based on: Marcus Oyelaran, in chat · high confidence
GOV-06Do you carry cyber liability insurance? State the carrier, coverage limit per claim and aggregate, and policy expiry date. Mercy Valley requires a minimum of USD $5,000,000 per claim. Attach certificate of insurance.
Not handledNo document addresses cyber liability insurance, carrier, coverage limits, or policy expiry.
What the test flagged (1)
- Information Security PolicyNo document mentions cyber liability insurance at all, let alone carrier, per-claim/aggregate limits, or expiry date.
Marcus confirmed Fernhollow carries cyber liability insurance, but the carrier, per-claim/aggregate limits, and expiry date are still needed (Mercy Valley requires $5M/claim minimum). Likely held by Finance or Legal.
Based on: Marcus Oyelaran, in chat · low confidence
GOV-07Are background checks performed on all employees and contractors with access to Mercy Valley data prior to granting access? Describe scope (criminal, employment, education).
Partly handledThe Information Security Policy requires background checks before a new hire's start date, but this is undercut by a 'where permitted by local law' exception and is not cross-referenced from the AUP's access-granting language or the HIPAA policy's workforce scope.
Covered in: Information Security Policy
What the test flagged (2)
- Information Security PolicyThe 'where permitted by local law' qualifier creates an unaddressed exception scope that could leave some workforce members without background checks.
- HIPAA Privacy and Security PolicyDoes not describe background check requirements for workforce members or vendors handling PHI, despite defining them as in scope.
Policy and onboarding procedure confirm background checks run before start date, but the scope (criminal/employment/education) isn't documented. Please confirm with HR (Priya Raman).
Based on: Information Security Policy; New Hire Onboarding Procedure · medium confidence
GOV-08Do you perform automated security testing (SAST, DAST or dependency scanning) as part of your software development lifecycle? Describe tools and how findings are tracked to remediation.
Partly handledAutomated tests are required before merge to production, but no document specifies that these tests include SAST, DAST, or dependency scanning as required by GOV-08.
Covered in: Information Security Policy
What the test flagged (1)
- Information Security Policy"Automated tests" is not defined to include security-specific testing types (SAST, DAST, or dependency scanning).
No SAST/DAST/dependency scanning tooling found in current documents. Likely a gap — no software-development-policy or vulnerability-management-plan drafted yet.
Access Control
AC-01Is multi-factor authentication required for all workforce access to systems that store or process Mercy Valley data, including remote and administrative access?
HandledMultiple policies consistently require MFA for all systems and all users, with no exceptions for administrators, and specify allowed factors; remote access is covered via device trust controls.
Covered in: Access Control Policy; Information Security Policy
What the test flagged (1)
- Remote Work and Device PolicyMFA for remote access is only implied through Okta Verify prompts and Device Trust rather than explicitly stated as mandatory.
Yes — MFA required for every user on every system via Okta (push+number matching or FIDO2); SMS/voice disabled; admins require FIDO2.
Based on: Okta MFA settings (their uploaded document); Access Control Policy · high confidence
AC-02Describe your password requirements (minimum length, complexity, lockout, reuse).
Partly handledMinimum password length (14 characters) and lockout thresholds are defined in the Access Control Policy, but complexity rules and password reuse/history restrictions are not addressed anywhere.
Covered in: Access Control Policy
What the test flagged (2)
- Access Control PolicyNo explicit password reuse/history restriction is stated anywhere in the tested documents.
- Acceptable Use PolicyRestates minimum length only, without complexity, lockout, or reuse details, creating a partial/inconsistent picture across documents.
Minimum 14 characters, common-password check on, no reuse of last 5, no forced expiry (per NIST 800-63B), lockout after 10 failed attempts for 30 minutes.
Based on: Okta MFA settings (their uploaded document) · high confidence
AC-03Is access to systems granted on a least-privilege, role-based basis and approved by a manager or system owner?
HandledLeast-privilege, role-based access with manager or system owner approval is clearly defined and consistently referenced across policies.
Covered in: Access Control Policy; Information Security Policy
What the test flagged (1)
- HIPAA Privacy and Security PolicyDefers entirely to the Access Control Policy without restating the approval process for PHI-specific access, though this is a minor gap given the referenced policy is strong.
Yes — Access granted on least privilege, role-based basis, approved by system owner; privileged access additionally needs Security Officer approval.
Based on: Access Control Policy · high confidence
AC-04How often are user access rights reviewed for systems containing Mercy Valley data? Provide evidence of the most recent review. Mercy Valley expects at least quarterly review of privileged and PHI-system access.
Partly handledThe Access Control Policy commits to quarterly reviews of privileged/key systems as Mercy Valley requires, but the Information Security Policy contradicts this by stating reviews are annual.
Covered in: Access Control Policy
What the test flagged (2)
- Information Security PolicyStates access reviews are annual, directly contradicting the Access Control Policy's quarterly commitment.
- HIPAA Privacy and Security PolicyStates no specific frequency for PHI-system access review, fully deferring to the Access Control Policy.
Yes — Quarterly reviews per Access Control Policy v1.2; most recent completed 2026-10-16 covering AWS, Google Workspace, GitHub, Okta and Zendesk, including privileged and service accounts.
Based on: 2026 Q3 access review summary (their uploaded document) · high confidence
AC-05Within what timeframe is access revoked when an employee or contractor is terminated?
HandledAccess is revoked the same day a workforce member leaves, with immediate removal for involuntary terminations, consistently stated across policies.
Covered in: Access Control Policy; Information Security Policy
What the test flagged (1)
- Remote Work and Device PolicyThe 10-business-day equipment return window could be confused with access revocation timing, though it only concerns physical device wipe, not account access.
Access removed the same day; for involuntary terminations, before or during the termination meeting.
Based on: Access Control Policy · high confidence
AC-06Is privileged access to production environments (e.g. database administrator, cloud root/admin) restricted, time-limited and logged?
HandledPrivileged production access, including for PHI databases, is time-limited, logged and restricted with no standing access, meeting the requirement.
Covered in: Access Control Policy; Remote Work and Device Policy
Yes — No standing access to production PHI databases; time-limited (4-hour) just-in-time access via AWS IAM Identity Center, logged in CloudTrail. Privileged access needs written Security Officer approval.
Based on: Access Control Policy · high confidence
AC-07Are endpoints (laptops) used to access Mercy Valley data centrally managed, encrypted and required to meet a security baseline before access is allowed?
Partly handledLaptops are centrally managed, encrypted, and enforce a security baseline via Jamf, but no policy clearly states that baseline compliance is actively verified before granting access to Mercy Valley data/systems.
Covered in: Remote Work and Device Policy
What the test flagged (3)
- Acceptable Use PolicyOnly prohibits tampering with controls; does not state a baseline check gates access.
- HIPAA Privacy and Security PolicyStates laptops must not store PHI rather than describing baseline enforcement for systems that access PHI.
- Remote Work and Device PolicyDoes not explicitly state that non-compliant devices are blocked from authentication/access (e.g., via conditional access tied to Jamf compliance status).
No answer drafted yet.
Encryption
ENC-01Is Mercy Valley data, including PHI, encrypted at rest? State the algorithm and key length.
HandledData at rest, including PHI, is encrypted with AES-256 via AWS KMS, consistently stated across the Information Security Policy and HIPAA policy.
Covered in: Information Security Policy; HIPAA Privacy and Security Policy
No answer drafted yet.
ENC-02Is all data in transit encrypted using TLS 1.2 or higher, including internal service-to-service traffic?
Partly handledTLS 1.2+ is required for data in transit, but no document explicitly confirms this covers internal service-to-service traffic as Mercy Valley's requirement specifies.
Covered in: Information Security Policy; HIPAA Privacy and Security Policy
What the test flagged (2)
- Information Security PolicyDoes not explicitly state whether internal service-to-service traffic is included in the TLS 1.2+ requirement.
- HIPAA Privacy and Security PolicySame gap regarding internal traffic scope.
No answer drafted yet.
ENC-03Describe your encryption key management: who can access keys, where they are stored and how often they are rotated.
Partly handledKey rotation frequency is stated, but no document describes who can access encryption keys or where they are stored beyond implying AWS KMS.
Covered in: HIPAA Privacy and Security Policy; Information Security Policy
What the test flagged (2)
- Information Security PolicyDoes not describe who can access keys or storage/access control details.
- HIPAA Privacy and Security PolicyDoes not specify which roles or systems can access keys.
No answer drafted yet.
Logging
LOG-01Do you log access to and changes of PHI at the application level (who, what, when)? How long are these logs retained? HIPAA 164.312(b).
Partly handledApplication-level audit logging of PHI access and changes with 6-year retention is well described in the HIPAA policy, but it conflicts with the Data Retention and Disposal Policy's 1-year retention for application logs.
Covered in: HIPAA Privacy and Security Policy
What the test flagged (1)
- Data Retention and Disposal PolicyStates application logs are retained for only 1 year, contradicting the HIPAA policy's 6-year retention for PHI audit logs; it's unclear if these refer to the same logs.
No answer drafted yet.
LOG-02Are infrastructure and administrative activity logs (e.g. cloud audit logs) collected centrally and protected from modification?
Partly handledAdministrative and infrastructure logs are centrally collected via CloudTrail, but no document states these logs are protected from modification.
Covered in: Information Security Policy
What the test flagged (2)
- Information Security PolicyDoes not state that logs are protected from modification (e.g., immutability, restricted write access, or separate security account controls).
- Data Retention and Disposal PolicyOnly states retention period, with no mention of tamper protection for CloudTrail logs.
No answer drafted yet.
LOG-03Are security logs monitored for suspicious activity 24x7? Describe alerting and who responds out of hours.
Not handledNo document establishes 24x7 security log monitoring and alerting, so this Mercy Valley requirement is not met.
What the test flagged (1)
- No policy addresses continuous (24x7) monitoring of security logs, alerting thresholds, or after-hours response procedures.
No answer drafted yet.
LOG-04What is your retention period for security and audit logs? Mercy Valley requires a minimum of 1 year online.
Partly handledMultiple documents set a log retention period that meets or exceeds the 1-year minimum, but there is ambiguity between the 1-year and 6-year figures and no confirmation that logs remain online/searchable for the full period.
Covered in: Information Security Policy; HIPAA Privacy and Security Policy; Data Retention and Disposal Policy
No answer drafted yet.
Incident Response
IR-01Do you have a documented incident response plan that defines roles, severity levels and escalation timelines? Attach plan or table of contents.
HandledThe Incident Response Policy documents a defined incident response plan with stages, and related policies consistently reference it for escalation.
Covered in: Incident Response Policy
What the test flagged (1)
- Incident Response PolicyFindings do not explicitly confirm that defined severity levels and escalation timelines (beyond stage names) are fully spelled out within the policy itself; other documents only defer to it.
No answer drafted yet.
IR-02Within what timeframe will you notify Mercy Valley of a confirmed or suspected security incident affecting Mercy Valley data? Mercy Valley's standard is notification within 72 hours of discovery.
Not handledFernhollow's documented customer notification commitment (10 days, up to 60 days) directly conflicts with Mercy Valley's required 72-hour notification window.
Covered in: Vendor Management Policy
What the test flagged (3)
- Incident Response PolicyStates customer notification occurs within 10 calendar days (up to 60 days), which does not meet Mercy Valley's 72-hour requirement.
- HIPAA Privacy and Security PolicyRepeats the 10-day/60-day customer notification commitment, confirming the conflict with Mercy Valley's 72-hour standard.
- Information Security PolicyOnly addresses internal escalation within 1 hour; no customer-facing notification timeframe is stated.
No answer drafted yet.
IR-03Is the incident response plan tested at least annually (e.g. tabletop exercise)? Provide the date of the last test.
HandledThe Incident Response Policy requires an annual tabletop exercise that includes a PHI breach scenario, satisfying the requirement.
Covered in: Incident Response Policy
No answer drafted yet.
IR-04Have you experienced a security incident or breach involving customer data in the past 36 months? If yes, describe.
Partly handledPolicies describe a mechanism for tracking and disclosing breaches, but no document provides an actual disclosure statement about whether an incident occurred in the past 36 months.
Covered in: HIPAA Privacy and Security Policy
What the test flagged (1)
- All documentsNo document contains an actual disclosure of whether a security incident or breach involving customer data occurred in the past 36 months; this is a factual disclosure, not a policy statement.
No answer drafted yet.
IR-05How often do you engage an independent third party to perform penetration testing of the application and infrastructure? Provide the date and summary of the most recent test. Attach executive summary and remediation status of high/critical findings.
Not handledNo document describes an independent third-party penetration testing program, nor provides dates or summaries of any test performed.
What the test flagged (2)
- Incident Response PolicyOnly references attacker scenarios as examples for severity classification; this is not evidence of actual penetration testing.
- All documentsNo document establishes a penetration testing program, cadence, independent third-party engagement, or provides a date/summary of a most recent test.
No answer drafted yet.
Vendors
VEN-01Do you have a documented third-party risk management program for vendors that access or process Mercy Valley data?
HandledThe Vendor Management Policy establishes a tiered, documented third-party risk management program covering onboarding, contractual requirements, and ongoing review.
Covered in: Vendor Management Policy; Information Security Policy
No answer drafted yet.
VEN-02Provide a list of all subprocessors that will store, process or access Mercy Valley data, including their location and the services they provide. Mercy Valley must be notified 30 days before a new subprocessor is added.
Not handledNo document provides a subprocessor list or a commitment to notify customers 30 days before adding a new subprocessor.
What the test flagged (1)
- All documentsNo document maintains or references a subprocessor list with location and services, nor a 30-day advance notification commitment for new subprocessors.
Current Critical vendors handling data: AWS (hosting/database/storage, ca-central-1 & us-east-1, BAA signed 2025-02-10) and Twilio (SMS/voice reminders, US, BAA signed 2025-02-24). Have not yet confirmed a published 30-day advance-notice commitment for new subprocessors in the policy text - flagging as a gap to close.
Based on: Vendor Management Policy · medium confidence
VEN-03Do you require subcontractors that handle PHI to sign a Business Associate Agreement?
HandledMultiple consistent policies require a signed Business Associate Agreement before any PHI is shared with a subcontractor or vendor.
Covered in: Vendor Management Policy; Information Security Policy; HIPAA Privacy and Security Policy
Yes — Any vendor that creates, receives, stores or sends PHI must sign a BAA before any PHI is shared; no exceptions allowed.
Based on: Vendor Management Policy · high confidence
VEN-04How often are critical vendors reassessed, and what evidence do you collect (e.g. SOC 2 reports)?
Partly handledCritical and High vendors have defined periodic reassessment with SOC 2 evidence collection, but Medium/Low vendor frequency is undefined and another policy gives an inconsistent annual-for-all description.
Covered in: Vendor Management Policy
What the test flagged (2)
- Vendor Management PolicyNo defined reassessment frequency for Medium and Low tier vendors.
- Information Security PolicyStates all vendors with customer data access are reviewed annually, without mentioning tiers or SOC 2 evidence collection, creating inconsistency with the Vendor Management Policy's tiered approach.
No answer drafted yet.
VEN-05Do you maintain a software bill of materials (SBOM) for the application delivered to Mercy Valley, and can you provide it on request? SPDX or CycloneDX format preferred.
Not handledNo document addresses maintaining or providing a software bill of materials (SBOM).
What the test flagged (1)
- No policy mentions an SBOM, its format, or a process to provide it to customers on request.
No answer drafted yet.
HIPAA
HIP-01Will you sign Mercy Valley's Business Associate Agreement? If you require your own form, attach it.
HandledFernhollow has a clear, strong commitment to signing BAAs with customers, including willingness to use a customer's own form with approval.
Covered in: HIPAA Privacy and Security Policy; Information Security Policy
Commercial/legal decision on whether to sign Mercy Valley's own BAA form vs. offering Fernhollow's standard BAA - needs Marcus or Legal to confirm.
HIP-02Have you designated a HIPAA Security Officer and a Privacy Officer? Provide names.
HandledBoth a HIPAA Security Officer (Marcus Oyelaran) and a Privacy Officer (Grace Liu) are explicitly named in multiple policies.
Covered in: HIPAA Privacy and Security Policy; Information Security Policy
Marcus Oyelaran is the HIPAA Security Officer; Grace Liu is the Privacy Officer.
Based on: Information Security Policy; Their website (privacy page) · high confidence
HIP-03Describe which PHI data elements your service will store, and whether any PHI is included in SMS, email or voice reminders sent to patients.
Partly handledThe PHI data elements stored are clearly described, but the policies do not clearly state whether PHI appears in SMS, email, or voice reminders sent to patients.
Covered in: HIPAA Privacy and Security Policy
What the test flagged (1)
- HIPAA Privacy and Security PolicyDoes not explicitly confirm or deny whether PHI is included in SMS, email, or voice reminder content sent to patients, which the requirement specifically asks about.
PHI stored: patient names, phone numbers, email addresses, appointment dates/times, provider names, clinic locations and reason for visit. Reminders sent by SMS, voice or email contain only first name, clinic name and appointment time - reason for visit is never included in any reminder.
Based on: HIPAA Privacy and Security Policy; Their website (privacy page) · high confidence
HIP-04Do you use artificial intelligence or machine learning tools (including third-party large language model services) that process, store or are trained on Mercy Valley PHI? If yes, describe the tools, the data involved and the safeguards. Include any AI features in the product and any internal use of AI tools by your staff.
Not handledOnly a restriction on pasting sensitive data into unapproved AI tools exists; there is no disclosure of specific AI/ML tools, data involved, safeguards, or AI features within the product.
Covered in: Acceptable Use Policy
What the test flagged (2)
- Acceptable Use PolicyDoes not name which AI/ML tools (including LLM services) are approved, what data they process, or what safeguards apply.
- No document discloses whether the product itself contains AI/ML features that process PHI.
No answer drafted yet.
HIP-05Where will Mercy Valley PHI be stored and processed (country and region)? Will any PHI be accessed from outside the United States? Mercy Valley requires all PHI to remain in the United States.
Not handledDocuments consistently show PHI is stored across both a Canadian region (ca-central-1) and a US region (us-east-1), and disaster recovery copies' location is unclear, directly conflicting with Mercy Valley's requirement that all PHI remain in the United States.
Covered in: Information Security Policy
What the test flagged (4)
- Data Retention and Disposal PolicyStates PHI production systems span both AWS ca-central-1 (Canada) and us-east-1 (US), without clarifying that Mercy Valley's specific PHI stays only in the US.
- Vendor Management PolicyAddresses only Canadian PHI residency, not the US-only requirement Mercy Valley needs confirmed.
- Information Security PolicyDoes not confirm whether disaster recovery copies of US PHI remain within the United States, leaving a residency gap.
- HIPAA Privacy and Security PolicyDoes not explicitly state that US customer PHI remains exclusively within the United States or whether PHI is ever accessed from outside the US.
No answer drafted yet.
BCP/DR
BCP-01Do you have a documented business continuity and disaster recovery plan? When was it last tested?
Partly handledAn annually tested business continuity/disaster recovery plan is documented, but no date of the last test is provided as the requirement specifically asks for.
Covered in: Information Security Policy
What the test flagged (2)
- Information Security PolicyNo date of the last test is provided.
- HIPAA Privacy and Security PolicyAlso describes an annual test but gives no specific last-test date.
No answer drafted yet.
BCP-02State your recovery time objective (RTO) and recovery point objective (RPO) for the service.
Not handledNo document defines a recovery time objective (RTO) or recovery point objective (RPO).
What the test flagged (1)
- RTO and RPO values are not stated anywhere in the policy set.
RPO: 5 minutes using point-in-time recovery, 24 hours using daily recovery points. RTO: 8 hours.
Based on: AWS backup configuration (their uploaded document) · high confidence
BCP-03How often are backups taken, how long are they retained, and are they stored in a separate location from production?
Partly handledBackup retention (35 days) and separate-region disaster recovery copies are documented, but backup frequency is not explicitly stated and the daily backup claims in other policies aren't tied to the retention figure.
Covered in: Data Retention and Disposal Policy; Information Security Policy
What the test flagged (2)
- Data Retention and Disposal PolicyDoes not explicitly state backup frequency, only retention and DR region copies.
- HIPAA Privacy and Security PolicyMentions daily backups but does not state retention period or separate storage location.
Yes — Daily backups, 35-day retention, cross-region copy within the same country (ca-central-1→ca-west-1, us-east-1→us-west-2), separate from production.
Based on: AWS backup configuration (their uploaded document) · high confidence
BCP-04How often do you test restoring data from backups? Provide the date and result of the most recent test.
Partly handledThe policy commits to quarterly backup restoration testing, but no document provides the date or result of the most recent test, which the requirement explicitly asks for.
Covered in: Information Security Policy
What the test flagged (2)
- Information Security PolicyNo date or result of the most recent restoration test is recorded or referenced.
- Data Retention and Disposal PolicyMentions disaster recovery copies but does not address restoration testing at all, so there is no corroborating evidence of actual tests performed.
Tested quarterly. Most recent: 2026-09-17, pass, restore time 47 min (CA) / 52 min (US).
Based on: AWS backup configuration (their uploaded document) · high confidence
Training
TRN-01Do all employees and contractors complete security awareness training upon hire and at least annually?
HandledSecurity awareness and HIPAA training is required within 30 days of hire and annually for all workforce members, satisfying the requirement.
Covered in: Information Security Policy; HIPAA Privacy and Security Policy
Yes — New hires complete security awareness and HIPAA training within 30 days of start; all workforce repeat annually.
Based on: Information Security Policy; Security training 2026 roster note (their uploaded document) · high confidence
TRN-02Do all workforce members with access to PHI complete HIPAA training? Provide your completion rate for the current year.
Partly handledHIPAA training is required for all workforce members within 30 days of hire and annually, and completion is tracked in a system, but no current-year completion rate is provided and training is not explicitly scoped to those with PHI access.
Covered in: HIPAA Privacy and Security Policy
What the test flagged (2)
- HIPAA Privacy and Security PolicyNo current-year completion rate is provided, as the requirement specifically asks for.
- Information Security PolicyTraining applies broadly to 'all workforce members' rather than specifically confirming coverage of those with PHI access.
No answer drafted yet.
TRN-03Do you conduct simulated phishing exercises? How often?
Not handledNo document addresses simulated phishing exercises at any frequency.
What the test flagged (1)
- No policy mentions simulated phishing exercises, frequency, or responsible owner.
No answer drafted yet.
TRN-04Do employees sign an acceptable use policy and confidentiality agreement before receiving access?
HandledEmployees are required to sign both the Acceptable Use Policy and a confidentiality agreement before receiving system access.
Covered in: Information Security Policy; Acceptable Use Policy
What the test flagged (1)
- Acceptable Use PolicyDoes not itself mention the confidentiality agreement, relying on the Information Security Policy for that element; minor cross-document inconsistency in completeness but not contradictory.
Yes — Every workforce member signs the Acceptable Use Policy before receiving access, and re-signs within 14 days of a new version.
Based on: Acceptable Use Policy · high confidence
Each question is tested against the company's published policies. Green, handled: a policy commits to what the customer asks, specifically. Yellow, partly handled: a policy covers it, but vaguely, incompletely or not to the customer's standard. Red, not handled: no policy covers it, or a policy contradicts what the customer requires. The grey box is what the assistant drafted for the customer: Answered, Needs you (it needs a fact only the company has) or Open (not reached yet). The two can disagree, and that is the point: an answer can rest on an evidence document no policy mentions yet, and a policy can promise what the company hasn't done yet. When the answers are done, the spreadsheet downloads back in the customer's own format, filled in.
Import your own questionnaire
Upload the customer's spreadsheet. 93 Compliance answers from your policies and documents, asks you about the rest, and hands the spreadsheet back filled in.
Start free