TrustDesk
Synthetic demo data
Back to workspace

Sterling Government Solutions

Overdue

qn-003 · Public Sector

Deal stage
New Logo
Deal value
$2,100,000
Questions
6
Received
May 4, 2026
Due
May 28, 2026 (4d overdue)
Vulnerability Management · q-011

Provide details on your vulnerability management and penetration testing cadence.

95confidence
Auto-Approved
Drafted response

Continuous scanning runs across production and build pipelines, with independent third-party penetration tests at least annually; an executive summary is available under NDA.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived4/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse3/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Routed toAuto-Approved

Why this verdict

  • Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.
Vulnerability Management · q-012

What are your patch remediation SLAs and how are they tracked?

70confidence
Needs Review
Drafted response

Patches are prioritized by severity; critical issues are remediated within defined SLA windows, tracked to closure, and reported to security leadership.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived0/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse3/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toSecurity SME

Why this verdict

  • Capped at Needs Review: mapped evidence is expired, overriding a numeric score of 70. A confident answer on stale evidence is still a stale answer.
Access Control & Identity · q-013

Describe access provisioning, review, and deprovisioning controls.

100confidence
Auto-Approved
Drafted response

Access is provisioned through approved requests under least privilege, reviewed quarterly, and revoked promptly on role change or offboarding.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived4/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse4/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toAuto-Approved

Why this verdict

  • Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.
AI & Model Governance · q-014

How does your AI functionality use customer data, and is it used for model training?

78confidence
Needs Review
Drafted response

AI features operate under a documented governance program with human oversight; customer data is not used to train shared or third-party foundation models without explicit consent.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived2/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language3/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse3/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toLegal

Why this verdict

  • Capped at Needs Review: AI & Model Governance carries legal/privacy exposure and always requires human sign-off, regardless of the 78 confidence score.
  • Evidence Freshness is below target (2/4).
Compliance & Certifications · q-015

Confirm SOC 2 Type II and ISO 27001 certifications and availability of reports.

100confidence
Auto-Approved
Drafted response

We maintain a SOC 2 Type II report and ISO/IEC 27001 certification; reports and certificates are available under NDA via the trust portal.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived4/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse4/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Routed toAuto-Approved

Why this verdict

  • Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.
Incident Response · q-016

What are your contractual breach notification timelines?

75confidence
Suggested
Drafted response

Customers are notified of confirmed breaches affecting their data without undue delay and within the timelines defined in the applicable agreement and regulation.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived2/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language3/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse3/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity3/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toSecurity Enablement

Why this verdict

  • Evidence Freshness is below target (2/4).