Helios Energy

On Track

qn-005 · Energy & Utilities

Deal stage: New Logo
Deal value: $640,000
Questions: 5
Received: May 21, 2026
Due: Jun 10, 2026 (9d)

Encryption & Data Protection · q-022

Describe encryption in transit for all external integrations.

100confidence

Auto-Approved

Drafted response

All data in transit is protected using TLS 1.2 or higher, with legacy protocols disabled and HSTS enforced on public endpoints.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse4/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

SEC-ENC-002Encryption in TransitCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.

Access Control & Identity · q-023

What identity federation and MFA standards do you enforce?

95confidence

Auto-Approved

Drafted response

Workforce access is federated through SSO with MFA enforced for all access and phishing-resistant factors required for privileged roles.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse3/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

SEC-IAM-011MFA & Single Sign-OnCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.

Incident Response · q-024

Describe your incident response plan and testing cadence.

91confidence

Auto-Approved

Drafted response

A documented IR plan defines roles, severity tiers, and escalation paths, and is tested at least annually through tabletop exercises with post-incident reviews.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language3/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse3/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

SEC-IR-020Incident Response PlanCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.

Encryption & Data Protection · q-025

How are encryption keys rotated and who has access to them?

84confidence

Suggested

Drafted response

Keys are managed in a hardware-backed KMS, rotated at least annually and on personnel change, with access restricted by least privilege.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived2/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse4/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity3/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

SEC-KMS-004Key Management & RotationExpiring Soon

Routed toSecurity Enablement

Why this verdict

Evidence Freshness is below target (2/4).

Business Continuity & Resilience · q-026

Is there a documented business continuity plan with RTO/RPO targets?

100confidence

Auto-Approved

Drafted response

Yes. BC/DR plans define RTO and RPO targets, are tested at least annually, and use geographically redundant infrastructure with validated backups.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse4/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

BC-DR-070Business Continuity & Disaster RecoveryCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.