iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextContext not defined
Country of the organisation assessedNot provided
What it providesNot provided
Relationship with the EUNot provided
Home / Trust & firm

Trust & firm

Data processing

Collect only what is necessary for the qualification, delivery and evidencing of the engagement.

Limit data to the mandate

Collection starts from the decision to be made and excludes information that improves neither qualification, nor verification, nor reporting.

An assurance engagement does not need to cover the entire information system. It favours metadata, extracts, samples and demonstrations wherever these are sufficient to reach the conclusion.

Data without a purpose does not enter

Production credentials, secrets and complete datasets stay out of the initial exchange when an extract, metadata or a demonstration will do.

Minimisation cycle

Each piece of data collected must retain a justifiable purpose and retention period.

01

No secrets or production identifiers in the initial form

02

Classification and restrictions

03

Retention linked to purpose

04

Deletion and export tracked

Putting into practice

Link each piece of data to its purpose and retention period.

Qualify

Name the category, source, purpose and restrictions before processing.

Minimise

Choose the extract, sample or demonstration sufficient for the conclusion.

Retain

Link the availability period to the engagement, the contract and the decisions still open.

Return

Export what needs to be exported, then delete or isolate what no longer serves a purpose.

Checkpoints

01

Category

Nature of the data and level of sensitivity.

02

Purpose

Mission question that the processing must support.

03

Access

Authorised people, locations and systems.

04

Duration

Deadline for review, return or deletion.

Engagement data cycle

Keep a purpose and a deadline for each category collected.

The file links relevant data to its source, the authorised individuals and its retention period; the absence of a purpose triggers a decision to return, isolate or delete it.

Read the processing rules →
European client → Contract → Requirement
Promise → Policy → Practice → Platform
Evidence → Verification → Exception
Technical drift → Affected commitment
Remediation → Residual risk → Deadline

Preliminary exchange

Define the data actually needed for the mandate.

Identify the data categories, purposes, countries of access and retention periods before opening a workspace.

Ask a question