iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextContext not defined
Country of the organisation assessedNot provided
What it providesNot provided
Relationship with the EUNot provided
Home / Incident communication to a client

Communicating an incident to a client

Communicate verified facts without creating new commitments.

Timeline, client scope, unknowns, evidence and follow-up actions are structured without substituting for the client's legal obligations.

What your context changes

Decision to be made

To be addressed first

See the corresponding pathway →

What indicates that you are affected

  • Confirmed or suspected incident
  • European client affected or concerned
  • Follow-up questionnaire received

What weakens the client relationship

  • Assumption presented as fact
  • Conflicting messages across teams
  • Client deadline mistaken for statutory deadline
  • Untracked follow-up commitments
Decision to be obtainedA factual file, coordinated responses, a request log and assigned follow-up actions.

The conclusion distinguishes communicable facts, unknowns still open and validations expected before the next message.

Review logic

From established facts to controlled, traceable communication.

The sequence follows the verified chronology; every change to the message remains linked to a new fact and its authorisation.

01Establish

Build a verified, sourced timeline.

02Delimit

Identify services, clients and data potentially affected.

03Coordinate

Align authorised spokespeople on the facts that can be disclosed.

04Track

Track questions, announced commitments and upcoming deadlines.

Client situation room

Separate what is established, unknown and communicable.

Demonstration example
ESTABLISHED FACTS, 09:40 UTCUnauthorised access confirmed on a support account.

Log, account and period identified.

UNDER VERIFICATIONPossible access to Client A's environment.

No conclusions before correlating logs.

NEXT COMMUNICATIONFactual point validated by the authorised managers.

Unknowns and the next deadline explicitly stated.

Items to be gathered

Prepare the file before widening the review.

  • The factual timeline, the affected services and the communications already issued
  • The deadline and the associated commercial decision
  • Commitments already communicated to the parties concerned
  • The individuals able to explain how things actually work
  • The available evidence, including where it is partial
  • Exceptions, incidents or remediations already known
ENTRYThe factual timeline, the affected services and the communications already issued
VIGILANCEAssumption presented as fact

Conflicting messages across teams

DECISIONA factual file, coordinated responses, a request log and assigned follow-up actions.

Indicative timeline

During the communication window

Update the message only once new facts have been established and authorised.

H0

The incident affects or concerns a European client; contractual clocks may already be running.

H0–H24

Factual file: what is known, unknown, under verification. Nothing goes out unless it has been verified.

Communication

Structured messages, consistent across teams, with no assumption disguised as fact and no improvised commitment.

Following

Follow-up questions prepared, commitments made tracked through to fulfilment, file ready for the post-incident phase.

Consistent intervention

Support for client incident communication

Coordinate the facts, evidence and follow-up commitments vis-à-vis the client. The timeline, potentially affected services and messages already issued help frame the facts, the validations and the next client touchpoint.

Examine the scope of the engagementContact iKNSA →