iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextContext not defined
Country of the organisation assessedNot provided
What it providesNot provided
Relationship with the EUNot provided
Home / Announced supplier audit

Announced supplier audit

The audit should not be the moment you discover your gaps.

The scope, interviews, evidence and demonstrations are prepared based on what the client will actually verify.

What your context changes

Decision to be made

To be addressed first

See the corresponding pathway →
Controlled entrance to an operations centre with an audit trail prepared in the foreground
On-site observationThe auditor will see an environment, people and actions — not just policies.

Rehearsal log

Build the day rather than endure it.

The audit notice is turned into an agenda of demonstrations. Each sequence indicates the contact, the evidence, the system and the gap that remains open.

  1. Opening and scope

    Mandate, sites, services, clients and subcontractors concerned.

    Management
  2. Demonstration of identities

    Lifecycle, privileged accounts, MFA and excluded populations.

    IAM
  3. Continuity under real conditions

    Backup, restoration, dependencies and the latest approved evidence.

    Operations
  4. Execution centre journey

    Physical access, workstations, supervision and observable practices.

    Site

What must be observable

Four spaces, four forms of truth.

ACCESSWho can enter, connect and administer?

Badges, visitors, accounts, privilege elevation and audit trails.

TEAMSDo the interviews tell the same story?

Responsibilities, escalation, departures and exceptions.

PLATEFORMEDo the systems enforce what is declared?

Configuration, logs, restrictions and demonstrations.

OPERATIONSWhat happens during an incident or a failure?

Response, continuity, decisions and evidence produced.

Adversarial rehearsal

Test the answers that seem obvious.

Show the most recent full review of privileged accounts.

Verify the population included, the approvals, the date and the handling of exceptions.

Restore a backup and show the validation.

Compare procedure, actual execution, dependencies and proof of outcome.

What happens to a provider's access when they leave the engagement?

Trace the event from the HR or procurement source through to the systems concerned.

An announced audit with a scope and a deadline is already a starting point.Present the audit opinion