# Security Questionnaire Baseline — Advisory Engagement

**Status:** public baseline. Contract-specific answers and evidence must be supplied in the controlled packet.

| Topic | Baseline position | Evidence on request |
|---|---|---|
| Access | Named principal access, least privilege, MFA, no shared credentials | Access roster and client-tenant audit log |
| Data | No production personal data required by default | Signed no-personal-data attestation |
| Storage | Client-tenant first; local working copies minimized | Data-flow and approved-location record |
| Transfer | Encrypted transport; no public consumer-AI submission | Tool and transfer inventory |
| Subcontracting | No undisclosed specialist receives client material | Named specialist approval record |
| Incident | Notify through the client-named channel without unreasonable delay | Engagement incident contacts |
| Closeout | Return or destroy local working copies | Written destruction certification |
| Continuity | Decisions, sources and deliverables maintained in the client workspace | Current decision and deliverable register |