Infrastructure, application inventory, cyber posture, security incidents.

• VIII.1

  Obtain application inventory with licence type, user count and renewal date.

  Severity B
• VIII.2

  Identify any SaaS or licensing true-up exposure.

  Severity B
• VIII.3

  Review infrastructure topology: cloud accounts, on-prem, hybrid.

  Severity B
• VIII.4

  Confirm Cyber Essentials Plus or ISO 27001 certification status.[NCSC CE]

  Severity B
• VIII.5

  Obtain most recent penetration-test report and remediation evidence.

  Severity A
• VIII.6

  Review security-incident log for the last three years and ICO notifications.

  Severity A
• VIII.7

  Confirm backup, BCP and DR test history.

  Severity B
• VIII.8

  Test password, MFA and privileged-access controls on a sample.

  Severity B
• VIII.9

  Review identity / SSO architecture and joiner-mover-leaver cadence.

  Severity B
• VIII.10

  Confirm cyber-insurance cover and any exclusion for prior incidents.

  Severity B
• VIII.11

  Identify open-source software dependencies and any GPL-style licensing risk.

  Severity B
• VIII.12

  Confirm software-development lifecycle: code review, SCA, SAST, DAST.

  Severity C
• VIII.13

  Review hosting locations and data-residency commitments.

  Severity B
• VIII.14

  Obtain SOC 2 Type II report (or evidence in-scope alternative).

  Severity B
• VIII.15

  Confirm vendor-risk-management process for third-party services.

  Severity C
• VIII.16

  Identify any pending IT-modernisation capex in the forecast.

  Severity C
• VIII.17

  Confirm shadow-IT discovery and any unmanaged sanctioned tools.

  Severity C
• VIII.18

  Review historic security incidents impacting customers and notifications.

  Severity A