# CAIQ / SIG Lite answer stubs

**Status:** draft questionnaire stubs for ASR/VRM intake  
**Non-claim:** completing these stubs does **not** mean CyberHalluciNet has
SOC 2, ISO 27001, HIPAA, or FedRAMP certification or authorization.

| Topic | Stub answer direction | Evidence pointer |
|-------|----------------------|------------------|
| Encryption in transit | TLS for management; attacker protocols are deception faces | deploy + sensorconfig |
| Encryption at rest | Operator-controlled volumes; TTY replay encryption options | capture docs / TDD-034 |
| Access control | No shared attacker→policy authority; Ops control opt-in bearer | SEC-001, ADR 0008 |
| Logging / monitoring | One-way telemetry; privacy/secret fixture scans | SEC-004, TDD-009 |
| Vulnerability mgmt | govulncheck + controlled dependency PRs | supply-chain-baseline.md |
| Incident response | Kill-switch / quarantine runbooks | SEC-009, how-to/emergency |
| Subprocessors | Customer/operator choice; no silent cloud phone-home in sensor | plane-separation |
| Data residency | Synthetic attacker interaction; no primary PII purpose | applicability.md |

Replace stub directions with dated customer-specific answers before export.