Questionnaire answers by question ID, with the no rows shown.
When a client sends a security questionnaire, many of the access, logging and change questions have an answer in a record Opafra already wrote. The answers below are keyed to the question IDs in CSA’s CAIQ v4.0.3 and paraphrased, and they include the questions Opafra does not answer.
48 questions read. 20 shown here.
We read the questions in CAIQ v4.0.3 that touch access, logging, change, backup and vulnerability management, in September 2026. Opafra answers 7 in full, 21 in part and 20 not at all. The rows below are the ones where the answer turns on a record. The wording is paraphrased because the questionnaire may not be redistributed. The NIS2 page sets out the rule behind the security questions.
7 questions
Yes, from the record
The answer is a record Opafra writes, for work that goes through Opafra.
| Question | What the record gives |
|---|---|
| IAM-10.1Is privileged access granted only for a limited period? | A grant can carry an expiry and ends on its own. On a server set up for certificates, each connection uses one that lasts five minutes. The access record shows both. |
| IAM-13.1Can each user be identified uniquely? | Every run and connection is tied to a named person in a named organization. On a certificate server, the certificate's key ID names the organization and the server, so the server's own log says who connected. |
| IAM-14.1Is multi-factor authentication required? | Sign-in to Opafra uses multi-factor authentication, and SSH access uses per-person, five-minute certificates. |
| IAM-14.2Are digital certificates used for system identities? | Each organization has its own SSH certificate authority, and its certificates are signed from that authority, not a shared one. |
| LOG-08.1Are audit records generated, with relevant security information? | Runs, approvals, grants, sign-ins, role changes and exports are written to the audit log with who, what and when. |
| LOG-09.1Are audit records protected from unauthorized access, change and deletion? | For Opafra's own records, yes: the database refuses to change or delete an audit entry. Logs on your own servers are outside it. |
| CCC-02.1Is a defined change process with approval and testing followed? | For changes run through Opafra, yes. Each run records the plan revision, the approver, the dry run per host and the outcome. |
7 questions
Partly
The record is part of the answer. The rest is a policy, a document or a system Opafra does not see.
| Question | What the record gives, and what it does not |
|---|---|
| IAM-03.1Are access levels managed, stored and reviewed? | Roles and grants inside Opafra are listed and can be reviewed. Accounts that exist on your servers are not seen. |
| IAM-04.1Is separation of duties applied? | Requester and approver are both recorded, and an access request cannot be approved by the person who made it. Self-approval of runs can be blocked, and the record flags any that are allowed. Separation of duties outside Opafra is your policy. |
| IAM-08.1Are user access reviews completed at a suitable frequency? | The access review lists everyone with access to an environment, the decision for each person, the reviewer, the date and the changes made. Reviewing accounts on your servers is outside it. |
| IAM-11.1Do customers take part in granting high-risk privileged access? | The approval is recorded with the approver's name. When your client holds an approver seat, the client approves on its own servers. Access that does not go through Opafra is not covered. |
| BCR-06.1Are continuity plans exercised and tested yearly? | The restore test is one exercise and is recorded each time it runs, with its result. The plan itself is your document. |
| BCR-10.1Is the disaster recovery plan exercised yearly? | The restore test records the result and the time to restore. The recovery plan is your document, not Opafra's. |
| TVM-03.1Are vulnerabilities responded to on a schedule and in emergencies? | Patch runs and their deadlines are recorded, and so is the reason when a patch is skipped. Opafra does not scan for vulnerabilities. |
6 questions
No, not from Opafra
These are the rows where the honest answer is no, or where the answer is a document and not a record.
| Question | Why not |
|---|---|
| CCC-09.1Is there a process to roll changes back to a known good state? | Plans and scripts roll back to an earlier revision, but reverting what a run did on a server is not built. |
| LOG-03.1, LOG-05.1Are unusual security events detected and alerted on? | No. The audit log exports as CSV or NDJSON and can be polled over the API by a SIEM, which is where detection happens. |
| LOG-06.1Is a reliable time source used for log entries? | Not stated yet. The time source for log entries is not published, so this one is not answered from the record. |
| TVM-07.1Is vulnerability detection run at least monthly? | No. Opafra does not scan your servers. |
| CCC-01.1Is there a written change management policy? | No. A policy is a document you write. Opafra produces the records the policy refers to. |
| IAM-01.1Is there a written identity and access management policy? | No. The same applies: the policy is yours, and the access record is the evidence it was followed. |
Answer the whole form yourself.
A yes here is a yes for work done through Opafra. It says nothing about systems that do not run through it, and it is evidence for an answer, not a statement that anyone meets a requirement. Each answer points at a record on the evidence page.
Security questions that this page does not cover go to the contact on the security page.
Send us your questionnaire.
Name the template your clients use. You get a demo and your price in writing within one business day, with no call.