• Are there security measures to protect against unauthorised access?
• What’s the process for identifying and responding to security incidents?
• Have there been any security incidents in the past year, and how were they handled?