Privacy and confidentiality
Placeholder text. The wording below must be reviewed and approved by GITSAB before production use.
Who is responsible for the data
GITSAB is the controller of the information submitted through this questionnaire.
What is collected
The questionnaire collects the organization profile, the estimated size of the organization, the services and systems in scope, an assessment of the current position against NIS2 risk-management measures, and the conditions for delivery. No evidence documents are requested in this version of the service.
What you must not enter
Do not enter passwords, encryption keys, private keys, recovery codes, access tokens, secret API keys, unnecessary personal data or complete sensitive incident logs.
Why the information is used
The information is used to scope, price and plan a cybersecurity engagement, and to prepare a quotation. It is not used to decide whether NIS2 applies to your organization, and it is not used to issue a certificate.
Who can see the information
The information is available to GITSAB and, where needed to deliver the engagement, to an authorised cybersecurity delivery partner. Questionnaire answers are not published and are not accessible to other users of this service.
How the information is protected
Answers are encrypted before they are stored. Access to a questionnaire requires a private link that is generated for you alone. Access logs record that a submission was made, not what it contains.
How long the information is kept
An unfinished questionnaire is kept for 30 days after the last activity. A submitted questionnaire is kept for 90 days and is then deleted or cryptographically erased, unless GITSAB has agreed a different period with you.
Your questions
If you want the information you submitted to be corrected, erased, or you want to know who has accessed it, contact GITSAB using the address on this page.
Contact
No contact address has been configured. Please use the GITSAB address you received this link from.