Hi Devin Harris here I'm a senior analyst on the field security team here at gitlab today, I want to walk through using the customer questionnaire first-pass board and try to keep this under five minutes. So we're going to go really fast share my screen here. Alright to get there we're gonna go to the get logged, comm project security department, the security department, we're gonna, go down to the security assurance team.

Security assurance from security assurance we're going to the field security team and then the security questionnaire first passport right here. Alright, the readme will talk about how to use the board. I can cover that in another time or I haven't covered that today. The main thing you want to cover is the issue board, because that's where the real magic happens here, you can see the list of questions using the board. Just display, unfiltered is probably not advisable, probably won't help much when it comes to doing what you want to do.

The way I would have been using. It is if you're, on the call with a customer or filling out a customer security questionnaire, and you have a specific question. So, let's search for antivirus, let's say you get a question about antivirus, so we have one question that matches that. Do you enforce anti-malware on all get lot of control user devices, and we can talk about our answer here feel free to comment down here, tag, people and ask questions if you find something useful and you use it in the response.

Please give me a thumbs up that way know if it's useful, if not, leave a thumbs down and a comment. Let me know what what needs to change, but I really want to aggregate which switch these are being most useful and how we're using them coming back to the board we do have boards, and the only board we have right now is scopes will probably create more time all environments get logged, comm, self-hosted and unscoped feel free to use those.

If there's a board that you feel it's helpful, just go ahead and create it they're easy to do. Labels are really important here and as if this repository grows, we use labels so feel free to use labels in here.

The last thing I want to go over real quick is creating a new question answer pair. So if you go to create a new issue, just choose the new Q&A pair template.

This top line here is for creating the title question. Identifier would be something like a cig numbering scheme for a question. If you don't have one, don't put it just start with questions, it can be the whole question or a summary of the question.

If you have the answer and it's correct and you can point to something put verified otherwise do unverified and then enter the date. The last day, the question was touched, we're going to paste in the entire question here and then the answer, if you're filling out a questionnaire- and it has multiple answers we can select- you can put those in is like checkboxes and put like choose- want to answer them.

Let's put an answer owner that can be a group or a person just a get lab handle that way. We know who to go to to maintain the question and then any notes that support the answer. No experiment for the customer, they're meant for us. So if there's a question, the customer would likely want to see a mansur. That said yes to, and it said no, um the notes might want to support why that is so. No, we don't do what you're asking for, but we have other controls in place.

Here's what they are or no, not yet, but this feature will be released and upcoming release now feel free to throw that their references. We can point a hand book really anything relevant to help. Somebody understand any of the context and the question. The answer are the answer. Those tags um I just have some default tags populated. You can delete these at anything. You want. Really. These are meant to be keywords. I might actually change that name to keywords, just something that helped somebody search and find the answer that they're looking for.

If you do a question and answer, you don't have to assign it to anybody. But if you do a question- and you don't have the answer please assign to somebody- you want to chase it down if it's security related that'll, be my team filled security and that's a very, very quick introduction to how to use the security questionnaire. First, Passport um I hope to engage with your team more about this in the near future. Have a great day all mine.