ACA SOFTWARE SECURITY QUESTIONNAIRE
Vendor / service / product version / review date / intended data categories:
Data path / downstream providers / support attachment locations:
QUESTION ROW
Question | vendor response | service scope | evidence type | period covered | limitation | customer responsibility | internal reviewer | disposition
ACCESS: roles / employer scope / support access / access removal / export permissions.
AUTHENTICATION: available controls / enforced controls / customer configuration / integration identities.
DATA HANDLING: transfer / storage / attachments / generated outputs / downstream providers.
RETENTION: active records / backups / support files / deletion evidence / restoration effect.
RECOVERY: commitments / relevant test record / actual limitations.
INCIDENTS: contacts / communication process / contractual responsibilities.
FICTIONAL CLARIFICATION
Active upload deletion 30 days; backup aging 90 days; difference 60 days.
Clarify covered data categories and access, do not summarize both as 30 days.
IMPLEMENTATION CONDITIONS
Setting or evidence required / owner / verification / unresolved decision: