Do you encrypt data at rest?Yes. Production data stores use encryption at rest with managed keys.
Do you perform penetration testing?Yes. External penetration testing is performed at least annually.
Do you support multi-factor authentication?Yes. MFA is enforced for administrative and portal access.
How do you manage access to production systems?Access is granted on a least-privilege basis with documented approval, periodic review, and logging of administrative activity.