Enterprise Security & GRC Review

Template Overview

Closing high-value enterprise contracts hinges on passing rigorous security and governance, risk, and compliance (GRC) evaluations. The Enterprise Security & GRC Review template provides a structured format for sales engineers and security architects to document prospect threat model inquiries, compliance certifications, and air-gapped guarantees in Markdown.

Markdown Template Structure

Copy the block below or click Download .md File to add this template directly to your personal vault:

---
title: "Security & GRC Review: [[Customer Organization]]"
date: [YYYY-MM-DD]
sales_engineer: "[[Lead Solutions Architect]]"
account_executive: "[[Enterprise AE Name]]"
prospect_ciso: "[[Prospect CISO / Security Lead]]"
prospect_grc: "[[Compliance Director Name]]"
deal_size_arr: "$[XXX,000]"
security_posture: "Zero-Trust / Regulated Industry"
tags: [sales, enterprise-security, grc, compliance, infosec]
---

# Enterprise Security & GRC Review — [[Customer Organization]]

## 1. Prospect Threat Model & Regulatory Mandates
- **Regulatory Frameworks Applicable:** [SOC 2 Type II / HIPAA / GDPR / FINRA / FedRAMP]
- **Primary Data Classification:** Highly Confidential / Attorney-Client / Protected Health Information (PHI).
- **Core Security Stance:** Absolute prohibition against third-party AI training on corporate meeting audio.

## 2. Technical Architectural Defense
| Customer Inquiry / Control Area | Enterprise Expectation | Oyma Architectural Proof | Outcome / Status |
|---|---|---|---|
| **Audio Processing Egress** | Zero third-party audio upload | On-device Apple Silicon Core ML Whisper | Validated & Approved |
| **Data Encryption at Rest** | AES-256 with customer keys | Native macOS FileVault hardware encryption | Validated & Approved |
| **AI Model Training Policy** | Zero telemetry / zero training | Strict local execution with Ollama or BYOK | Validated & Approved |
| **SOC 2 Type II Certification** | Independent auditor report | Annual Type II report shared under NDA | Delivered |

## 3. Custom GRC Inquiries & Edge Cases
- **Device Management (MDM):** Distribution compatibility via Jamf Pro, Microsoft Intune, and Munki.
- **Endpoint Data Loss Prevention (DLP):** Verified non-interference with CrowdStrike Falcon and Zscaler client agents.

## 4. Closing Action Items & Deliverables
- [ ] [[Lead Solutions Architect]] Provide network packet capture audit report demonstrating zero outbound audio packets.
- [ ] [[Enterprise AE Name]] Transmit executed Data Processing Agreement (DPA) to customer legal counsel.
- [ ] Next security approval checkpoint scheduled for [YYYY-MM-DD].

Filled Real-World Example

Here is a realistic example demonstrating how this template captures actual deliberations:

---
title: "Security & GRC Review: BioPharm Global"
date: 2026-10-10
sales_engineer: "[[Marcus Vance]]"
account_executive: "[[Claire Dupont]]"
prospect_ciso: "[[Dr. Robert Thorne]]"
prospect_grc: "[[Helena Vance (GRC)]]"
deal_size_arr: "$240,000"
security_posture: "HIPAA & FDA Part 11 Regulated"
tags: [sales, enterprise-security, grc, compliance, infosec]
---

# Enterprise Security & GRC Review — BioPharm Global

## 1. Compliance Requirements
Dr. Thorne confirmed that clinical trial deliberations cannot be processed by cloud transcription APIs due to FDA Part 11 audit requirements and intellectual property restrictions.

## 2. Architecture Clearance
Marcus Vance demonstrated on-device Whisper transcription running on an M3 MacBook Pro in airplane mode. The security review team confirmed that because transcripts land directly in the existing enterprise-managed local folder, no additional cloud vendor risk assessment is required.

## 3. Next Steps
- Claire Dupont will issue the enterprise master services agreement for 250 clinical team seats by Monday.

When to Use and When to Avoid

When to Use

• Use during enterprise sales cycles when meeting customer CISOs, security architects, and compliance officers.
• Use to systematically address vendor security questionnaires and data sovereignty inquiries.
• Use to document security clearance milestones and proofs required for procurement sign-off.

When to Avoid

• Avoid for initial discovery qualification calls (use standard Discovery Call templates).
• Avoid for post-sale implementation bug troubleshooting.

On-Device AI Integration

Summarize your recording in Oyma with this local instruction:

Summarize the enterprise security review call:
1. Extract customer regulatory requirements, data classifications, and compliance frameworks.
2. Outline technical architecture answers provided regarding data isolation, encryption, and zero egress.
3. List remaining security questionnaire deliverables, proof assets requested, and scheduled follow-ups.
Output in clean, structured Markdown.

Your data remains securely on your Mac with zero cloud exposure.