FAQs

Clear answers before you define a security engagement.

Review engagement fit, scope, delivery mode, evidence, responsibilities, and commercial terms. Ask Yojo to confirm details for your environment in writing.

Scope and authorisation

State the decision or work required, the systems and organisations inside the boundary, relevant deadlines, and the people who can confirm technical and commercial information.

.faq-enhanced { display: none !important; }

Scope and authorisation

What should we define before asking for a proposal?

State the decision or work required, the systems and organisations inside the boundary, relevant deadlines, and the people who can confirm technical and commercial information.

Who authorises assessment or response activity?

The client must identify a person authorised to approve the written scope, access, methods and constraints. Yojo does not test or access systems on an informal request.

Deliverables and evidence

Which deliverables will we receive?

The proposal identifies the work products agreed for the engagement, such as a findings register, assessment report, control record, escalation path or handover note. Deliverables depend on the purchased work.

What makes a finding supportable?

A useful finding states the review boundary, observed condition, evidence used, relevant consequence, affected owner and the decision or follow-up required. Point-in-time limitations remain visible.

Information handling

Should we send sensitive security material through the public form?

No. Use the public form to describe the requirement at a high level. Do not include credentials, secrets, exploit details, personal data, incident evidence or production artefacts.

How is an evidence-transfer method agreed?

Evidence access, permitted recipients, storage expectations and return or deletion requirements must be recorded for the engagement before sensitive material is exchanged.

MDR and incident boundaries

What must be agreed for managed detection and response?

The written scope should identify telemetry sources, monitoring periods, investigation responsibilities, notification paths, client contacts, exclusions and the service-review rhythm. Unlisted systems or periods should not be assumed.

Is the contact form an incident-response channel?

No. The public form is not an emergency or monitored incident channel. Incident support, availability and escalation arrangements apply only when they have been confirmed in writing.

Procurement and commercial terms

When are price and delivery terms provided?

Commercial terms follow a defined requirement. The proposal should state the work, dependencies, client responsibilities, delivery arrangement, fees, payment terms and change process.

Can procurement requirements be included during scoping?

Yes. Share required contracting steps, supplier records, purchase-order constraints and review contacts early enough for them to be reflected in the proposal timetable.

Specialist support and scheduling

What information is needed for a specialist requirement?

Describe the work products, systems, stakeholders, access, working arrangement, internal owner, assignment period and handover standard. A role title alone is not enough to confirm fit.

How are dates and specialist availability confirmed?

Share the required window and material deadlines. Yojo will review the requirement and confirm whether a suitable arrangement and schedule can be proposed; availability is not implied before written confirmation.

Still deciding?

Describe your environment, priority risk, and required outcome.

Discuss your requirement

Clear answers before you define a security engagement.

Scope and authorisation

01What should we define before asking for a proposal?+

02Who authorises assessment or response activity?+

Describe your environment, priority risk, and required outcome.