- Home
- FAQ
FAQ
Good questions. Straight answers.
What we do, what we don't do, and what happens when you get in touch.
Getting started
Is this a penetration test?
No. The pilot reviews supplied evidence within an agreed scope. It does not attack or test live systems.
Will sending an enquiry start a scan?
No. Contacting us does not trigger a website request, DNS lookup or security check. Any assessment needs a separately agreed scope and written permission from an authorised party.
Can you guarantee that we are secure?
No. The review states what was assessed, what was found and what remains unknown. Unknown evidence is not treated as a pass.
Do you need passwords or customer data?
No. Do not send passwords, API keys or customer records. Evidence requirements are agreed separately.
Can you work with our IT provider?
Yes. Findings and evidence questions can be discussed with your designated IT provider.
How much does it cost?
Scope, price and timing are agreed before work starts. Remediation and repeat reviews are not automatically included.
Is SAP support part of the QuickScan?
No. SAP consulting is a separate service, and the QuickScan does not connect to SAP.
SAP Security
What does an SAP security consultant do?
An SAP security consultant designs and reviews who can do what in SAP: roles, authorizations, segregation of duties and access reviews. At 0Confusion, that work is separate from the cybersecurity QuickScan.
Is 0Confusion an SAP partner?
No. 0Confusion is independent. SAP is a registered trademark of SAP SE, and 0Confusion is not affiliated with SAP SE.
Do we need SAP GRC to manage segregation of duties?
No. SAP Access Control is one way to do it, not the only way. A smaller company can start with a clear ruleset and SAP's standard reports, though that takes more manual work.
Can you fix an audit finding for us?
We can work with you on what the finding means, what to change and how to show it. Your auditor decides whether a finding is closed, so nobody can promise that outcome.
Do you log in to our SAP system?
Only if that is part of the agreed scope and your organisation has given permission. Many first conversations need no system access at all.
Cybersecurity QuickScan
What is the Cybersecurity QuickScan?
A scoped pilot review of evidence you supply about your website, email and access settings. A person reviews the findings before delivery, and the report says what remains unknown.
What do the review categories cover?
C01 HTTPS/TLS, C02 security headers, C03 website configuration, C04 software and CMS indicators, C05 domain and DNS, C06 email SPF, DKIM and DMARC, C07 privacy indicators, C08 login and accounts, C09 booking and ordering dependencies, and C10 risk aggregation and evidence review. C10 connects the findings and is not a tenth technical scan. Coverage is agreed individually.
What do we get?
A management summary, findings with their supporting evidence, unknown parameters and limitations, and recommended priorities or further investigation. PDF is the main format, with JSON when needed.
Is the sample report about a real company?
No. The sample report uses fictional data. It is not a customer assessment, a security score or a result about your business.
Does the review make us GDPR compliant?
No. The review looks for notice indicators. A privacy policy does not establish GDPR compliance, and we don't give legal or vendor-security certification.
Do you fix what you find?
Not automatically. Remediation and repeat reviews are not included unless agreed. Findings and questions can be discussed with your IT provider.
