Your diligence file on us, answered in advance.

We have access to nonpublic information, so a regulated client must perform diligence on us and keep the file. This page is that file.

Talk to our team The four written answers

This page is reissued whenever an answer on it changes.

Under four instruments, we are one of your third party relationships.

Which reaches you depends on your charter
Instrument	Why it matters here	Who it reaches, and who it does not
Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920	Banks.	Reaches Every bank the OCC, Federal Reserve and FDIC supervise, no asset size threshold. Status Guidance, not a rule. Not Credit unions; NCUA is not a party.
NCUA 12 CFR Part 748, Appendix A	Credit unions.	Reaches Every federally insured credit union, no asset size exemption. Vendors Appendix A, III.D, with 07-CU-13 and Supervisory Letter 07-01. Not Banks.
NAIC Insurance Data Security Model Law, Model #668	Insurance licensees.	Reaches Licensees, only where a state enacted it; the enacted text governs. Clock 72 hours to the commissioner from determining a cybersecurity event occurred, where the state is domicile or home state, or 250 or more of its consumers are involved and a further notice or harm test is met. Exempt Under 10 employees, contractors included, among others, from the written program only. Not Licensees in a state that has not enacted it.
FTC Safeguards Rule, 16 CFR 314.4(f)	Nonbank lenders, brokers and servicers.	Requires Service provider selection, contracts and periodic assessment, 314.4(f), at any consumer count; 314.6 does not remove them. Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions.

Louisiana's version, La. R.S. 22:2501 and following: Insurance. Under each, you select us on a documented basis and keep the evidence; your examiner may read it in two years.

This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.

Who you would be contracting with.

Entity: Red Stick Solutions, L.L.C., Baton Rouge, Louisiana. Formed in 2003. Procurement file: About.
Address: Not published. A full mailing address and registration details are provided on request and on every engagement contract.

References are provided at proposal stage, under NDA, on request.

The fee and duration commitment, in full.

Published scopes: The Security Assessment in Core or Full, the Platform Review, the Detection and Response Readiness Review, the AI Governance Assessment, AI Policy and Acceptable Use, and the AI Vendor and Third Party Review for one vendor.
Their fee: Fixed against that scope, in writing, in the first conversation, before you sign or grant access.
Other engagements: The first conversation ends with a written scope; its fee follows in writing before you sign.
Duration: The elapsed duration and your team's hours, in writing with the fee. You sign nothing before you have both.
No published fee: Each number is fixed against a scope, not an average.
A changed scope: We requote and show which change moved the number.
A wrong number: Once we are in your environment, you hear the day we know.
Where it applies: Every engagement; each page shows its fee rows and links here.

Answers that hold, for your vendor record.

What we collect: Only what the written scope names: system and configuration data, findings and evidence, documents you hand over, prior test and scan reports, correspondence.
Reports and evidence: Final reports and raw evidence are different items, with retention periods answered separately. One period for both deserves a question.
Access, and its return: Before anything begins we state in writing the access we need and why, at the lowest level that answers the question. You grant, scope and can revoke it at any moment without asking. At closure you confirm removal against our item by item list.
An incident affecting your material: We will tell you within two business days of becoming aware of any incident affecting your material.
Subcontractors: No subcontractor is placed on your engagement without telling you first, and what they would do. You can decline.
Continuity: If an engagement is interrupted for any reason, you keep everything produced to that point, as it stands that day. Nothing is withheld to keep the work going or that a third party would need to finish it.
Retest: One round of verification of remediated findings is included in the fee as standard on the Security Assessment, the Platform Review, the Detection and Response Readiness Review, the AI Governance Assessment, every offensive security engagement and every vulnerability program cycle. Further rounds are quoted; the proposal states the window. On other engagements it states whether a second reading is included.
First reply: Any inbound inquiry, by form, email or phone, is answered within one business day.

Where responsibility sits.

Each statement of work confirms it. Nothing here moves management authority, risk acceptance or a legal duty to us.

Responsibility by work item
Work item	You retain	This firm's role	Confirmed by
Authority and decisions	The business, scope authority, risk acceptance, legal duties, approval, production changes, remediation.	Frames decisions, convenes people, records evidence and reasoning, raises uncertainty.	Accountable and approving roles in the statement of work.
Access and evidence	Authorized access, accurate context, third party permission, evidence holders, notice of sensitive material.	Minimum evidence, agreed handling, observed kept apart from inferred, material returned or destroyed.	The written access list and evidence handling schedule.
Delivery and change	Your people and providers, dependency decisions, change approval, implementation resources, acceptance.	Named activities only, an issue and decision record, scope control, handover, agreed verification.	Roles, calendar, change control, acceptance, continuity, escalation: engagement terms.

What we will not hold at once.

Our advice is not tied to product sales. If Red Stick Solutions ever holds a commercial relationship with a product or platform it discusses with you, that relationship is disclosed to you in writing before it can affect the advice.

Red Stick Solutions will not assess or test a security program it owns as virtual CISO for the same client in the same period. Where a client wants both, the assessment or the test goes to a third party and this firm helps select one.

Full policy: Partners.

What we can send you, and when.

A mutual NDA, an MSA or your paper, a statement of work, a certificate of insurance, a W-9, your security questionnaire answered, a business continuity statement, screening attestations for anyone with access to your systems. Send your list; on receipt we say what and when.

We answer questionnaires ourselves rather than routing them. Where we do not hold something in the form you want it, we will say so rather than send you a substitute and let you find out. Confidentiality runs on the paper the engagement is signed under. See our deliverable's structure on Security Assessment.

Four answers, in writing, not published.

Ask for any of the four and you have the answer in writing within two business days.

Engagement data answers arrive before you send us anything, asked for or not. If we hold nothing in the form you want, that is the answer.

Attestation: Whether we hold a SOC 2 report or an equivalent, and its scope.
Insurance: Certificates of insurance, coverage and limits.
Screening: Screening done on anyone with access to your systems or data; we also complete your own form.
Engagement data: Where your material is stored and who can reach it; encryption in transit and at rest; how long the final report and the raw evidence are each kept, and when destroyed; any AI tooling used, and its retention and training terms.

Ask before the engagement, not after, and hold us to the answer.

Which document is your file missing?

Talk to our team

Print the firm on two sheets