Context
During a Stage 2 audit, auditors typically interview developers and technical leads. They're checking whether secure development practices are real — not just documented.
Questions Auditors Commonly Ask
About the Development Process
•"Walk me through how a feature goes from idea to production."
•"Who reviews code before it's merged?"
•"How do you handle security requirements in user stories?"
•"Show me a recent pull request with a security-relevant review comment."
About Environment Management
•"How many environments do you have? How are they separated?"
•"Can developers access production data?"
•"How do you manage secrets and credentials in code?"
•"Show me that production and development are separated."
About Dependency Management
•"How do you track third-party libraries and their vulnerabilities?"
•"What happens when a critical CVE is published for a library you use?"
•"How often do you update dependencies?"
•"Show me your dependency scanning tool and recent results."
About Testing
•"Do you perform security testing? What kind?"
•"Show me evidence of a recent security test and how findings were resolved."
•"How do you handle test data — do you use production data in test environments?"
About Deployment
•"Who can deploy to production?"
•"Is the deployment automated? Show me the pipeline."
•"What happens if a deployment fails? Walk me through rollback."
•"How do you verify a deployment was successful?"
How to Prepare Your Team
1. Do a Mock Interview
Run through these questions with your developers before the audit. Most developers aren't used to audit interviews.
2. Have Evidence Ready
Auditors love seeing real examples. Prepare:
•A sample PR with review comments
•Pipeline configuration showing security gates
•Dependency scan results
•Environment architecture diagram
3. Be Honest
If something isn't perfect, say so and explain what you're doing about it. Auditors respect honesty far more than polished non-answers.
4. Speak Naturally
Developers should describe their actual workflow, not recite policy documents. Auditors can tell the difference.