A list of things to ask about the state of a company
Who has access to production systems?
Who has access to staging/development/pre-production?
Who has access to any/all source code repositories?
Who has access to deploy to production?
How often are system passwords rotated?
How often are user passwords rotated?
How many people are on the on call rotation?
Does development/engineering participate in on call/emergency response?
Do backups exist?
How often are backups tested (e.g. restored and validated)?
How many network links exist for production?
How many network links exist to each office?
Who has administrative access to email/account management?