From documents
Answers come from facts, not recall
Each answer is drafted from the client's confirmed facts and the documents already in their workspace, and shows which fact or quote supports it.
Security questionnaires
Questionnaires answered from the client's own documents
A questionnaire answered from memory cannot be defended a year later. Here every answer points at the confirmed fact or the quoted document it came from, and anything unsupported is marked rather than guessed.
Free · No sign-up · Up to ten websites
What is a security questionnaire?
When a client sells to a larger customer, that customer sends a questionnaire: dozens to hundreds of questions about encryption, access control, sub-processors, incident response and data location. Standard formats such as CAIQ and SIG exist, but most buyers send their own spreadsheet.
For a consultant this is unbounded work attached to a fixed retainer, and it is also the riskiest writing in the practice. An answer ticked yes in March is still on file in November, and nobody can tell which answers were checked and which were remembered.
What it has to cover
- Questions about encryption, key handling and data location
- Access control, authentication and joiner-mover-leaver process
- Sub-processors, and how their changes are notified
- Incident detection, response and notification timelines
- Certifications, audits and penetration testing evidence
What changes when it is not done by hand
Honest statuses
Confirmed, to check, or a gap
An answer the facts support is marked confirmed. One that needs your eye is marked to check. One with nothing behind it is a gap with the question to ask — never a plausible yes.
Reusable
Your firm's answers accumulate
Wording you approve becomes part of your firm's library and is offered for the same question on the next client, so the second questionnaire costs less than the first.
What you get
Every vendor fact comes from our own registry: 157 vendors with the date each entry was checked.
Upload the buyer's spreadsheet
Work from the questionnaire as it arrived, in the buyer's own format and order, rather than re-keying it.
Evidence beside every answer
Each drafted answer names the confirmed fact or quotes the document behind it, so a reviewer can check it without asking you.
Gaps become questions
Unsupported questions turn into a short list to put to the client, in plain language, instead of blocking the whole return.
Firm answer library
Approved wording is reused across clients where the underlying facts match, and stays your firm's property.
Export in the buyer's format
Return the completed questionnaire as it came, under your brand.
Stays in step with the pack
Answers read the same confirmed facts as the client's documents, so the questionnaire and the DPA cannot disagree.
Get started in three steps
- 1
Upload the questionnaire
Add the buyer's file to the client's workspace. Questions are read in their original order and wording.
- 2
Draft from what is known
Answers are drafted from the client's confirmed facts and documents, each marked confirmed, to check, or a gap.
- 3
Review, fill the gaps, return it
Read the drafts, put the short gap list to the client, and export the completed questionnaire under your brand.
Questions
- Does it answer the whole questionnaire automatically?
- No, and it should not. It drafts what the client's confirmed facts support and marks the rest. The judgement about what to claim stays with you.
- What if a question has no supporting fact?
- It is returned as a gap with the question to put to the client. Nothing is answered from a guess about what is probably true.
- Can we keep our own approved wording?
- Yes. Approved answers become your firm's library and are offered again where the facts match.
- Do you send anything to the buyer?
- No. The completed file is yours to return; nothing leaves the workspace unless you export it.
- Are CAIQ and SIG supported?
- Any questionnaire you can upload as a spreadsheet is read in its own format. There is no assumption that it follows a standard.
See what changed since your clients' policies were written
Enter up to ten client websites. Free, no sign-up, the first report in about a minute.