Questionnaires your client can still defend a year later
A questionnaire answered from memory is a liability with a delayed fuse. The answer stays on file long after the person who wrote it has forgotten what it rested on, and when a customer asks for the evidence behind a ticked box there is nothing to produce.
The alternative is not more caution, it is traceability: every answer points at the confirmed fact or the quoted document behind it, and anything with nothing behind it is marked rather than guessed. That also happens to be what makes the second questionnaire cheaper than the first.
Guides
Long-form, written for a practitioner.
- Answering vendor security questionnaires at scale
A method for answering questionnaires from a client's documented facts, marking what needs checking and building a reusable answer library.
- How to scale a privacy practice past 20 clients
What breaks between 10 and 40 clients, and the operating habits that keep documentation current without hiring for every new engagement.
Notes
Shorter pieces on one thing that changed.
- An answer needs a state: confirmed, to check, or gap
A bare "yes, it's encrypted" cannot be defended a year later. A fact with a state, an owner and an expiry date can.
- The German NIS2 clocks a consultant has to track
BSIG 2025 registration, change and incident deadlines with their section numbers, and the order to put them in place for a German client.
- When a vendor has no public data processing agreement
What to ask for, what a customer-specific DPA changes about the annex, and how to record "asked, no response" so the file stays honest.
Doing this work
What the product does with it.
- Security questionnaires
Answer vendor security questionnaires from the facts and documents a client already confirmed, with every answer marked confirmed, to check or a gap, and a reusable answer library per firm.
- Trust pages
Publish a client's security and privacy information as a page on their own domain, under your brand: sub-processors, measures and documents, updated from the same confirmed facts as their pack.
Reference
The pages the facts come from.
See what changed since your clients' policies were written
Enter up to ten client websites. Free, no sign-up, the first report in about a minute.