Managed service for B2B SaaS and software companies
Security questionnaire completion service
A customer’s procurement or security team has sent a questionnaire and a deal is waiting on it. Send it to us with the documentation you already have, and we return an evidence-backed draft. Anything your documents don’t support is flagged for you, not guessed.
When this fits
You have a questionnaire, a deadline and a team with other work to do.
Security questionnaires arrive from enterprise customers during procurement, at renewal, and inside RFPs. They can run to hundreds of questions, and they are usually answered by whoever in your company knows the most about security, alongside their real job.
This service is for B2B SaaS and software companies that already have security policies and documentation but need the questionnaire completed accurately and quickly, without adopting a new platform. You send the questionnaire and your material. We do the mapping, drafting and flagging. You review and approve.
We work as a managed service: you don’t log in to a tool or configure anything. Your existing documentation is the source, and the customer’s own file is the format we return.
What we complete
The questionnaires customers actually send.
Standardised questionnaires and customer-specific ones. We’re set up for these formats; this is not a record of past engagements.
- Due diligence questionnaires (DDQ)
- SIG and SIG Lite
- CAIQ
- Customer and vendor security questionnaires
- Security sections of RFPs and procurement forms
- Enterprise security assessments
- Excel, Word and portal-based questionnaires
What you send, what you get
Send what you already have. Get back something you can review.
You send
- The questionnaireIn the format it arrived: Excel, Word, a portal export or similar
- Security policies and procedures
- Certifications and audit reportsWhere you hold them
- Technical and architecture documentation
- Previously approved questionnaire responsesWhere available
You get
- A completed draftIn the customer’s own file or format
- Evidence mappingEach supported answer points to its source document
- Flagged questionsUnsupported or uncertain answers marked, not guessed
- A list of items needing your approval
- Reusable approved answersKept with their evidence for the next questionnaire
You don’t need a complete documentation set to start. Tell us what you have and we’ll say what is likely to be unsupported before drafting begins.
How it works
From questionnaire to approved answers.
Send the questionnaire details
Use the enquiry form to tell us what has arrived, its format, roughly how many questions it contains and your deadline. Please don’t send sensitive documents through the form.
We review the scope
We check the questionnaire against what you can provide, and agree what we need and how confidential material will be handled before anything sensitive is exchanged.
We draft from your evidence
Each answer is drafted only from the material you supply and tied to its source. Where the material is silent or ambiguous, the question is flagged instead of answered.
You review the exceptions
You confirm, correct or supply evidence for flagged items. Nothing is presented to your customer as fact until you have approved it.
You receive the completed draft
The completed questionnaire in the required format, plus the approved answers and their evidence, ready to reuse on the next one.
Evidence first
Every answer is supported or flagged.
Each question in the draft carries one of three statuses, so you can see at a glance where your attention is needed.
- Supported
- The material you supplied answers the question, and the answer cites where.
- Review required
- The material is partial or ambiguous, or the answer needs your judgement. For example, a policy requires training but doesn’t say how often.
- Missing evidence
- Nothing supplied supports an answer. You provide evidence, or answer it yourself.
Source material
Documentation that makes a draft stronger.
Most questionnaires draw on the same core material. Whatever you hold is a useful starting point.
Policies
Information security, access control, acceptable use, data retention and classification, secure development and change management.
Operational procedures
Incident response, backup and recovery, business continuity, vulnerability and patch management, onboarding and offboarding.
Technical documentation
Architecture overviews, hosting and infrastructure descriptions, encryption and key handling, logging and monitoring, subprocessor lists.
Certifications and reports
Any audit reports, certifications or independent test summaries issued to you. We don’t need them to start, and we never assume you hold one.
Boundaries
What we won’t do.
A questionnaire is a set of representations your company makes to a customer. They have to be true, and they have to be yours.
- Invent controls that aren’t in your documentation
- Claim certifications you don’t hold
- Manufacture evidence
- Present assumptions as verified facts
- Make legal attestations on your behalf
- Require production credentials or access to your systems
You remain responsible for approving every final representation. This is not an audit, a certification or legal advice.
FAQ
Questions we expect.
Is this software or a service?
A service. You send the questionnaire and your documentation, and we return a completed draft for your review. There is no platform to implement or log in to.
What happens if our documentation doesn’t cover a question?
We don’t fill the gap with a guess. The question is marked as review required or missing evidence, with a note on what is unclear, and you decide whether to supply evidence, confirm the position or answer it yourself.
Do you need access to our systems?
No. We work from the documents you send. If a question can only be answered by inspecting a live system, we flag it for you to answer.
Do you provide SOC 2 or ISO 27001 certification?
No. We don’t audit, certify or attest. We help you answer questionnaires from the evidence you already hold, including any certifications or reports issued to you.
How long will it take, and what will it cost?
That depends on the questionnaire’s size and format and the state of your documentation. Give us the deadline in your enquiry and, once we have reviewed the scope, we will tell you plainly whether it is feasible and what it involves.
Related
Related questionnaire types
Request a questionnaire review
Have a security questionnaire waiting?
Tell us what you’ve received, its format and your deadline. We’ll review the scope and let you know what we need to complete it.