Customer security questionnaire support
A customer needs security answers before a deal or renewal. We help prepare an evidence-based response for your approval, with a clear account of what is verified, missing or planned.
Written quotation for your scope
The first conversation is free. Scope and price are confirmed in writing before work starts.
Discuss your customer’s questionnaireWhat you receive
Draft answers in the customer’s workbook where the format allows it, an organised evidence index and a list of gaps with owners. Each answer identifies its basis: a verified record, a stated practice still requiring confirmation, or a planned improvement. You approve and send the final response.
What determines the scope
We review questions and sub-questions, covered entities and systems, available evidence, interviews, customer portals, contractual questions and revision rounds. A short workbook with missing evidence may require more effort than a longer, well-supported one. Supported files and return format are agreed before starting.
Before you commission the work
Ask the customer what result they will accept and by when. If an ISO/IEC 27001 certificate or SOC 2 report is a hard condition and you do not have it, drafting answers will not produce it. An email question does not automatically require a separate domain audit. Necessary tests are separately scoped before commitment.
Two example scopes to compare
Example A: one entity, one workbook, existing approved policies and test records; draft answers, evidence references and one agreed review. Example B: several systems, inconsistent records and unresolved contract questions; interviews, evidence collection and separately identified technical or legal work. These are scope examples, not client cases or priced packages. We quote after reviewing complexity and available inputs.
Your time and the deadline
Provide the request, the exact date and time zone, approximate volume and a person authorised to confirm facts. Your team supplies evidence and approves statements. We allow for those dependencies before accepting a schedule; the typical 5–15-working-day range is not an urgent-delivery guarantee.
Price, changes and corrections
The written proposal fixes the outputs, price, client inputs and review rounds. We distinguish a defect in the original work from new facts or additional customer requirements before agreeing further charges. A full regulatory assessment is not a compulsory first purchase.
Sharing evidence safely
First send a description of the request without confidential attachments. We agree access and the document-exchange route before receiving sensitive records. The response can identify evidence without distributing unrestricted copies of internal reports to every customer.
Why pricing is individually quoted
We use an individually fixed price after reviewing the inputs. Question count alone does not measure missing evidence, interviews and checks. You receive scope and total price before work begins; buying another package first is not compulsory.
General scope and acceptance terms
Useful reading
Specimens and preparation for commissioning
These specimens and worksheets show how outputs, your participation and acceptance are recorded. Specific terms are completed and agreed for the engagement.