Guide

Questionnaire-prep guide

Most questionnaire time is lost to re-researching the same answers. Prep the sources up front and a reviewer's job gets much faster.

Before the questionnaire arrives

Keep your core policies (InfoSec, Access Control, Incident Response) current — most questionnaires ask about them directly.
Keep a running answer library of your best, most recently approved responses instead of starting fresh each time.
Know your own scope: which frameworks you hold, what a SOC 2/ISO cert covers, and what it doesn't.

When it lands

Identify the format — a bespoke spreadsheet, or a standard one like SIG or CAIQ — since standard formats map more predictably to your existing answers.
Extract every question up front, including ones buried in extra tabs or oddly merged cells, before assigning anyone to answer.
Flag any question that's actually new — not covered by an existing policy, control, or past answer — early, since those need real research time.

Drafting answers

Ground every answer in something real: a policy, a passing control, or a previously approved answer — not a generic assurance.
Note the source each draft answer came from, so a reviewer can verify it quickly instead of re-researching it.
Treat low-confidence or unsupported drafts as a signal to research the question properly, not to soften the wording instead.

Review before sending

Have a human read and approve every answer — nothing should go out unreviewed, however confident the draft looks.
Check that answers are internally consistent — the same fact shouldn't be stated two different ways in the same document.
Confirm the completed file is returned in the format the buyer sent, not a reformatted version that's harder for their team to ingest.

After you send it

Save every newly approved answer back into your library so the next questionnaire is faster.
Note any question you had to research from scratch — that's a gap in your library worth closing before it comes up again.

This is exactly what questionnaire automation does: draft answers grounded in your policies and evidence, reviewed by your team before anything is sent.

See questionnaire automation Back to resources

Before the questionnaire arrives

Keep your core policies (InfoSec, Access Control, Incident Response) current — most questionnaires ask about them directly.

Keep a running answer library of your best, most recently approved responses instead of starting fresh each time.

Know your own scope: which frameworks you hold, what a SOC 2/ISO cert covers, and what it doesn't.

When it lands

Identify the format — a bespoke spreadsheet, or a standard one like SIG or CAIQ — since standard formats map more predictably to your existing answers.

Extract every question up front, including ones buried in extra tabs or oddly merged cells, before assigning anyone to answer.

Flag any question that's actually new — not covered by an existing policy, control, or past answer — early, since those need real research time.

Drafting answers

Ground every answer in something real: a policy, a passing control, or a previously approved answer — not a generic assurance.

Note the source each draft answer came from, so a reviewer can verify it quickly instead of re-researching it.

Treat low-confidence or unsupported drafts as a signal to research the question properly, not to soften the wording instead.

Review before sending

Have a human read and approve every answer — nothing should go out unreviewed, however confident the draft looks.

Check that answers are internally consistent — the same fact shouldn't be stated two different ways in the same document.

Confirm the completed file is returned in the format the buyer sent, not a reformatted version that's harder for their team to ingest.