Security Questionnaire Library

STANDARD RESPONSES

Security Response Categories

SECURITY QUESTIONNAIRE CATEGORIES

DATA SECURITY:
☐ Encryption at rest (AES-256)
☐ Encryption in transit (TLS 1.2+)
☐ Data classification
☐ Data retention/deletion
☐ Backup and recovery

ACCESS CONTROL:
☐ Authentication methods
☐ SSO support
☐ Role-based access
☐ MFA requirements
☐ Session management

INFRASTRUCTURE:
☐ Hosting environment
☐ Network security
☐ Vulnerability management
☐ Penetration testing
☐ Monitoring and logging

COMPLIANCE:
☐ SOC 2 certification
☐ GDPR compliance
☐ HIPAA (if applicable)
☐ Industry-specific
☐ Privacy practices

INCIDENT RESPONSE:
☐ Incident process
☐ Notification procedures
☐ Breach history
☐ Business continuity
☐ Disaster recovery

Quick Response Matrix

Topic	Standard Response	Evidence Doc
Encryption	AES-256, TLS 1.2	Security whitepaper
SOC 2	Type II certified	SOC 2 report
Pen testing	Annual, third-party	Pen test summary
Backups	Daily, encrypted	DR policy

---

EVIDENCE LIBRARY

Documentation Checklist

SECURITY EVIDENCE LIBRARY

CERTIFICATIONS:
☐ SOC 2 Type II report
☐ ISO 27001 (if applicable)
☐ Industry certifications
☐ Third-party audits

POLICIES:
☐ Information security policy
☐ Privacy policy
☐ Acceptable use policy
☐ Incident response plan
☐ Business continuity plan

TECHNICAL DOCS:
☐ Architecture diagram
☐ Data flow diagram
☐ Network diagram
☐ Encryption specifications

PROCESS DOCS:
☐ Access control procedures
☐ Change management
☐ Vendor management
☐ Employee training records

---