Security Questionnaire Response System

QUESTIONNAIRE RESPONSE

Response Library Template

SECURITY QUESTIONNAIRE RESPONSE LIBRARY

CATEGORY: Access Control

Q: Do you use multi-factor authentication?
STANDARD RESPONSE:
Yes. We require MFA for all employees accessing company systems.
MFA is enforced via [SSO Provider] for all applications.

EVIDENCE:
☐ SSO configuration screenshot
☐ MFA policy document
☐ Access control policy

---

CATEGORY: Data Security

Q: Is data encrypted at rest?
STANDARD RESPONSE:
Yes. All data at rest is encrypted using AES-256 encryption.
Database: [AWS RDS / Cloud SQL] with encryption enabled.
Storage: [S3 / GCS] with server-side encryption.

EVIDENCE:
☐ Encryption configuration
☐ Data protection policy
☐ SOC 2 report reference

---

CATEGORY: Incident Response

Q: Do you have an incident response plan?
STANDARD RESPONSE:
Yes. We maintain a documented incident response plan that includes:
- Defined incident severity levels
- Response team and escalation procedures
- Communication protocols
- Post-incident review process

EVIDENCE:
☐ Incident response policy
☐ IR team contact list
☐ Recent incident report (redacted)

Questionnaire Intake Tracker

QUESTIONNAIRE TRACKING

QUESTIONNAIRE #: _______________
Customer: _______________
Received: _______________
Due date: _______________
Owner: _______________

STATUS: ☐ Received ☐ In Progress ☐ Review ☐ Submitted

QUESTIONNAIRE TYPE:
☐ Standard (SIG, CAIQ, VSAQ)
☐ Custom
☐ Vendor assessment portal

QUESTIONS:
Total: ___
Answered from library: ___
New responses needed: ___
Requires evidence: ___

REVIEW:
☐ Technical review complete
☐ Legal review (if needed)
☐ Final approval

SUBMITTED:
Date: _______________
Method: ☐ Portal ☐ Email ☐ Document

Common Question Categories

Category	Questions	Library Coverage
Access control		___%
Data security		___%
Incident response		___%
Business continuity		___%
Vendor management		___%
Compliance		___%
Physical security		___%
HR security		___%

Evidence Library Checklist

EVIDENCE LIBRARY

CERTIFICATIONS:
☐ SOC 2 Type II report (current)
☐ ISO 27001 certificate (if applicable)
☐ Penetration test summary
☐ Insurance certificates

POLICIES (current versions):
☐ Information Security Policy
☐ Access Control Policy
☐ Data Protection Policy
☐ Incident Response Policy
☐ Business Continuity Policy
☐ Vendor Security Policy
☐ Acceptable Use Policy

PROCEDURES:
☐ Access provisioning process
☐ Offboarding checklist
☐ Change management process
☐ Backup procedures

TECHNICAL EVIDENCE:
☐ Encryption configuration
☐ MFA configuration
☐ Network diagram
☐ Architecture diagram

REFRESH SCHEDULE:
| Evidence | Last Updated | Next Review |
|----------|--------------|-------------|
| SOC 2 | | |
| Policies | | |
| Pen test | | |
| Diagrams | | |

Response Quality Checklist

☐ All questions answered ☐ Responses accurate and current ☐ Evidence attached where requested ☐ No confidential info disclosed ☐ Legal review (high-value deals) ☐ Technical accuracy verified ☐ Consistent with prior responses

---

Quick Reference: Which Resource for Which Challenge

Challenge	Recommended Resources
"Building security program"	#553
"SOC 2 certification"	#554, #555
"Incident preparedness"	#556
"Access management"	#557
"Vendor security"	#558
"Data protection"	#559
"Security training"	#560
"GDPR compliance"	#562
"Security monitoring"	#564

---

Every resource built to the Human Standard. Every resource designed to protect your business and enable growth.