Skip to content

Questionnaires and Security Questions

Questionnaires and security questions collect structured answers for assessments, customer due diligence, and framework control review.

Common Uses

  • Customer security questionnaires.
  • Framework readiness assessments.
  • Vendor or third-party due diligence.
  • Control owner self-assessments.
  • Pre-audit information gathering.

Workflow

  1. Open Questionnaire or Security Questions.
  2. Select the relevant project, framework, or assessment.
  3. Answer each question with clear, evidence-backed detail.
  4. Attach or link supporting evidence where available.
  5. Save progress as you work.
  6. Submit answers for auditor or manager review.
  7. Update answers when controls, policies, or systems change.

Good Answers

Good answers are specific about the process, tool, owner, and frequency. They are supported by evidence, honest about partial implementation, and written in language an auditor can verify.

Access reviews are performed quarterly by the IT manager using the user access export from the identity provider. The latest review was completed on 2026-04-15 and is attached as evidence.

Review Guidance

  • Check that answers match the control requirement.
  • Confirm linked evidence supports the answer.
  • Request clarification for vague or unsupported claims.
  • Mark gaps as findings or tasks when needed.
  • Reuse strong answers across related frameworks where appropriate.