Tag
Security Questionnaires
19 articles
Trust and sales
The security page buyers check first
What a public security page needs on its first screen, the sections that follow, how to write claims a reviewer believes, and the red flags they notice.
6 min read
Risk and vendors
Vendor security questionnaires that get answers
How to design and send vendor security questionnaires that come back complete: sizing by tier, reusing reports, writing answerable questions, and follow-up.
6 min read
Compliance frameworks
What a SOC 3 report is for
A SOC 3 is the public summary of a SOC 2 examination. What it contains, what it deliberately leaves out, where it helps sales, and where buyers still want more.
6 min read
Trust and sales
Security addendums and what to negotiate
A clause-by-clause guide to a customer's security addendum: incident notice, audit rights, prescribed controls, subprocessors, deletion, and liability.
6 min read
Trust and sales
Security commitments in customer contracts
Where security commitments hide in customer contracts, the types you will find, why your SOC 2 report depends on them, and how to keep a register that works.
6 min read
Trust and sales
Security reviews for startups without a report yet
How a startup with no SOC 2 report can still pass a buyer's security review: what to offer instead, how to present the audit timeline, and what to avoid.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Trust and sales
Explaining shared responsibility to customers
How a SaaS provider explains which security controls it runs, which its cloud provider runs, and which customers own, in a matrix and in questionnaire answers.
6 min read
Compliance frameworks
How to read a SOC 2 report as a buyer
A buyer's order for reading a vendor's SOC 2 report: the opinion, period, scope, carve-outs, user entity controls, and test results, and what to record.
6 min read
AI governance
The AI questions now in security questionnaires
The AI questions customers add to security questionnaires, what each one is testing, the facts to gather before answering, and the answers that go wrong.
6 min read
Trust and sales
Sharing penetration test results with buyers
What buyers want from your penetration test, what a summary letter should contain, how to discuss open findings honestly, and when to share more detail.
6 min read
Compliance frameworks
What a SOC 2 bridge letter is and when buyers ask for one
What a SOC 2 bridge letter covers, who signs it, why it carries no auditor assurance, when buyers ask for one, and how to keep the gaps it covers short.
6 min read
Trust and sales
Answering due diligence questionnaires
What a vendor due diligence questionnaire asks beyond security, who should own each section, and how to handle financials, continuity and signed attestations.
6 min read
Compliance frameworks
HITRUST vs SOC 2 for healthcare buyers
How a HITRUST certification and a SOC 2 report differ in who issues them, what they test and how long they last, and how to tell which your buyer needs.
6 min read
Trust and sales
Handling an enterprise security review
A stage-by-stage playbook for an enterprise security review: intake questions, the standard package, the questionnaire, follow-up calls, and findings.
6 min read
Trust and sales
Gating documents behind an NDA
How to gate a SOC 2 report and other security documents: choosing the NDA mechanism, setting approval rules, expiring access, and keeping a usable log.
6 min read
Trust and sales
What to put on a Trust Center
The documents and facts a Trust Center should carry, which belong in public view and which behind an NDA, and what should never be published there at all.
6 min read
Trust and sales
Building a security answer library
How to structure a security answer library: the fields each entry needs, how to seed it from past questionnaires, and the review rules that keep it true.
6 min read
Trust and sales
SIG, CAIQ and custom questionnaires compared
How the SIG, the CAIQ and a buyer's custom questionnaire differ in origin, structure and use, and when to complete a standard one before anyone asks.
6 min read