Two hundred questions arrived from your customer's procurement team and now you're the compliance department. Send it to me instead — completed in their format, in three days, by someone who spent 35 years doing this inside a bank.
Whatever you write becomes a statement of fact in someone else's vendor file. It gets referenced at renewal. It gets quoted back at you if anything ever goes wrong.
Which is why the instinct to answer yes to everything is the expensive one. Single sign-on becomes "MFA enforced." A backup schedule becomes an RPO. A code review becomes a security review. Each one is a small false statement with a long shelf life — and reviewers who read these all day recognise the pattern immediately.
"Is multi-factor authentication enforced for all administrative access to production systems?"
Your evidence shows SSO, not enforced MFA. I will not write yes.
Fix: enforce MFA at the identity provider, then audit for console paths that bypass federation. About a day.
That's what you're actually buying. Not speed — a document you can put your name on.
Three files. The questionnaire in their format, keyed to their question numbers. A gap register for everything your evidence doesn't support. And your security profile written down once, so the next questionnaire costs you a fraction of this one.
| Control | Current state | Smallest fix that closes it | Effort |
|---|---|---|---|
| Incident response plan | Not documented | One page, named owners, one tabletop | 1–2 d |
| Access review | Never formally run | Run one, record it, book the next | ½ d |
| RTO / RPO | Backups aren't objectives | Time a restore, set the target above it | ½ d |
| Penetration test | Never performed | Book a scoped web app and API test | 6–12 wk |
| Indemnification | Contractual | Routed to your counsel — not mine to draft | — |
Most of what's missing costs days, not dollars. You'll know which ones before you submit — and closing two of them beforehand turns flags into clean answers.
The questionnaire as they sent it, plus whatever evidence exists — policies, cloud config, architecture notes, a half-finished spreadsheet. Nothing written down? That's normal at your size. We do a short call and I write down what's actually true.
One document covering hosting, identity, data, access, development, logging, incident response, compliance and subprocessors — including the gaps. This is the asset you keep.
Grounded answers quote your own evidence. Anything the evidence doesn't support gets flagged with the honest answer, the smallest fix and the effort. Contractual and insurance questions get routed to your counsel, not drafted by me.
Completed questionnaire, gap register, security profile. Plus which two or three gaps are cheap enough to close before you submit.
Message me before ordering with your question count and format — this category can't be priced from the framework name alone, because a "SIG" can be almost any length.
Add-ons: 48-hour rush +$150 · AI and LLM section +$120 · second questionnaire from the same profile +$95 · extra 100 questions +$150. SIG Core and SIG Detail run into the hundreds and thousands of questions — those are quoted individually.
Retainer: once your profile exists, $500 a quarter keeps it current and covers up to two questionnaires. Most companies receive one per enterprise deal, forever.
Not when it would be easier. Not when you ask me to. A confident wrong answer is the thing that turns a compliance exercise into a legal problem, and it is the specific risk I am paid to keep off your desk.
No SOC 2 yet? Most companies your size don't have one.
Honest answers with a remediation timeline pass procurement more often than founders expect. Optimistic yeses are what fail — and they fail late, in the follow-up call, after the reviewer has stopped trusting the rest of the document.
I don't sell certification. I don't sell software. I complete the document in front of you and tell you the truth about what's in it.
Thirty-five years as a senior network security analyst inside a bank — firewalls, access control, F5, SIEM and the audit cycle across a six-country Caribbean footprint, under continuous regulator scrutiny. I've answered these reviews and I've run them from the other side.
Before you send anything: I'll sign an NDA, and I'll tell you honestly whether your deadline is achievable rather than take the order and miss it.
Reply the same day, with a fixed price and a delivery date — not an estimate.