SaaSFort How to answer a security questionnaire fast
A prospect sent you a 200-row SIG or CAIQ and the deal is paused until you return it. Most of the technical rows ask about things that are externally observable: TLS, certificates, security headers, DNS, exposed services. You can answer those in minutes with evidence, instead of guessing. Here is the workflow, and the document you attach so procurement stops asking follow-ups.
The four-step workflow
- 1
Scan your own domain first
Run the free scan before you open the spreadsheet. You get an A to F grade and 66 findings across 25 categories, each mapped to a control. Now you are answering from evidence, not memory.
- 2
Map findings to the questionnaire rows
TLS version, HSTS, certificate validity, security headers, DMARC, and exposed-service rows are answered directly from the scan. The report maps each finding to NIS2 Article 21 and ISO 27001 Annex A, which is the control language most questionnaires use.
- 3
Attach the PDF as evidence
Instead of writing "yes, we use TLS", attach the dated report that shows it. Procurement teams accept evidence faster than assertions, and it cuts the follow-up round that usually adds a week.
- 4
Re-scan before each renewal
Questionnaires recur per deal and per renewal. A fresh scan keeps your answers current and shows progress over time rather than a single snapshot.
The Audit Pack is built for exactly this
The €39 Audit Pack gives you the full control-mapped PDF, 90 days of re-scans, and a dated attestation you can drop straight into a questionnaire, a DDQ, or a data room. One-time, no subscription.
Frequently asked questions
Which security questionnaire rows can a scan actually answer?
The externally-observable ones: TLS version and cipher configuration, certificate validity and chain, HSTS and other security headers, DMARC and SPF, DNSSEC, and exposed administrative services. That is typically a meaningful slice of the technical section of a SIG or CAIQ. It will not answer internal-policy rows like access reviews or employee training, which need your own documentation.
Do procurement teams accept a scan report as evidence?
For the external-posture rows, a dated third-party scan report is stronger than a self-asserted "yes". It shows the actual configuration with a timestamp. Most procurement reviewers prefer attachable evidence because it removes a follow-up question. Pair it with your policy docs for the internal rows.
How fast can I turn a questionnaire around with this?
The scan itself takes about 60 seconds. Mapping the findings to the technical rows and attaching the PDF is usually under an hour for the external-posture section. The internal-policy rows still take your own time, but the part that used to stall on "let me check our config" is done immediately.
What is the difference between the free scan and the €39 Audit Pack?
The free scan shows your grade and findings on screen. The Audit Pack adds the downloadable control-mapped PDF, 90 days of re-scans, and a dated attestation, which are the artifacts you attach to a questionnaire. If you only need to answer one questionnaire, the one-time pack is the fit.
Related: The vendor security assessment guide · The security evidence pack for enterprise deals · Audit Pack · Scan your domain free (60s)