Hiring help with a security questionnaire: what to check

A customer sent a security questionnaire, the due date is close, and you are wondering whether to pay someone to fill it in. This guide is for that decision: when it makes sense, what to give a contractor, what to check in what comes back, and what to settle about confidentiality before the file leaves your hands.

One disclosure first. We answer vendor security questionnaires for a flat price, so we are one of the contractors you might hire. The guide draws on our own judgment, not client work, and it includes the reasons to do the job yourself. Hold us to the same checks as anyone else.

The limit that frames everything below: help can write answers faster, but it cannot know what is true at your company. Every answer on the sheet is a statement your company makes to a customer. Our guide to answering when you don’t have the control explains why that matters. Whoever writes the words, the statements are yours, so the plan is built around keeping them true.

When to do it yourself, and when to hire

Most of the time on a first questionnaire goes to finding out what is true, not to typing. A contractor does not remove that part: someone at your company still has to say how sign-in, laptops, backups, and access really work. What a contractor does remove is the drafting, the consistency pass, and the first read for gaps. That tells you which way to lean. These are our rules of thumb, not measurements.

Do it yourself when:

• The sheet is short, a few dozen questions, and the facts are already in someone’s head. Explaining your setup to a stranger can take as long as answering.
• You have answered one before. A kept fact sheet and a past set of answers make the second one mostly a re-check.
• Your agreement with the customer does not let you share the file with anyone outside your company, or you cannot find out in time (see the NDA section below).
• You have the time and a person who owns it. Our five-day plan is built for that case.

Hiring starts to make sense when:

• The sheet is long. The full-length SIG Lite and CAIQ-Lite each run more than a hundred questions; our guide to SIG Lite and CAIQ-Lite has the counts and their sources.
• The deadline is tight and the people who know the facts are the same people shipping the product.
• Nobody on the team has written this kind of answer before, and the wording is where you are stuck, not the facts.

If you are not sure, a useful test: write down the ten facts you would need to answer the first page. If you can fill that list in an afternoon, you can probably finish the sheet yourself. If you can’t, hiring will not fix that; it will only move the question to a different inbox.

What to hand a contractor

A contractor is only as accurate as what you give them. Prepare these before you write to anyone.

• The file, as your customer sent it. The spreadsheet or document itself, not a retyped copy, with its instructions tab and the email it came with. Send it in an editable format. The due date, which product it covers, and any request to attach documents belong in the same message.
• The facts they cannot guess. A contractor cannot know whether multi-factor authentication is required for everyone, who has admin access to production, or when a backup restore was last tested. Write one line per fact, with who told you. The fact-sheet list on day 2 of our five-day plan is a good start: hosting, sign-in, access, laptops, customer data, logs, backups, incidents, your own vendors, people, and policies.
• Your existing policies and documents, each with its date and whether it is approved and in effect or still a draft. A draft is not a policy you have. Say which is which, or an answer will claim a policy that only exists as a file.
• Earlier answers, if you have any, marked with what has changed since. Facts go stale, and an old answer that is no longer true is worse than none.
• What you will and won’t say. Controls you are still building, with a date only if there is a real plan behind it. Anything you would rather not describe in writing.
• One named person at your company who can answer questions within a day. The clock on any job stops while the contractor waits for a fact.

Do not hand over passwords, keys, production access, or customer data. Describing a control takes a description, not access to it. If a contractor asks for credentials to answer a questionnaire, that is a reason to look elsewhere.

Questions to ask before you pick one

Whoever you consider, these separate a service that will protect you from one that will fill in the boxes. They are our judgment, and we answer them for our own service at the end.

1. Will you answer “Yes” for a control I don’t run? The only acceptable answer is no.
2. How will I know which answers need my check? You want a list of flagged items, not a clean-looking sheet.
3. Who reads the finished work before it comes to me, and is that a person?
4. What does the price cover: how many questions, what format, how many revisions, and what happens if my sheet is longer?
5. When does the clock start: when I pay, or when you have the file and my answers?
6. Where does my file go, who and what processes it, and how long is it kept? (More on this next.)
7. Do you promise my customer will approve? Walk away from a yes. Nobody outside that customer’s risk team can promise it.

The NDA question

This is general information, not legal advice, and we are not your lawyer. There are two confidentiality questions, and people mix them up.

1. What your customer allows

The questionnaire, and sometimes the customer’s name on it, may be covered by an NDA or by confidentiality terms in your contract or in the file itself. Before you send it to anyone, read what applies and look for who you may share it with. If it is unclear, ask your contact in one line: “Can we use an outside contractor to help complete this?” Their answer, in writing, is worth more than your guess. If the agreement is strict, or the answer is not clear, that is a question for a lawyer, not a contractor.

If you do share the file, one common precaution is to redact your customer’s name and any other third-party names first. Our own order page asks for that when a file is under an NDA.

2. What the contractor does with it

Ask these, and get the answers in writing, in an email or in the contractor’s terms:

• Who will see the file and your answers?
• Which tools and service providers process them, including any AI provider?
• Are they used for anything besides your job, such as another customer’s answers?
• How long are they kept, and can you ask for them to be deleted?

A contractor who will not say has told you something. Whether you also want a separate NDA with them depends on your agreement with the customer, which is the first question. A signed NDA with a contractor may not, by itself, make it permissible to share something your customer asked you to keep confidential. Check the first question before the second.

For us, the terms and the privacy notice are where to read this before you send anything. In short: we use what you send only to prepare your order, we use an AI provider to help draft, and we do not publish your file or use it for another customer’s order. You confirm you may share it with us and our service providers.

What to check in what comes back

Plan a review before the work arrives, and give someone other than the main contact the job of reading all of it. This is the part you cannot hand off, and it is where an honest answer set differs from a polished one.

• Every answer traces to a fact. For each answer, can you point to the line in your fact sheet that supports it? An answer you cannot trace is one to question, not to approve.
• Someone is accountable for each answer. A named person at your company should be able to defend each one on a call with your customer’s reviewer. If nobody can, change the answer. If you want it written down, add an owner column in your working copy and remove it before you send.
• Flagged items are resolved by a person. Good contractors mark what they could not confirm. Each flag needs an answer from you, not a deletion. A long sheet with no flags at all can mean the questions were not asked, not that nothing was unclear.
• No control you don’t run. Check the “Yes” answers hardest on controls that take real upkeep: multi-factor authentication for everyone, encryption of stored data, tested backups, a written incident response plan, security training, background checks, access reviews, and reviews of your own vendors. A “Yes” with no fact behind it is the one that costs you later.
• Policies named in answers exist. If an answer cites a policy, it should be approved, in effect, and dated. A policy that is still a draft is a gap, and the answer should say so.
• Gaps are stated as gaps. A “No” with what you do have beside it reads better than a stretch. A planned fix belongs in the answer only with a real plan and date. Our missing-control guide has the wording.
• Absolutes and duplicates. “All”, “always”, and “never” are true less often than they are written. And a long sheet asks the same thing twice in different words; the two answers must agree, and agree with your website, your privacy notice, and your contracts.
• Attachments exist. If an answer points to a document, you have it and can send it. A document made up to fill a slot is a problem for you, not for the contractor.
• The file is clean. Check that it still opens, that its structure and dropdowns match what your customer sent, and that no comments, internal notes, tracked changes, or another company’s name came along in the file or its properties.

Before you send it: the person who reads it should be able to say what is partial or planned, and that is what goes in your cover note. Then save the fact sheet and the final answers with the date. The next questionnaire starts from them, and it will take much less time than this one.

If you would rather hand it off

Blank Slate Creative, LLC answers vendor security questionnaires: a SIG Lite, a CAIQ-Lite, or your customer’s own sheet. We do readiness and documentation work only: never an audit, an attestation, or a certification. This guide draws on our own judgment, not client work.

Here are our answers to the questions above. You give us the facts, and we write answers that match how you actually operate, gaps included. We won’t write an answer for a control you don’t run, and we flag the items that need your check. An AI model helps draft, and a human security professional reads each completed questionnaire before it is sent to you. We can’t promise your customer will approve.

On the rest of the list: you get your sheet back as a completed .xlsx or .csv, plus a plain Markdown summary, with one revision if you ask within three business days of delivery. We keep your intake answers, your files, and what we delivered for as long as the work and our business records need; the privacy notice has the detail.

Up to 125 questions is $85, flat. Fifty more questions is +$45, so up to 175 is $130. After you pay, we email the intake questions and ask for your file, and you get the finished sheet three business days after the day we have your file and your answers (four with the add-on). Over 175 questions, we quote it. The questionnaire order page has the detail.

Sources

The advice above is our own judgment, and this guide cites no outside source for it. What it says about our service comes from our terms, our privacy notice, and the questionnaire order page. The question counts for SIG Lite and CAIQ-Lite are in our SIG Lite and CAIQ-Lite guide, which lists its own sources.