A security questionnaire often arrives in the middle of a sale, from a buyer’s procurement team, with a deadline and a spreadsheet of 100 to 300 questions. For a small company without a security team, it can take a week of someone’s time. We draft the answers from what you already have, mark every answer with where it came from, and list the questions you cannot answer yet, so your time goes into reviewing and fixing rather than writing from scratch.
What’s included
- The questionnaire filled in, in the buyer’s own format (spreadsheet, Word, or copied answers for a web portal), up to 300 questions.
- Each answer marked with its source: which of your documents or intake answers it came from. Answers we could not support are left marked "needs your input" rather than guessed.
- A gap list: questions where the honest answer is "no" or "not yet," with a plain note on what it would take to change that answer, sorted by how often buyers ask.
- An answer library in a spreadsheet: question themes and your approved answers, so the next questionnaire starts from it.
- One round of revisions after you review the draft.
What we need from you
- The questionnaire file, and the deadline the buyer gave you.
- Whatever you already have: security policies, a SOC 2 or ISO report or bridge letter if you have one, previous questionnaires you answered, your privacy policy, architecture or hosting notes, insurance details.
- Answers to our short intake email covering the basics most questionnaires ask: hosting provider, sign-in and MFA, encryption, backups, device management, staff onboarding and offboarding, incident history you are willing to share, and subprocessors.
- Please remove secrets, keys and internal hostnames from anything you send.
Turnaround
4 business days from receiving the questionnaire, your documents, the intake answers and payment, including one business day for Emilio’s review. If your buyer’s deadline is tighter, tell us before you pay and we will say whether we can meet it.
Scope
Included
- One questionnaire, up to 300 questions, for one organization.
- Standard formats such as SIG Lite, CAIQ, VSA or a buyer’s custom spreadsheet.
Not included
- Logging into a buyer portal on your behalf. We give you the answers to paste in.
- Inventing controls or claiming certifications you do not have.
- Talking to the buyer’s security team.
- Questionnaires over 300 questions. Email us for a fixed quote.
Who does the work
Emilio Santos does the work, with AI assistance. He uses general-purpose AI tools to help sort, draft and check, which means parts of what you send are processed by those tools. He reads every line of what you send and every line of the deliverable before it goes to you.
Your data
- Send files by email to circuits50capital@circuits.fit. They arrive and are stored in that mailbox.
- Please remove passwords, keys, account numbers, payment card numbers and protected health information before sending. We never ask for system access or credentials.
- Parts of your material are processed by AI tools as part of the work. Where a tool’s settings let us turn off the use of our inputs for model training, we turn it off, and we do not use your files to train models.
- We delete your files and our working copies within 30 days of delivery. Copies kept by email or AI providers under their own retention or backup schedules may last longer, and we do not control those.
- We do not sell or share your material except with the email and AI services used to receive and process it. See the privacy policy. If you would rather your material not be processed by AI tools, say so when you order and we will tell you whether we can do the work without them.
How to order
- Email circuits50capital@circuits.fit with the subject "Security Questionnaire Draft" and a short description. You can attach files now or after we reply.
- We confirm the scope with you by email.
- Payment is arranged after the scope is confirmed. The turnaround starts once payment is in.
After the scope is confirmed by email, you’ll be sent a secure Stripe card payment link.
FAQ
Will you make our answers look better than they are?
No. Every answer comes from what you tell us or send us. If the honest answer is no, the draft says no and the gap list explains the fix. A buyer who later finds an overstated answer is a bigger problem than a gap.
We have no policies yet. Can we still order?
Yes, but expect more answers marked as gaps. Some teams order a Security Policy Set at the same time.
Do you work with MSPs?
Yes. We can draft for an MSP’s client and leave our name off. Each client questionnaire is a separate order.
What free tools help here?
The vendor claim checker and SBOM request pack cover the other side: questions you ask your own vendors.
Disclaimer
Answers are drafted only from the information you give us. You review, correct and submit them as the author; we don’t attest to your controls. This is not a certified audit, attestation or legal advice.
Circuit & Capital services are research, writing and advisory deliverables prepared with AI assistance and reviewed by Emilio Santos before delivery. They are not legal, tax, accounting, audit or compliance-certification services, and no attorney-client, auditor or fiduciary relationship is created. You decide what to act on and remain responsible for your contracts, deadlines, security controls, filings and submissions. Our total liability for any order is limited to the fee paid for that order. If a deliverable doesn’t match its published scope, tell us within 14 days and we’ll fix it or refund it.