What questionnaires built on each framework ask
What a security questionnaire built on ISO 27001, SOC 2, NIS2, DORA, GDPR or ISAE 3000 asks for, and how to answer it from your own policies and evidence.
DORA third-party questionnaires, and how to answer them
If you sell software or services to a bank, an insurer, a payment institution or a fund manager in the EU, DORA has turned their vendor process into something closer to an audit. Here is what they ask and why.
Read the framework → FrameworkGDPR vendor assessment questionnaires, and how to answer them
The privacy section of a questionnaire is where vendors lose the most time, because the questions are legal rather than technical. They are also the most repetitive, so once the answers are written, they are written.
Read the framework → FrameworkISAE 3000 and 3402 reports, and the questionnaires that ask for them
In Northern Europe the question is rarely "do you have SOC 2" and often "do you have an ISAE 3000 report". Here is what the report is, what it covers, and what to say if you do not have one yet.
Read the framework → FrameworkISO 27001 security questionnaires, and how to answer them
Many customer questionnaires are ISO 27001's Annex A turned into questions. If you know the structure, you know what is coming, and a well-kept answer library covers most of it.
Read the framework → FrameworkNIS2 supplier questionnaires, and how to answer them
NIS2 makes thousands of EU organisations responsible for the security of their supply chain. Their suppliers are finding that out one questionnaire at a time.
Read the framework → FrameworkSOC 2 questionnaires, and how to answer them
Customers who ask about SOC 2 want two things: your report, if you have one, and answers organised by the five trust services criteria if you do not. Both are easier than they look.
Read the framework →