The shape of an answer that passes
Every answer below does four things in a few sentences: it names the control, it names who owns it, it says how often it happens, and it says where the evidence is. The weak versions do the opposite: they reassure. Reviewers are paid to be unmoved by reassurance.
Access control
Question: How are user access rights granted, reviewed and revoked?
Weak: We follow the principle of least privilege and access is strictly controlled.
Better: Access is requested through a ticket and approved by the system owner; accounts are created with the role's default rights only. The IT lead reviews all access rights quarterly against the HR list, and the review is recorded in the ticketing system. Access is revoked on the last working day as part of the HR leaver checklist. The access control policy is attached.
Encryption
Question: Is customer data encrypted at rest and in transit?
Weak: Yes, we use industry-standard encryption.
Better: In transit, all connections use TLS 1.2 or later; older protocols are disabled at the load balancer. At rest, databases and backups are encrypted with AES-256 using keys managed by the hosting provider's key service; keys are rotated yearly. Laptops are full-disk encrypted and managed centrally.
Backups
Question: How often are backups taken and tested?
Weak: Backups are taken regularly and can be restored if needed.
Better: Databases are backed up every hour with point-in-time recovery and retained for 35 days; file storage is replicated across two regions. A full restore into a separate environment is tested quarterly by the platform team; the last test was in June and the log is attached. Recovery point objective is one hour, recovery time objective is four hours.
Incident response
Question: Do you have an incident response plan, and when was it last exercised?
Weak: We have a comprehensive incident response process.
Better: The incident response plan is owned by the head of engineering and defines severity levels, the on-call rota, communication with customers within 24 hours for incidents affecting their data, and a post-incident review within five working days. It was last exercised in a tabletop in March with a simulated credential leak; the findings were closed in April. The plan is attached.
Vulnerability management
Question: How do you identify and fix vulnerabilities?
Weak: We patch promptly and monitor for vulnerabilities.
Better: Dependencies are scanned on every build and the operating system images weekly; findings are triaged by severity with fix targets of 7 days for critical and 30 days for high. An external penetration test is performed yearly; the March summary is attached with all findings closed. Security fixes are released outside the normal release cycle when needed.
Sub-processors
Question: Which third parties process customer data?
Weak: We only work with trusted, compliant providers.
Better: Customer data is processed by our hosting provider (EU region), our e-mail delivery provider and our AI provider, each under a data processing agreement. The current list with locations and purposes is published on our website and customers are notified of changes 30 days in advance. Our own staff access production data only through named accounts with logging.
Business continuity
Question: How would you continue service in the event of a major outage?
Weak: We have redundancy in place to ensure high availability.
Better: The service runs in two availability zones with automatic failover; a full regional failure is covered by the backups and infrastructure-as-code, with a tested rebuild time of four hours. The continuity plan names the decision maker and the customer communication path. Last exercised in the quarterly restore test; result attached.
Staff and training
Question: Do employees receive security training?
Weak: All staff are trained in security awareness.
Better: Every employee completes security awareness training in their first week and yearly after that, tracked by HR; the current completion rate is 100 per cent. Engineers additionally complete secure development training yearly. Phishing simulations run quarterly, and the results feed the next training.
Why these work
Each better answer could be checked by a reviewer in five minutes, and a reviewer who can check one answer trusts the next one more. The weak answers cannot be checked at all, so they earn a follow-up question and, over two hundred rows, a reputation. Responsemate drafts answers in the better shape from your own policies and past answers, with the source attached, so the review is checking facts rather than writing prose. How drafting works.
Questions people ask
Can we reuse these examples?
Only the shape. Every fact in them is invented. An answer copied from a website is a claim you cannot support, and reviewers ask follow-up questions.
How long should an answer be?
Two to four sentences for most questions. Long enough to name the control, the owner, the frequency and the evidence. Anything longer usually means the answer is reassuring rather than informing.