The documents reviewers ask for most
Across most questionnaires the same requests come up, in roughly this order of frequency:
- The information security policy, and the policies it points to: access control, acceptable use, data classification, incident response, business continuity, supplier management.
- A current certificate or attestation, if you have one: ISO 27001, SOC 2 Type II, ISAE 3000, Cyber Essentials, or your hosting provider's.
- The most recent penetration test summary, with the date, the scope and the state of the findings. The summary, not the full report, unless asked.
- The business continuity or disaster recovery plan, and evidence it was tested: the date and outcome of the last exercise.
- The data processing agreement and the list of sub-processors.
- Proof of cyber insurance: the certificate with cover and expiry.
- An organisation chart or a named security contact.
- For SaaS: the architecture overview, the data flow, and where data is stored.
Have these eight ready and named, and most questionnaires need nothing else.
What each one proves
Reviewers do not read evidence for pleasure; they read it to verify a claim. Match the document to the claim. A certificate proves that an auditor checked the scope on a date. A policy proves the rule exists and who owns it. A test summary proves someone looked for holes and what happened to the ones they found. A completed exercise report proves the continuity plan is more than a document. An answer that says "we test backups quarterly" and attaches last quarter's test log is done; the same answer with the backup policy attached invites the follow-up "but do you test it?".
Name and date everything
A reviewer opening "policy_final_v3 (2).pdf" learns nothing from the name. Name files by what they are and when: "Access control policy, reviewed 2026-05.pdf", "Penetration test summary, 2026-03, external.pdf". Put the date of the last review inside the document as well; the file name gets lost when the customer copies it into their own system.
Attach where it is asked, not everywhere
Attach a document to the question that asks for it, and refer to it by name from related questions ("see the access control policy attached to question 4.2"). Attaching the full policy set to every sheet buries the one document the reviewer needed and doubles the size of the file you send back.
Summaries for sensitive material
Some documents help an attacker as much as a reviewer: network diagrams with addresses, the full penetration test with reproduction steps, internal runbooks with system names. For those, attach a summary that gives the reviewer what they need (scope, date, categories of findings, state of remediation) and offer the full document on a call or in a data room. Most reviewers accept this without argument, because their own security team would say the same.
Keep evidence current, on a date
Evidence ages on a schedule you know in advance: the certificate expires, the test is due, the insurance renews, the policy has an annual review. Put those dates on the documents in your answer library and let something warn you before a customer does. Sending an expired certificate is the most common avoidable questionnaire failure, and it is entirely avoidable.
In Responsemate
Files in the knowledge base carry an expiry date and a freshness status, a nightly check flags what has aged, and evidence can be attached to a questionnaire answer from the library with one click, or found for you by the AI assistant when a question asks for it. How files and evidence work.
Questions people ask
Should we send our full policies to a customer?
Usually the policy itself, yes, under the confidentiality the questionnaire already sits under. Internal procedures with system names and network detail are better summarised. If a document would help an attacker more than a reviewer, send a summary and offer the full version under a call.
What if we do not have a penetration test?
Say so, say when the next one is planned, and describe what you do instead (vulnerability scanning, code review, a bug bounty). A reviewer would rather know than be sent a scan report labelled as a test.
How old can evidence be?
A certificate is valid until its expiry date. A penetration test older than a year is usually questioned. Policies should show a review within the year. If a document is older, attach it with a note on when it is next reviewed.