Services
A security questionnaire arrived before the evidence was ready. — with a 20-person software company
A 20-person software company received a 140-question security questionnaire from an enterprise prospect. It had no formal policies and limited evidence to support its answers.
Over two weeks, I reviewed its security controls, drafted four policies grounded in how the team actually worked, and built an evidence tracker with owners and target dates.
About the engagement
Client-identifying details have been redacted in accordance with the NDA. Some details have been generalized to protect confidentiality.
Methods and frameworks
A gap review against SOC 2 security criteria, mapped to ISO 27001 where useful, with four policies written around how the team actually works and an evidence tracker with owners and target dates.
- SOC 2 (security criteria)
- ISO 27001 mapping
- Gap analysis
- Access control policy
- Incident response policy
- Backup and recovery policy
- Acceptable use policy
- Evidence tracker
- Six-month roadmap