Key takeaways
- Prepare a reusable evidence pack
- Answer honestly, including gaps and plans
- Keep answers consistent across clients
The first 300 question spreadsheet from a bank or a US enterprise tends to arrive in the middle of a deal, with a two week deadline. Teams that keep these documents ready answer in days. Teams that do not spend the fortnight writing policies under pressure.
Documents to keep ready
- Information security policy and acceptable use policy.
- Privacy policy and a data processing agreement template.
- Data flow diagram and personal data inventory.
- Access control and incident response procedures.
- Summary of your latest penetration test.
- Business continuity and backup summary.
- AI use policy, if AI is part of your service.
Good practice
- Keep a library of approved answers and review it every quarter. Most questionnaires ask the same fifty things in different words.
- Be honest about gaps, and share the plan and date to close them. Buyers handle a clear "not yet, here is when" far better than an answer that falls apart in the audit.
- Give questionnaires one owner, so the answer you sent one client matches the answer you send the next.
Have a question about this guide? Write to us or ask Colony, our AI guide.