Security Questionnaire & RFP Response Service
Every enterprise deal arrives with a security questionnaire — SIG, CAIQ, a customer spreadsheet or an RFP security section. We build your answer library from your real controls, complete questionnaires inside an agreed turnaround, have a CISO review every submission, and stand up a trust center so many requests never need a questionnaire at all. AI-assisted drafting keeps it fast; a named practitioner keeps it accurate.
In scope
- Answer library built from your policies, controls and audit reports
- Questionnaire completion (SIG, CAIQ, custom spreadsheets, portals)
- CISO review of every submission
- Trust center setup and upkeep
- Gap log: questions you cannot yet answer 'yes' to
You receive
- Maintained answer library
- Completed questionnaires within the agreed turnaround
- Public or gated trust center
- Quarterly gap report that feeds your security roadmap
Tiers
Choose the depth.
Essential Questionnaire Support
$950 / mo
Up to 3 questionnaires a month, 5-business-day turnaround, answer library and a basic trust center page. Limit key 'sessions' = questionnaires per month.
- sessions
- 3
Advanced Questionnaire Support
$2.5K / mo
Up to 10 a month, 3-day turnaround, gated trust center with document requests and quarterly gap report
- sessions
- 10
Enterprise Questionnaire Desk
$6.5K / mo
Fair-use volume up to 40 questionnaires a month, 48-hour turnaround, RFP security sections and live customer security calls with a CISO.
- sessions
- 40
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a advisory & fractional leadership engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Onboarding & baseline
Current program, risks, commitments and stakeholders reviewed.
You see · Access to leadership and existing documents.
02Priorities & roadmap
A risk-ranked roadmap agreed with leadership.
You see · Decisions on priorities and budget.
03Ongoing cadence
Regular working sessions, decisions and deliverables to the agreed scope.
You see · A named advisor and a standing rhythm.
04Reporting to leadership
Board and executive reporting in business terms.
You see · Board-ready updates.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Non-Human & Machine Identity Security
Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.
Zero Trust Security Assessment
Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches.
CISO Comprehensive Security Assessment
Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation.
Research
Latest from the blog
incident-response · Nov 4, 2026
Critical Node-RED Flaw Under Active Exploitation: CVE-2026-58115 Hits Siemens Gateways
A maximum-severity authentication bypass in Node-RED is being exploited to drop Linux bots and webshells on Siemens SIMATIC IoT2050 gateways. VulnCheck says the exploit is trivial to weaponize.
incident-response · Oct 31, 2026
The r3@lg00dp@$$w0rd Pentest Story: A Lesson in Patching Over Password Cleverness
A penetration tester used a 2019 Windows flaw to compromise 2,500 machines at a law firm that spent $500,000 on security tools, exposing a CISO's plaintext password along the way.
incident-response · Oct 29, 2026
CISA's AA26-237A Advisory: Two SOCs, Two Outcomes, One Detection Checklist
CISA's AA26-237A advisory compares two red-teamed SOCs with opposite outcomes, giving CISOs a concrete checklist for finding detection gaps before an adversary does.
Start an engagement