Security questionnaires
Security questionnaires, answered from your own policies.
Send us the questionnaire your customer gave you and the policies you already have. We draft every answer from your documents, a Fortress engineer reviews each one, and you get the completed file with a clear list of gaps.
The problem
Questionnaires hold up deals.
A customer’s security questionnaire can run to hundreds of questions, and the deal waits until it’s answered. The work usually falls to whoever knows your systems best, and it takes them days away from their actual job.
Most of the answers are already in your policies. The hard parts are finding them, wording them consistently, and being honest about what your documents don’t cover.
How it works
From your documents to reviewed answers
Send the questionnaire and your policies
The file your customer sent, as it is, and the policies and procedures you already have. We’ll give you a secure way to send them.
We draft every answer from your documents
Drafts are written with AI assistance, working only from your documents. Each answer points to the document and the passage it relies on.
A Fortress engineer reviews every answer
An engineer checks each draft against the source passage, corrects it, and marks anything your documents don’t support.
You get the completed file and a list of gaps
The answered questionnaire, plus every question your documents don’t support, grouped by topic, with suggested next steps.
Before you start
What we need, and what we don’t do
What we need from you
- The questionnaire exactly as your customer sent it.
- Your existing security policies and procedures, such as information security, access control, incident response, business continuity and vendor management.
- The date your customer needs the answers by.
- Someone who can answer our follow-up questions about how things actually work.
Supported formats
- Questionnaires: SIG Lite, SIG Core, CAIQ, HECVAT, or a custom questionnaire in a spreadsheet.
- If the questionnaire lives in an online portal, export it to a spreadsheet if the portal allows it, or ask us first.
- Policies: the documents you already have, such as Word files or PDFs. We convert them to text for drafting.
What we don’t do
- We don’t attest, sign or certify anything on your behalf.
- We don’t invent controls or describe practices your documents don’t support.
- We don’t answer without evidence. Where your documents are silent, the answer is marked as needing your input.
- We don’t submit the questionnaire. You review the answers and submit them, and they remain your company’s statements.
- This is not an audit or an assessment of whether your controls work.
Gaps
Where your documents fall short, we say so.
Every question your documents don’t support is listed with what’s missing and a suggested next step, such as writing or updating a policy, confirming a practice that happens but isn’t written down, or answering “No” honestly. If you want help closing the gaps afterwards, that’s a separate conversation.
Your documents
How your documents are handled
How AI is used
Answers are drafted with AI and reviewed by a person.
We draft the answers with AI assistance (Claude, made by Anthropic). The model works only from the documents you send, and it’s told to mark a question as needing your input whenever those documents don’t support an answer.
A Fortress engineer then reviews every answer against your documents before you receive anything. You review the result again before you submit it.
- Your documents are used only for your engagement.
- To draft answers, the text of your documents is sent to our AI provider, Anthropic, through its API.
- Don’t send documents through the request form or by email. We’ll reply with a secure way to send them.
- Ask us how your documents are handled before you send them, and tell us if your customer or your contracts limit where they can go.
Price
Price and turnaround
- Price
- $750 per questionnaire, up to 300 questions. Larger questionnaires are quoted.
- Turnaround
- 5 business days from receiving your questionnaire and documents.
Request a quote
Tell us about the questionnaire.
No files here. Tell us what you’ve received and when it’s due, and we’ll reply with next steps and a secure way to send the documents.
Questions
Common questions
Which questionnaires can you work with?
SIG Lite, SIG Core, CAIQ, HECVAT, and custom questionnaires that come as a spreadsheet. If yours is in an online portal, ask us first.
Do you use AI to write the answers?
Yes. Answers are drafted with AI assistance from your documents only, and a Fortress engineer reviews every answer before you receive it.
Will the answers make us look more secure than we are?
No. Every answer has to be supported by your documents. Where they don’t support one, the question is marked as needing your input and listed in the gaps, rather than filled in with a guess.
Who is responsible for the answers?
Your company is. We prepare and review drafts; you check them, change what needs changing, and submit them as your own statements. We don’t attest or sign anything for you.
What if we don’t have written policies?
Send the request anyway and choose “No” or “Some”. Without documents most answers will be marked as needing input, and the gaps list shows which policies would cover the most questions.
How much does it cost, and how long does it take?
The current price and turnaround are shown on this page. If your questionnaire is unusual, send a request first and we’ll confirm before you pay.
How do we send our documents?
Not through the request form and not by email. Once we have your request, we’ll reply with a secure way to send the questionnaire and your policies.
Can you help us close the gaps?
Yes, as separate work. Tell us what you’d like help with and we’ll discuss the scope.