Build the asset that survives every questionnaire: one cited answer per control, with evidence, owner, status, and a verification date. Three worked examples and 30 sample answers show the shape of defensible responses — the cited “yes”, the tested control, and the honest gap with a compensating control. Question wording is ThinSky’s own; swap in your customer’s exact questions as they arrive (the official SIG is licensed by Shared Assessments and is not reproduced here).
Disclaimer. Sample answers — illustrative only. Replace every row with your organisation's verified responses before submitting to any customer or auditor. Questions about a specific row? Email sales@thinsky.com or visit https://thinsky.com/saq3/?ref=csv — same engineers who wrote this template.
Every highlighted row is sample information — overwrite each one with your organisation’s verified response before sending to a customer.
| Ref | Domain | Question (example wording — replace with your customer’s) | Sample answer | Evidence / citation | Owner | Status | Last verified | Framework mapping |
|---|---|---|---|---|---|---|---|---|
| 1 | Access Control | Do you review user access rights on a defined schedule? | Yes — access reviews run quarterly across all production systems; the most recent review completed in May 2026. | Access Control Policy v2.1, §4; Q2-2026 access review report | Head of Engineering | Verified example | 2026-06-10 | ISO 27001:2022 A.5.18 / NIST CSF PR.AC-1 / CSA CCM IAM-11 |
| 2 | Incident Response | Do you have a documented incident response plan that is tested? | Yes — documented IR plan with severity definitions and escalation paths; last tabletop exercise ran in March 2026. | Incident Response Plan v1.3; tabletop exercise notes 2026-03 | CTO | Verified example | 2026-06-10 | ISO 27001:2022 A.5.24 / NIST CSF RS.RP-1 / CSA CCM SEF-01 |
| 3 | Business Resilience | Do you test backup restoration? | Partially — automated daily backups with monthly restore verification for the primary database; full DR failover test is on the roadmap for Q4 2026. | Backup & Recovery Runbook; restore-verification log | Platform Lead | Gap (compensating control) example | 2026-06-10 | ISO 27001:2022 A.8.13 / NIST CSF PR.IP-4 / CSA CCM BCR-08 |
| 4 | Enterprise Risk Management | Do you maintain a risk register reviewed by leadership? | Yes — a quarterly-reviewed risk register tracks security, operational, and compliance risks with named owners and remediation timelines; the most recent leadership review was completed in May 2026. | Risk Register v3.2; leadership review minutes 2026-05 | CTO | Sample answer | 2026-06-12 | ISO 27001:2022 6.1 / NIST CSF ID.RM-1 / CSA CCM GRC-02 |
| 5 | Enterprise Risk Management | Is there a named owner for information security risk? | Yes — the CTO is the executive owner of information security risk and chairs the quarterly risk review with the security and engineering leads. | Security Governance Charter §2.1 | CTO | Sample answer | 2026-06-12 | ISO 27001:2022 5.3 / NIST CSF ID.GV-2 / CSA CCM GRC-06 |
| 6 | Security Policy | Do you maintain a written information security policy approved by management? | Yes — the Information Security Policy is reviewed annually and approved by the executive team; current version v2.4 was approved in February 2026. | Information Security Policy v2.4 (signed approval page) | CTO | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.1 / NIST CSF ID.GV-1 / CSA CCM GRC-07 |
| 7 | Security Policy | How often are security policies reviewed and re-approved? | Annually at minimum, or sooner when a material change in scope, technology, or regulatory environment triggers an interim review. | Policy Management Procedure §3.2 | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.1 / NIST CSF ID.GV-1 / CSA CCM GRC-08 |
| 8 | Organisational Security | Do employees receive security awareness training at hire and periodically after? | Yes — security awareness training is delivered within the first 30 days of hire and refreshed annually thereafter, with role-based modules for engineering and customer-facing teams. | Training completion records (LMS export, 2026) | People Operations | Sample answer | 2026-06-12 | ISO 27001:2022 A.6.3 / NIST CSF PR.AT-1 / CSA CCM HRS-12 |
| 9 | Organisational Security | Are background checks performed where legally permitted? | Yes — third-party background checks (identity, criminal record where permitted, employment history) are completed before offer acceptance for all employees and contractors with access to customer data. | Pre-employment Screening Procedure §1.4 | People Operations | Sample answer | 2026-06-12 | ISO 27001:2022 A.6.1 / NIST CSF PR.IP-11 / CSA CCM HRS-02 |
| 10 | Asset & Information Management | Do you maintain an inventory of systems that store or process customer data? | Yes — a cloud-asset inventory is maintained in the CMDB and reconciled monthly against cloud-provider billing data; assets storing or processing customer data are tagged `data-class:customer`. | CMDB export; monthly reconciliation report (2026-05) | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.9 / NIST CSF ID.AM-1 / CSA CCM DCS-06 |
| 11 | Asset & Information Management | Is customer data classified and handled according to a data classification standard? | Yes — a four-tier classification standard (Public / Internal / Confidential / Restricted) governs storage, transmission, and access; customer data is Confidential by default and Restricted where it includes regulated information. | Data Classification Standard v1.2 | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.12 / NIST CSF ID.AM-5 / CSA CCM DSP-02 |
| 12 | Access Control | Is multi-factor authentication enforced for remote and administrative access? | Yes — MFA is enforced on all SSO-protected applications, VPN access, and administrative consoles via phishing-resistant authenticators (WebAuthn/FIDO2 primary, TOTP fallback). | Identity Provider configuration export; MFA enforcement policy | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.5 / NIST CSF PR.AC-7 / CSA CCM IAM-14 |
| 13 | Access Control | Are privileged accounts separated from day-to-day user accounts? | Yes — administrators use separate, named privileged accounts that are not used for email or general productivity; just-in-time elevation through Teleport is required for production access. | Privileged Access Policy §2.3; Teleport audit log | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.2 / NIST CSF PR.AC-4 / CSA CCM IAM-09 |
| 14 | Access Control | Is access revoked within a defined time after termination? | Yes — termination triggers a documented offboarding workflow that revokes SSO, hardware tokens, and physical access on the employee's last working day, with completion logged within 24 hours. | Offboarding Runbook; HRIS-SSO deprovisioning integration logs | People Operations | Sample answer | 2026-06-12 | ISO 27001:2022 A.6.5 / NIST CSF PR.IP-11 / CSA CCM IAM-10 |
| 15 | Application Security | Is code reviewed before release to production? | Yes — every change requires a peer pull-request review and a passing CI gate (lint, type-check, unit and integration tests, SAST) before merge; direct pushes to production branches are blocked at the repository level. | Branch protection rules export; PR audit log | Head of Engineering | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.28 / NIST CSF PR.IP-2 / CSA CCM AIS-03 |
| 16 | Application Security | Do you run security testing (SAST/DAST or penetration tests) on a defined schedule? | Yes — SAST runs on every pull request, DAST runs nightly against staging, and an independent third-party penetration test is performed annually with findings triaged into the next sprint. | Third-party pentest report (2026-Q1); CI security scan history | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.29 / NIST CSF DE.CM-8 / CSA CCM AIS-05 |
| 17 | Application Security | How are secrets and credentials managed in your build and runtime environments? | Secrets are stored in AWS Secrets Manager and injected at runtime via IAM-scoped roles; build-time secrets use short-lived OIDC tokens from GitHub Actions to AWS — no long-lived credentials exist in source control or CI variables. | Secrets Management Standard §2; OIDC trust policy | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.24 / NIST CSF PR.AC-1 / CSA CCM EKM-04 |
| 18 | Network Security | Is network access segmented between production and corporate environments? | Yes — production runs in dedicated AWS accounts isolated from corporate networks; access requires SSO + MFA + just-in-time elevation through Teleport, with no direct corporate-to-production routes. | Network architecture diagram; AWS account boundary export | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.22 / NIST CSF PR.AC-5 / CSA CCM IVS-06 |
| 19 | Network Security | Are firewalls or security groups reviewed on a schedule? | Yes — security groups and WAF rules are reviewed quarterly; drift between defined IaC and live configuration is detected daily via automated scans and remediated within one business day. | Quarterly review log; drift-detection alerts (2026-Q2) | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.20 / NIST CSF PR.AC-5 / CSA CCM IVS-04 |
| 20 | Server Security | Are systems hardened to a documented baseline and patched on a defined cadence? | Yes — production hosts use immutable container images built from a hardened base; CVE scanning runs on every build, with critical CVEs patched within 7 days and high within 30 days per policy. | Patch Management Policy §3; CVE remediation report (2026-05) | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.8 / NIST CSF PR.IP-12 / CSA CCM TVM-02 |
| 21 | End User Device Security | Are laptops encrypted and centrally managed? | Yes — all employee laptops are MDM-enrolled with full-disk encryption (FileVault/BitLocker) enforced, screen-lock policies applied, and EDR running with central alerting. | MDM compliance dashboard export | IT Operations | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.1 / NIST CSF PR.DS-1 / CSA CCM UEM-06 |
| 22 | Cloud Hosting | Which cloud providers and regions host customer data? | Customer data is hosted on AWS in `us-east-1` (primary) and `us-west-2` (disaster recovery). No customer data is processed or stored outside these regions without explicit customer consent. | Hosting Disclosure Statement v1.5 | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.23 / NIST CSF ID.SC-3 / CSA CCM DSP-19 |
| 23 | Cloud Hosting | Is customer data encrypted at rest and in transit? Which algorithms/protocols? | Yes — AES-256 at rest using AWS KMS (customer-managed keys available on request) and TLS 1.2+ in transit; legacy protocols are disabled at the load balancer. | Encryption Standard §1.1; SSL Labs report (A+) | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.24 / NIST CSF PR.DS-2 / CSA CCM CEK-03 |
| 24 | Operations Management | Do you maintain audit logs for production systems and review them? | Yes — production application, infrastructure, and identity logs are centralised in our SIEM with 90-day hot retention and 13-month cold retention; on-call engineers triage detection alerts 24/7. | Logging & Monitoring Standard; SIEM detection coverage matrix | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.15 / NIST CSF PR.PT-1 / CSA CCM LOG-01 |
| 25 | Operations Management | Is there a documented change management process for production changes? | Yes — production changes follow a documented process: peer-reviewed PR, automated test gate, staged rollout, and a documented rollback plan; emergency changes follow an expedited path with post-hoc review at the next change board. | Change Management Policy v2.1 | Head of Engineering | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.32 / NIST CSF PR.IP-3 / CSA CCM CCC-01 |
| 26 | Incident Response | Will you notify customers of a security incident within a defined timeframe? | Yes — customers are notified of confirmed security incidents affecting their data within 72 hours of detection, with regular status updates until resolution, per our contractual notification commitment. | MSA §8 (Incident Notification); Incident Response Plan v1.3 | CTO | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.25 / NIST CSF RS.CO-2 / CSA CCM SEF-06 |
| 27 | Business Resilience | Do you have documented business continuity and disaster recovery plans? | Yes — documented BC and DR plans cover personnel, facilities, and the production environment; the DR plan defines failover sequencing for the primary AWS region and is reviewed annually. | Business Continuity Plan v1.4; Disaster Recovery Plan v2.0 | CTO | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.30 / NIST CSF RC.RP-1 / CSA CCM BCR-01 |
| 28 | Business Resilience | What are your recovery time (RTO) and recovery point (RPO) objectives? | Production environment: RTO 4 hours, RPO 15 minutes. Tier-2 services: RTO 8 hours, RPO 1 hour. | DR Plan v2.0 §2 (RTO/RPO matrix) | Platform Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.30 / NIST CSF ID.BE-5 / CSA CCM BCR-09 |
| 29 | Threat Management | Do you perform vulnerability scanning and track remediation to closure? | Yes — authenticated vulnerability scans run weekly against production and dependency scans run on every build; findings are tracked in our ticketing system with SLAs of 7 days (critical), 30 days (high), 90 days (medium). | Vulnerability Management Standard; remediation SLA dashboard | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.8.8 / NIST CSF DE.CM-8 / CSA CCM TVM-04 |
| 30 | Privacy | Do you have a privacy policy covering collection, use, and retention of personal data? | Yes — a published privacy policy describes data collection, lawful bases, processing purposes, retention periods, and data subject rights; it is reviewed annually and on material change. | Privacy Policy (public, v3.1) | Privacy Officer | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.34 / NIST CSF ID.GV-3 / CSA CCM DSP-01 |
| 31 | Privacy | Do you support data subject deletion/export requests within defined timelines? | Yes — verified data subject requests (access, export, deletion) are fulfilled within 30 days; requests are tracked in a dedicated workflow with audit logging of approval and completion. | Data Subject Rights Procedure §2.4; DSR ticket log | Privacy Officer | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.34 / NIST CSF ID.GV-3 / CSA CCM DSP-17 |
| 32 | Third Party / Supply Chain | Do you assess the security of your own subprocessors and vendors? | Yes — vendors with access to customer data complete a security review (SIG-Lite or equivalent, plus SOC 2 / ISO 27001 evidence where applicable) before contract signing and are reassessed annually. | Vendor Risk Management Procedure; Vendor Inventory (2026-Q2) | Security Lead | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.19 / NIST CSF ID.SC-2 / CSA CCM STA-09 |
| 33 | Third Party / Supply Chain | Will you provide your subprocessor list and notify customers of changes? | Yes — the current subprocessor list is published on our trust page and customers are notified at least 30 days in advance of material changes by email and trust-page update. | Subprocessor List (public trust page); Customer Notification Procedure §1 | Privacy Officer | Sample answer | 2026-06-12 | ISO 27001:2022 A.5.21 / NIST CSF ID.SC-3 / CSA CCM STA-11 |
| — | Next steps | What if I can't answer most of these rows for my organisation yet? | We answer SIG Lite, CAIQ, SOC 2 evidence requests and similar questionnaires in three business days for $750 introductory. Email sales@thinsky.com or visit https://thinsky.com/saq3/?ref=csv with the questionnaire and your deadline. | — | — | Service info | 2026-06-27 | — |
Every acronym used in this template, expanded for reviewers and new owners. Keep this section intact when you replace the sample answers with your own.
| Acronym | Meaning |
|---|---|
| AES-256 | Advanced Encryption Standard with a 256-bit key — current at-rest encryption baseline. |
| AWS | Amazon Web Services — the cloud platform referenced in the sample hosting answers. |
| BC | Business Continuity — keeping the business running through disruption. |
| BC plan | Business Continuity Plan — documented procedures for sustaining operations during disruption. |
| CAIQ | Consensus Assessments Initiative Questionnaire — Cloud Security Alliance's vendor questionnaire. |
| CI | Continuous Integration — automated build/test pipeline that runs on every code change. |
| CMDB | Configuration Management Database — the system-of-record inventory of IT assets. |
| CVE | Common Vulnerabilities and Exposures — the public catalogue of disclosed vulnerabilities (cve.org). |
| DAST | Dynamic Application Security Testing — runtime security testing against a deployed app. |
| DR | Disaster Recovery — restoring systems after a major failure or outage. |
| DR plan | Disaster Recovery Plan — documented procedures for restoring systems after a disaster. |
| DSR | Data Subject Request — a privacy request to access, export, or delete personal data. |
| EDR | Endpoint Detection and Response — endpoint security tooling that detects and responds to threats. |
| FIDO2 | Fast Identity Online 2 — open authentication standard for phishing-resistant credentials, usually paired with WebAuthn. |
| HRIS | Human Resources Information System — the system-of-record for employee data. |
| IaC | Infrastructure as Code — defining cloud infrastructure in version-controlled config files (e.g., Terraform). |
| IAM | Identity and Access Management — the AWS service (and broader discipline) governing who can do what. |
| IR | Incident Response — the process and team that handles security incidents. |
| ISO 27001 | International Organization for Standardization 27001 — the international standard for information security management systems. |
| KMS | Key Management Service — AWS-managed encryption key service. |
| LMS | Learning Management System — platform that delivers and tracks training (used for security awareness). |
| MDM | Mobile Device Management — central management of laptops/phones (configuration, policy, wipe). |
| MFA | Multi-Factor Authentication — requiring more than a password to authenticate. |
| MSA | Master Services Agreement — the master commercial contract under which work is delivered. |
| OIDC | OpenID Connect — identity-layer protocol used here for short-lived federated credentials between CI and AWS. |
| PR | Pull Request — a proposed code change submitted for review before merge. |
| Q1 / Q2 / Q3 / Q4 | Calendar quarters (Q1 = Jan–Mar, Q2 = Apr–Jun, Q3 = Jul–Sep, Q4 = Oct–Dec). |
| RPO | Recovery Point Objective — the maximum acceptable data loss measured in time. |
| RTO | Recovery Time Objective — the maximum acceptable downtime before service is restored. |
| SAST | Static Application Security Testing — security scanning of source code without running it. |
| SIEM | Security Information and Event Management — central log aggregation, correlation, and alerting platform. |
| SIG | Standardized Information Gathering — Shared Assessments' vendor security questionnaire. |
| SIG Lite | Lightweight, shorter version of the SIG questionnaire. |
| SLA | Service Level Agreement — contractual performance commitment (here, time-to-remediate by severity). |
| SOC 2 | System and Organization Controls 2 — AICPA audit framework attesting to security/availability controls. |
| SSO | Single Sign-On — one identity provider authenticating users across many applications. |
| SSL Labs | Qualys SSL Labs — public TLS configuration grading service (ssllabs.com). |
| TLS | Transport Layer Security — modern encrypted transport protocol (successor to SSL). |
| TOTP | Time-based One-Time Password — six-digit code generated by an authenticator app. |
| VPN | Virtual Private Network — encrypted tunnel for remote access to a private network. |
| WAF | Web Application Firewall — application-layer firewall that filters HTTP/S traffic. |
| WebAuthn | Web Authentication — W3C standard for phishing-resistant authentication, usually paired with FIDO2. |