Vendor due diligence
A prospect sent a 200-question assessment. Here is how it gets answered.
A reviewed answer library, an evidence index, a documented DPA position and a repeatable process, with up to three live questionnaires or DPAs answered during the engagement.
214 reviewed answers, each with the evidence that supports it
- Security
- Access, encryption, logging, incident response, continuity, development
- 118
- Privacy
- Lawful bases, transfers, rights, breach notification, sub-processors
- 62
- DPA positions
- Standard terms, acceptable changes, declined clauses
- 34
- Live questionnaire, 142 questions
- Answered from the library in week 2
- 142 / 142
Who this is for
Vendors where the CTO answers every questionnaire personally.
A fit
- A SaaS company of 10 to 80 people where the CTO or a founder answers every customer security questionnaire by hand.
- A vendor whose enterprise prospect sent a long security assessment and a DPA with clauses the team does not know how to respond to.
- A company that has answered questionnaires inconsistently in the past and wants one source of truth before the next renewal cycle.
Also a fit
- A company deciding whether it needs ISO 27001 or SOC 2 at all; the library is the first half of that work if it does.
- A vendor whose customers use questionnaire portals and expect answers in their format.
- A team that needs a public trust summary to send before the questionnaire arrives.
Not a fit
- Mergers and acquisitions due diligence. This service covers customer due diligence of you as a vendor.
- Negotiating contracts on your behalf. We give you the position and the redlines; your team or your lawyer sends them.
- Customer audits. We prepare the evidence and can join the call; the audit is theirs.
What you walk away with
One source of truth, and the process that keeps it true.
Every deliverable is editable and yours, inside the platform or exported as DOCX, CSV and PDF.
Vendor questionnaires and DPA review
10 deliverables, 2 to 4 weeksSecurity and privacy answer library
150 to 300 reviewed answers, true to how your controls actually work
- CSV
- DOCX
Mapping of answers to ISO/IEC 27001, SOC 2, SIG and CAIQ question sets
So answers can be pasted or imported into customer portals
- CSV
Evidence index
Which document or screenshot supports each answer
- CSV
- Platform
Trust summary document for customers
Sent before the questionnaire arrives
Sub-processor list and notification procedure
With the change notice customers expect
- CSV
- Procedure
DPA negotiation position
Standard terms, acceptable changes, declined clauses, reviewed by the practising privacy lawyer on your project
- DOCX
Vendor DPA template based on your position
GDPR Article 28 and UK GDPR equivalents
- DOCX
Questionnaire response procedure and owner matrix
Who answers what, in how many days
- Procedure
Up to three live questionnaires or DPAs reviewed and answered
The ones on your desk during the engagement
- DOCX
- CSV
Recorded hand-over and readiness sign-off
With whoever runs the process afterwards
- Video
How it works
Four weeks to hand-over. Live questionnaires answered along the way.
The questionnaire on your desk does not wait for the library; it is answered during the engagement and becomes part of it.
- GRCTrail
- Hand-over
- Without us
Week 0
Scoping call
Past questionnaires, the one on your desk, existing controls and certificates. Written fixed price within 3 business days.
Weeks 1 to 2
Assessment
Review of past questionnaires and DPAs, inventory of controls and evidence, list of answers that are missing or not true yet. Implementation price confirmed.
Weeks 2 to 3
Implementation
Answer library, framework mapping, evidence index, trust summary, sub-processor register, DPA position with lawyer review, templates, procedure. Live questionnaires answered as they come.
Week 4
Hand-over
Library exported, procedure handed to its owner, recorded hand-over, readiness sign-off.
Next questionnaire
Days, not weeks
Answered from the library by your team, evidence attached from the index. An advisory retainer is available if you want us on it.
Every quarter
Library review
Answers re-checked against how controls work now, sub-processor list updated. In GRCTrail or in your export.
How we price
What moves the price
Three things we ask about on the call.
How many questionnaires you have answered before.
Past answers, even inconsistent ones, are raw material; starting from nothing takes longer.
Which certificates you hold.
An ISO 27001 or SOC 2 programme means most answers exist and need checking, not writing.
How many live questionnaires are on the desk.
Up to three are included; more are quoted.
Never in our price, named in the quote so you can budget
- Negotiating contracts on your behalf; you get the position and the redlines
- Clause-by-clause legal advice on a specific contract; quoted separately by the lawyer named in the quote
- Penetration testing
- Answering questionnaires after hand-over, unless on a separate advisory retainer
Questions before the call
Do we need SOC 2 or ISO 27001 before answering questionnaires?
No. Most questionnaires ask what you do, not which certificate you hold. A true, consistent answer library with evidence gets most deals through. If a customer requires a certificate, the library is the first half of the ISO 27001 or SOC 2 work.
Will GRCTrail answer questionnaires for us after hand-over?
The engagement includes up to three live questionnaires. After hand-over your team runs the process. An advisory retainer is available for later questionnaires and is quoted separately.
Can the answer library be reused in questionnaire portals?
Yes. The library is exported to CSV and DOCX and is organised by the common question sets, so answers can be pasted or imported into customer portals.
Is the DPA position legal advice?
The position is reviewed by the practising privacy lawyer engaged on your project, and the review is theirs. Clause-by-clause advice on a specific contract is quoted separately.
What if an answer is not true yet?
The assessment lists those. Some are fixed during the engagement, the rest are written as what you do today with a dated plan. We do not write answers your controls cannot support.
Related
Last reviewed: October 2026
Send us the questionnaire on your desk.
You leave the call with a scope and an indicative range. The written fixed price follows within 3 business days.